> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/processes-protected-by-exploit-security-policy.md).

# Processes protected by exploit security policy

By default, your exploit security profile protects endpoints from attack techniques that target specific processes. Each exploit protection capability protects a different set of processes that Palo Alto Networks researchers determine are susceptible to attack. The following tables display the processes that are protected by each exploit protection capability for each operating system.

| Windows processes protected by exploit security policy                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Browser exploits protection**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| <ul><li>\[updated version of Adobe Flash Player for Firefox installed on endpoint]</li><li>browser\_broker.exe</li><li>chrome.exe</li><li>firefox.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                           | <ul><li>flashutil\_activex.exe</li><li>iexplore.exe</li><li>microsoftedge.exe</li><li>microsoftedgecp.exe</li><li>opera\_plugin\_wrapper.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                     | <ul><li>opera.exe</li><li>plugin-container.exe</li><li>safari.exe</li><li>webkit2webprocess.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                          |
| **Logical exploits protection**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| <ul><li>cliconfg.exe</li><li>dism.exe</li><li>dllhost.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | <ul><li>excel.exe</li><li>migwiz.exe</li><li>mmc.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | <ul><li>powerpnt.exe</li><li>sysprep.exe</li><li>winword.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **Known vulnerable processes protection**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| <ul><li>7z.exe</li><li>7zfm.exe</li><li>7zg.exe</li><li>acrobat.exe</li><li>acrord32.exe</li><li>acrord32info.exe</li><li>allplayer.exe</li><li>applemobiledeviceservice.exe</li><li>apwebgrb.exe</li><li>armsvc.exe</li><li>blazehdtv.exe</li><li>bsplayer.exe</li><li>cmd.exe</li><li>eqnedt32.exe</li><li>excel.exe</li><li>flashfxp.exe</li><li>fltldr.exe</li><li>fontdrvhost.exe</li><li>foxit reader.exe</li><li>foxitreader.exe</li><li>groovemonitor.exe</li><li>hxmail.exe</li><li>i\_view32.exe</li><li>infopath.exe</li></ul> | <ul><li>ipodservice.exe</li><li>itunes.exe</li><li>ituneshelper.exe</li><li>journal.exe</li><li>jqs.exe</li><li>microsoft.photos.exe</li><li>msaccess.exe</li><li>mspub.exe</li><li>mstsc.exe</li><li>nginx.exe</li><li>notepad++.exe</li><li>nslookup.exe</li><li>outlook.exe</li><li>powerpnt.exe</li><li>pptview\.exe</li><li>qttask.exe</li><li>quicktimeplayer.exe</li><li>rar.exe</li><li>reader\_sl.exe</li><li>realconverter.exe</li><li>realplay.exe</li><li>realsched.exe</li><li>skype.exe</li><li>skypeapp.exe</li><li>skypehost.exe</li></ul> | <ul><li>SLMail.exe</li><li>soffice.exe</li><li>telnet.exe</li><li>unrar.exe</li><li>vboxservice.exe</li><li>vboxsvc.exe</li><li>vboxtray.exe</li><li>video.ui.exe</li><li>visio.exe</li><li>vlc.exe</li><li>vmware-authd.exe</li><li>vmware-hostd.exe</li><li>vmware-vmx.exe</li><li>vpreview\.exe</li><li>vprintproxy.exe</li><li>wab.exe</li><li>w3wp.exe</li><li>winrar.exe</li><li>winword.exe</li><li>wireshark.exe</li><li>wmplayer.exe</li><li>wmpnetwk.exe</li><li>xpsrchvw\.exe</li></ul> |
| **Operating system exploit protection**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| <ul><li>ctfmon.exe</li><li>dllhost.exe</li><li>dns.exe</li><li>lsass.exe</li><li>msmpeng.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                    | <ul><li>runtimebroker.exe</li><li>spoolsv.exe</li><li>svchost.exe</li><li>taskeng.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <ul><li>taskhost.exe</li><li>wmiprvse.exe</li><li>wmiprvse.exe</li><li>wwahost.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                       |

