Defense in depth — the Microsoft way (part 82): INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2

Read Time:20 Second

Posted by Stefan Kanthak on Feb 22

Hi @ll,

in Windows 11 22H2. some imbeciles from Redmond added the following
(of course WRONG and INVALID) registry entries and keys which they
dare to ship to their billion world-wide users:

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSrpGp]
“RuleCount”=dword:00000002
“LastWriteTime”=hex(b):01,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSrpGpDLL]

JFTR: the time stamp is 100ns past…

Read More