Unable to add exceptions using GetExeFilesToDenyList.ps1 about aaronlocker HOT 5 CLOSED

Use the -Rescan switch to force it to update what's in ScanResults.

from aaronlocker.

BTW - why do you want to block Msiexec?

from aaronlocker.

That worked!

I'm blocking it because it is categorized in Mitre’s Att&ck Framework as T1218.007
Defense evasion > Signed binary proxy execution > Msiexec
This technique has been used by a number of threat actors.

from aaronlocker.

OK. "AaronLocker" already blocks .MSI files that aren't explicitly approved. And blocking Msiexec completely means that users can't run approved MSIs for approved apps (e.g., Zoom/WebEx). I don't know whether Office still does this, but it used to run an MSI on a user's first run of an Office app to complete the user portion of the installation.

from aaronlocker.

I agree. I tested it and it certainly brakes things. This is not a good idea.

Thanks for your help!

from aaronlocker.