What's Changed
- Added Process mitigations for WebView 2 and Runtime broker after doing a thorough test to make sure they are fully compatible.
- Added proper description for all of the executables in the process mitigations CSV file.
- Removed unnecessary process mitigations for Edge and Acrobat reader because they are enabled by default by system. These changes are automatically applied when you run the Microsoft Defender category using the Harden Windows Security Module.
- Removed direct path from the process mitigations and instead only relying on file names, this can provide better security so that if, in a hypothetical scenario, an attacker changes the location of the files or tries to run a file with the same name but from a different location, the mitigation will still apply to it and kill it.
- Updated the descriptions in the PowerShell gallery.
- Removed process mitigations
DisableExtensionPointsforPrintDialog.exeandBlockDynamicCodeforRegsvr32.exe; Could potentially prevent an edge case when user tries to print something from an RDP session, using redirected printing feature, back to the host OS. It's rare but the goal is to never break any functionality. These changes are automatically applied when you run the Microsoft Defender category using the Harden Windows Security Module.
PR: #112