Has anyone else tried to convince Sophos to add wmic.exe to the list of applications that can be blocked or monitored with Application Control? Their own guidance on Emotet/Trickbot/Ryuk suggests that use of wmic.exe should be restricted, as it is increasingly used for lateral movement and persistence. Similarly, the 'hacking with Dr Bright' webinar they put on recently made the same recommendation. However, they refuse to add it to Application Control, with the rationale that "WMI is an integral part of the Windows operating system and blocking it could cause unexpected issues". They're obviously conflating wmic.exe with WMI, which is quite frustrating as they're not at all the same thing.
This thread was automatically locked due to age.
