full-disclosure - Re: [FD] Defense in depth -- the Microsoft way (part 93): SRP/SAFER whitelisting goes black on Windows 11

Open Source and information security mailing list archives

Message-ID: <B551C102BDCB46DAA485B089F5E1A825@H270>
Date: Tue, 7 Oct 2025 15:43:55 +0200
From: Stefan Kanthak via Fulldisclosure <fulldisclosure@...lists.org>
To: <fulldisclosure@...lists.org>
Cc: Microsoft Security Response Center <secure@...rosoft.com>
Subject: Re: [FD] Defense in depth -- the Microsoft way (part 93): SRP/SAFER
	whitelisting goes black on Windows 11

On Monday, September 22, 2025 3:40 PM I wrote:

> Hi @ll,
> 
> more than 2.5 years ago I posted "Defense in depth -- the Microsoft way
> (part 82): INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2"
> <https://seclists.org/fulldisclosure/2023/Feb/13>
> 
> In "SRP on Windows 11" <https://seclists.org/fulldisclosure/2023/Mar/1>
> Andy Ful presented a persistent correction some days later.
> 
> Since several months now (unfortunately I can't tell the exact time)
> SAFER shows the following BUG on Windows 11 24H2: it blocks execution of
> %SystemRoot%\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
> (really: it applies its default rule instead of a matching path rule)
> despite a path rule which allows execution in %SystemRoot% and its
> subdirectories!

On a fresh installation of the just released Windows 11 25H2 the former file
%SystemRoot%\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
is %SystemRoot%\System32\SecurityHealthHost.exe now, but the BUG persists:

| svchost.exe (PID = 9876) identified \\?\C:\Windows\System32\SecurityHealthHost.exe
| as Disallowed using default rule, Guid = {11015445-d282-4f86-96a2-9e485f593302}

> After configuration of SAFER settings and ruleset via the script
> <https://skanthak.hier-im-netz.de/download/NTX_SAFER.INF> provided and
> documented in <https://skanthak.hier-im-netz.de/SAFER.html>, the following
> line is written multiple times to %SystemRoot%\System32\LogFiles\SAFER.LOG
> when an unprivileged user tries to open "Windows Security":
> 
> | svchost.exe (PID = 1234) identified
> | \\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
> | as Disallowed using default rule, Guid = {11015445-d282-4f86-96a2-9e485f593302}

stay tuned, and far away from bug-riddled Windows 11
Stefan Kanthak
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives