Airlock Releases Free Document to Test Chained Trust in EDR and Application Whitelisting Solutions
Today Airlock Digital is releasing a free Microsoft Word document to test ‘Chained Trust’ in EDR and Application Whitelisting solutions. This is where a product will trust a parent process (such as winword.exe) and automatically place trust in any spawned child processes.
Security products that are configured to use ‘Chained Trust’ may provide a reduced level of security.
This document contains Macro code, which attempts to drop either a .dll or .exe file in the document's working directory and execute it, allowing you to audit product configurations.
[Updated in December 2023] Download the Allowlisting Auditor v4 or read about the Allowlisting Auditor updates in v4.
SHA256Sum: e39b1abff16db7a7f6d3b52e6d01d29dd423da0504358082acd1073e439c5723
Please let us know if you find this useful or have any feedback by contacting info@airlockdigital.com or @airlockdigital.
