Should I add native Windows processes (such as svchost.exe) to EMET? RRS feed

  • Question

  • Is it recommended to add native windows processes such as svchost.exe, lua.exe, rundll32.exe, etc. to EMET? 

    The reason I ask is that I have successfully added them in the lab environment and survived a reboot, but I notice that some system processes such as conhost.exe do not have the green checkbox in the "Running EMET" column even though they are listed in the EMET apps list. 

    Wednesday, July 19, 2017 10:36 PM