Forum Discussion

HignettP's avatar
HignettP
Copper Contributor
May 17, 2022

ASR Exception for Block Credential Stealing rule

Hi,

We want to apply the ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' with exceptions for a trusted executable as the source app. However, it looks like the exceptions list only applies to the detected file, which is always lsass.exe.

Is there a way to effect an allow-list for this rule?

Thanks.

  • aexlz's avatar
    aexlz
    May 17, 2022
    This is and will always be lsass.exe, because this process is accessed from other apps to enumerate users.
    Even though you see thousand of alerts there, you can put this on block most times. Not being able to enumerate users via lsass.exe does not stop 99 of 100 apps to work properly.
    Test it out with on device in advance.
  • aexlz's avatar
    aexlz
    Brass Contributor
    May 17, 2022
    This is and will always be lsass.exe, because this process is accessed from other apps to enumerate users.
    Even though you see thousand of alerts there, you can put this on block most times. Not being able to enumerate users via lsass.exe does not stop 99 of 100 apps to work properly.
    Test it out with on device in advance.