Re: Defense in depth -- the Microsoft way (part 93): SRP/SAFER whitelisting goes black on Windows 11

[Stefan Kanthak via Fulldisclosure <fulldisclosure () seclists org>]

On Monday, September 22, 2025 3:40 PM I wrote:

> Hi @ll,
>
> more than 2.5 years ago I posted "Defense in depth -- the Microsoft way
> (part 82): INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2"
> <https://seclists.org/fulldisclosure/2023/Feb/13>
>
> In "SRP on Windows 11" <https://seclists.org/fulldisclosure/2023/Mar/1>
> Andy Ful presented a persistent correction some days later.
>
> Since several months now (unfortunately I can't tell the exact time)
> SAFER shows the following BUG on Windows 11 24H2: it blocks execution of
> %SystemRoot%\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
> (really: it applies its default rule instead of a matching path rule)
> despite a path rule which allows execution in %SystemRoot% and its
> subdirectories!

On a fresh installation of the just released Windows 11 25H2 the former file
%SystemRoot%\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
is %SystemRoot%\System32\SecurityHealthHost.exe now, but the BUG persists:

| svchost.exe (PID = 9876) identified \\?\C:\Windows\System32\SecurityHealthHost.exe
| as Disallowed using default rule, Guid = {11015445-d282-4f86-96a2-9e485f593302}

> After configuration of SAFER settings and ruleset via the script
> <https://skanthak.hier-im-netz.de/download/NTX_SAFER.INF> provided and
> documented in <https://skanthak.hier-im-netz.de/SAFER.html>, the following
> line is written multiple times to %SystemRoot%\System32\LogFiles\SAFER.LOG
> when an unprivileged user tries to open "Windows Security":
>
> | svchost.exe (PID = 1234) identified
> | \\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
> | as Disallowed using default rule, Guid = {11015445-d282-4f86-96a2-9e485f593302}

stay tuned, and far away from bug-riddled Windows 11
Stefan Kanthak
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/