Exe Lockdown, simply put, is an executable file filter. It attaches to the operating system and filters all executable files, be it .exe .com .dll .drv .sys .dpl etc from all drives and all network shares against a list of files or paths, you, the administrator provide as trusted applications. If a prohibited executable (one not in the allow list or one defined in the deny list) is loaded, a popup box informs the user with an intelligent message. This message can be customised to your site including a contact or phone number reinforcing to the user that this is not an error. On the other hand perhaps you are not ready for total lock down just yet, but are worried about all these PE viruses, executable christmas/birthday cards, screen savers etc that are coming in via email. While most of your users don’t click on these you are worried about security holes in your email client, either hiding extensions or embedding files into html messages. By placing the email attachment directory in the denied list and removing all entries from the allow list you can prevent users (or malicious scripts) from running any executable attachments from the default directory. However the user can still move the file to different location to run it just like they can run all other programs outside of this explicitly defined directory. The popup message box can be customised to remind users that it is company policy not to open executable files received by email. But what happens if the executable’s don’t have .exe or hidden extensions? How will Exe Lockdown know if they are executable or data files?
Exe Lockdown hooks into the operating systems routines for creating a process and loading it into memory. If the operating system attempts to load any compiled code into memory ready to give it execution as a process or thread, Exe Lockdown will jump on it and prevent the code from being loaded into memory. Therefore trust-no-one doesn’t rely on the file extension.............
![[=PEX=]](/data/avatars/m/4/4451.jpg?1612629429){kind=avatar}
