[Qgis-user] Question regarding QGIS and Microsoft ASR rule "Block use of copied or impersonated system tools"

[Gert-Jan van der Weijden - GISNederland]

Interesting question!

Searching the Qgis source code in Github on "curl" I found one reference 
to "curl", in "qgsnetworkloggernode.cpp"
See for yourself at 
"https://github.com/search?q=repo%3Aqgis%2FQGIS+curl&type=code"

I guess this is triggered when you use the debugging/development tools 
panel (in the menu under "view"->"panels")
Could that be the ASR-trigger for curl.exe?


Can't find references to Powershell(.exe), so that surprises me.

Just to make sure: are you using a "clean" QGis, or do you have some 
plugins installed?


Kind regards,

Gert-Jan



On 9/1/2026 15:23, Sondre Een Kvalfoss via QGIS-User wrote:
>
> Hello,
>
> We have recently enabled a new Microsoft Defender Attack Surface 
> Reduction (ASR) rule in our environment called *"Block use of copied 
> or impersonated system tools"*, currently running in *Audit mode*.
>
> During our review of the audit logs, we have observed events involving 
> *curl.exe* and the source application *powershell.exe*, where the 
> common factor appears to be the following QGIS installation path:
>
> C:\Program Files\QGIS 4.2.1\bin
>
> Before enabling this ASR rule in *Block mode*, we would appreciate 
> your help in understanding what is triggering these events and how 
> QGIS uses these components. Our goal is to determine whether this 
> behavior is expected and whether it would be appropriate to create an 
> exclusion for QGIS if necessary.
>
> Could you please provide any details on the processes or functionality 
> within QGIS that may invoke curl.exe and/or powershell.exe from this 
> location?
>
> Thank you for your assistance. Please include me in the reply if possible.
>
> Kind regards,
>
> Sondre Een Kvalfoss
>
>
> _______________________________________________
> QGIS-User mailing list
> QGIS-User at lists.osgeo.org
> List info:https://lists.osgeo.org/mailman/listinfo/qgis-user
> Unsubscribe:https://lists.osgeo.org/mailman/listinfo/qgis-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-user/attachments/20260901/a33171d3/attachment.htm>