<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
span.EpostStil17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal">We have recently enabled a new Microsoft Defender Attack Surface Reduction (ASR) rule in our environment called
<b>"Block use of copied or impersonated system tools"</b>, currently running in <b>
Audit mode</b>.<o:p></o:p></p>
<p class="MsoNormal">During our review of the audit logs, we have observed events involving
<b>curl.exe</b> and the source application <b>powershell.exe</b>, where the common factor appears to be the following QGIS installation path:<o:p></o:p></p>
<p class="MsoNormal">C:\Program Files\QGIS 4.2.1\bin<o:p></o:p></p>
<p class="MsoNormal">Before enabling this ASR rule in <b>Block mode</b>, we would appreciate your help in understanding what is triggering these events and how QGIS uses these components. Our goal is to determine whether this behavior is expected and whether
it would be appropriate to create an exclusion for QGIS if necessary.<o:p></o:p></p>
<p class="MsoNormal">Could you please provide any details on the processes or functionality within QGIS that may invoke curl.exe and/or powershell.exe from this location?<o:p></o:p></p>
<p class="MsoNormal">Thank you for your assistance. Please include me in the reply if possible.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kind regards,<o:p></o:p></p>
<p class="MsoNormal">Sondre Een Kvalfoss<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>