Forum Discussion
Improved Resource Management Control
Do these changes mean that we will finally have a way to create exceptions in EDR products like Microsoft Defender for Endpoint? To this point it's been impossible to exclude an agent scan from the Defender Attack Surface Reduction rules like 'Block process creations originating from PSExec and WMI commands' because each process was independent. If the plugins are now child processes under nessud.exe or another executable in the Agent, we may have a solution! Am I understanding the new functionality correctly? It would be great to see some information in updated documentation to describe the process tree changes.
Hi paul_jacoby . You can find the agent release notes here.
Regarding your question about Microsoft Defender for Endpoint. I cannot comment on how that product works, but the changes made move command execution from under WMI to under the Nessus agent process tree for Nessus agent scans. There are no configuration options to change. There are still WMI queries executed that don't run commands, but spawning of processes like powershell.exe is now under the Nessus Agent's process tree.
