Defender ASR rules block coreutils

Ouverte
  • Quelque chose ne va pas ?
#183 5 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
25/100
Type d'issue
Bug
Clarté
À clarifier
Activité
Active
Stack technique
rust
Domaine
cli, operating-systems

Piste de recherche

No source files, tests, or entry points are named. Start by reproducing the coreutils installation failure on Windows with the listed Defender Attack Surface Reduction rules, then review the attached error and determine whether compatibility or a workaround requires input from the Defender PG; done means the interaction and an agreed resolution are documented.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

I installed coreutls on a machine where the following Defender Attack Surface Reduction rules have been deployed:

Name                                                                                              Action GUID
----                                                                                              ------ ----
Block executable files from running unless they meet a prevalence, age, or trusted list criterion        01443614-cd74…
Block JavaScript or VBScript from launching downloaded executable content                                d3e037e1-3eb8…
Block process creations originating from PSExec and WMI commands                                  Block  d1e49aac-8f56…
Use advanced protection against ransomware                                                        Block  c1db55ab-c21a…
Block executable content from email client and webmail                                            Block  be9ba2d9-53ea…
Block executable content from email client and webmail                                            Block  be9ba2d9-53ea…
Block untrusted and unsigned processes that run from USB                                          Block  b2b3f03d-6a65…
Block credential stealing from the Windows local security authority subsystem (lsass.exe)         Block  9e6c4e1f-7d60…
Block all Office applications from creating child processes                                       Block  d4f940ab-401b…
Block credential stealing from the Windows local security authority subsystem (lsass.exe)         Block  9e6c4e1f-7d60…
Block Adobe Reader from creating child processes                                                  Block  7674ba52-37eb…
Block Office applications from injecting code into other processes                                Block  75668c1f-73b5…
Block execution of potentially obfuscated scripts                                                        5beb7efe-fd9a…
Block Office applications from creating executable content                                        Block  3b576869-a4ec…
Block Office applications from creating executable content                                        Block  3b576869-a4ec…
Block Office communication application from creating child processes                              Block  26190899-1602…
Block Office communication application from creating child processes                              Block  26190899-1602…
Block Win32 API calls from Office macro                                                           Block  92e97fa1-2edf…
Block persistence through WMI event subscription                                                         e6db77e5-3df2…

And this has resulted in the following error message:
Image

You might want to check with the Defender PG to check whether there is a way to get around this.

Thanks!

Langage dominant
Rust
Étoiles
5.3k
Forks
112
Merge moyen
1 h 26 min
PR mergées (30 j)
3

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de microsoft/coreutils

Toutes les issues de microsoft/coreutils

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.