Airlock Releases Free Document to Test Chained Trust in EDR and Application Whitelisting Solutions
Today Airlock Digital is releasing a free Microsoft Word document to test ‘Chained Trust’ in EDR and Application Whitelisting solutions. This is where a product will trust a parent process (such as winword.exe) and automatically place trust in any spawned child processes.
Security products that are configured to use ‘Chained Trust’ may provide a reduced level of security.
This document contains Macro code, which attempts to drop either a .dll or .exe file in the document's working directory and execute it, allowing you to audit product configurations.
You can download the document here: https://www.airlockdigital.com/AirlockApps/Airlock_Application_Whitelisting_Macro_Security_Auditor_v1.0.doc
SHA256Sum: e39b1abff16db7a7f6d3b52e6d01d29dd423da0504358082acd1073e439c5723
Please let us know if you find this useful or have any feedback by contacting info@airlockdigital.com or @airlockdigital.