RUNDLL32.EXE

Question

RUNDLL32.EXE

amandaw33 opened this issue 5 years ago · 5 comments

heads up for me blocking %SYSTEM32%\RUNDLL32.EXE by publisher caused pinned items to stop working on win10 1809.

thanks for all your work on these rules.

Answer 1 · 2020-02-20T21:44:30.000Z

Thanks for the info. Note that blocking rundll32 is not supported and it is kinda expected that it will break something.

Answer 2 · 2020-02-20T22:15:12.000Z

It's listed here, no? Sorry if I'm misunderstanding.

https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/AppLocker-BlockPolicies/PublisherBlockRules-EXE.xml

Answer 3 · 2020-02-20T22:23:30.000Z

api0cradle commented 5 years ago

Answer 4 · 2020-02-20T22:24:38.000Z

I have added it, but I do not recommend the blocking rules to be used actively in production without proper testing since it might actually break stuff. The most scary binary is the rundll32 for sure

Answer 5 · 2020-02-20T22:46:31.000Z

Thanks just wanted to make sure I wasn't misunderstanding the rules set. I did test, then moved it to prod and ran it for a week before anyone noticed 😁 cheers!