Windows BSOD due to failure to load vsock.sys What happens if you block signer without FileAttrib qualifiers

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Wednesday, 02-Apr-2025 03:02:15 JST Will Dormann

   in reply to

   If we think that WDAC individual block list rules work OK, but the Microsoft recommended driver block rules do not work on HVCI-disabled system, how can that be?

   The MS list, despite listing blocked signers, also uses a FileAttrib qualifier for the signer being blocked. In the case of the Truesight driver I'm using for testing, the MS blocklist specifies a "FileNameand aMaximumFileVersion` property that is required for the block to take place.

   Why is this done? If you simply use WDAC to block a file by it's signer, you'll have a lot of collateral damage.

   That nasty driver you want to block? It also has signers that are legit. For example, Microsoft Windows Hardware Compatibility Publisher. 😀

   What happens if we just attempt to block this Truesight driver based on its signer without using such qualifiers? Windows won't boot. Why? Well, this vsock.sys driver shares a signer with the bad Truesight driver. Therefore, without a precise block list, the driver will fail to load because the important driver is blocked.