| Mac processes protected by exploit security policy                                                                                                                                                                                                                                                                                                                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Browser exploits protection**                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                     |
| <ul><li>com.apple.safariservices</li><li>com.apple.webkit.plugin</li><li>com.apple.webkit.plugin.64</li><li>com.apple.webkit.webcontent</li></ul>                                                                                                                                                                                                                                                                                                 | <ul><li>firefox</li><li>firefox-bin</li><li>google chrome helper</li><li>google chrome</li></ul>                                                                                                                                                                                                                                                                                          | <ul><li>plugin-container</li><li>safari</li><li>seamonkey</li></ul>                                                                                                                                                                                                                                                                                 |
| **Logical exploits protection**                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                     |
| <ul><li>adobereader</li><li>app drive for google drive</li><li>app drop for dropbox</li><li>app for dropbox</li><li>app for facebook</li><li>app for google drive</li><li>app for googledocs</li><li>app for instagram</li><li>app for linkedin</li><li>app for youtube</li><li>com.apple.safariservices</li><li>com.apple.webkit.plugin</li><li>com.apple.webkit.plugin.64</li><li>com.apple.webkit.webcontent</li><li>document writer</li></ul> | <ul><li>firefox</li><li>firefox-bin</li><li>google chrome helper</li><li>google chrome</li><li>itunes helper</li><li>itunes</li><li>mail+ for yahoo</li><li>microsoft excel</li><li>microsoft outlook</li><li>microsoft powerpoint</li><li>microsoft remote desktop</li><li>microsoft word</li><li>miniwriterfree</li><li>parallels client</li><li>pdf reader pro free</li></ul>          | <ul><li>pdf reader x</li><li>plugin-container</li><li>quicktime player</li><li>safari</li><li>seamonkey</li><li>slack</li><li>sonicwall mobile connect</li><li>textwrangler</li><li>vlc</li><li>vmware fusion services</li><li>vmware fusion</li><li>vpn shield</li><li>winmail.dat file viewer</li></ul>                                           |
| **Known vulnerable processes protection**                                                                                                                                                                                                                                                                                                                                                                                                         |                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                     |
| <ul><li>adobereader</li><li>airmail</li><li>app drive for google drive</li><li>app drop for dropbox</li><li>app for dropbox</li><li>app for facebook</li><li>app for google drive</li><li>app for googledocs</li><li>app for instagram</li><li>app for linkedin</li><li>app for youtube</li><li>bbedit</li><li>c-lion</li><li>cisco anyconnect secure mobility client</li><li>com.apple.cloudphotosconfiguration</li></ul>                        | <ul><li>document writer</li><li>itunes helper</li><li>itunes</li><li>jump desktop</li><li>mail</li><li>mail+ for yahoo</li><li>messages</li><li>microsoft excel</li><li>microsoft outlook</li><li>microsoft powerpoint</li><li>microsoft remote desktop</li><li>microsoft word</li><li>miniwriterfree</li><li>parallels client</li><li>pdf reader pro free</li><li>pdf reader x</li></ul> | <ul><li>photos</li><li>photoshop</li><li>quickbooks</li><li>quicktime player</li><li>signal</li><li>slack</li><li>sonicwall mobile connect</li><li>telegram</li><li>textmate</li><li>textwrangler</li><li>thunderbird</li><li>vlc</li><li>vmware fusion services</li><li>vmware fusion</li><li>vpn shield</li><li>winmail.dat file viewer</li></ul> |

| Linux processes protected by exploit security policy                                                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                        |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Known vulnerable processes protection**                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                        |
| <ul><li>anacron</li><li>apache2</li><li>authproxy</li><li>bluetoothd</li><li>charon</li><li>chronyd\*</li><li>couriertcpd</li><li>cron</li><li>crond</li><li>cupsd</li><li>cyrus\_pop3d</li><li>danted</li><li>dhcpd</li><li>dovecot</li><li>exim</li><li>ftpd</li><li>httpd</li><li>ibserver</li><li>identd</li><li>lighttpd</li><li>java</li><li>kamailio</li></ul><p>\*chronyd is injected in some scenarios, depending on the OS.</p> | <ul><li>mailman</li><li>master</li><li>mongod</li><li>mysqld</li><li>mysqld\_safe</li><li>named</li><li>ndsd</li><li>nginx</li><li>nmbd</li><li>node</li><li>nscd</li><li>php</li><li>php5-fpm</li><li>pmmasterd</li><li>pop2d</li><li>pop3d</li><li>postgres</li><li>proftpd</li><li>qmgr</li><li>rpcbind</li><li>rsync</li></ul> | <ul><li>samba</li><li>saned</li><li>sendmail</li><li>sendmail.sendmail</li><li>smartd</li><li>smbd</li><li>snmpd</li><li>squid</li><li>squid3</li><li>starter</li><li>syslog-ng</li><li>tinyproxy</li><li>vsftpd</li><li>wickedd-dhcp4</li><li>wickedd-dhcp6</li><li>winbindd</li><li>xinetd</li></ul> |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/processes-protected-by-exploit-security-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.