Windows Defender: Vulnerable Driver Blocklist (Win10,11)

Topic

New Reply

https://www.ghacks.net/2022/03/28/windows-defender-vulnerable-driver-blocklist-protects-against-malicious-or-exploitable-drivers/

Vulnerable Driver Blocklist is a new security feature of Windows Defender on Windows 10, Windows 11 and Windows Server 2016 or newer devices that protects against malicious or exploitable drivers.

Announced by Microsoft’s Vice President of Enterprise and OS Security, David Weston, on Twitter, the Microsoft Vulnerable Driver Blocklist is a new security feature that is enabled by default on Windows 10 in S mode devices and on devices that have the Core Isolation feature Memory Integrity, which Microsoft may also refer to as Hypervisor-protected code integrity (HVCI), enabled…

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules

1 user thanked author for this post.

windbg

Reply | Quote

Replies

How irrelevant for many. I cannot enable Core Isolation Memory Integrity on this Windows 10 Pro computer and never have been able to do so.

I run two incompatible NEEDED programs.

Reply | Quote

Mele, I fail to see how this is irrelevant? Drivers are a major source of attacks for NT, since they inject straight into the kernel, and having a list of known vulnerable drivers to be blocked by default (starting with 22H2) is arguably very helpful and so is Core Isolation being on by default, which it already is in 22H2. If you’re having issues, just disable it.

Security is never ‘irrelevant’ for anyone. Sure, nobody cares, people would rather have their two extra frames per second instead of the essential security VBS brings, yada yada – but it is undeniable that it is integral.

Reply | Quote