Forum Discussion
AsrPsexecWmiChildProcess and Nessus
Hi guys, We’d like to implement some of the Attack Surface Reduction rules within our Windows estate but coming up against an issue with how the Nessus agent operates triggering the "Block proces...
sirkillnotalot We've run into this as well. You either block and break Nessus, or audit and allow the activity to occur. We've decided to leave that particular ASR rule in audit mode and alert any time it fires unless the user is our nessus service account.