> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/processes-protected-by-exploit-security-policy.md).

# Processes protected by exploit security policy

Application processes that run on your endpoint are protected by the exploit security policy.

By default, your exploit security profile protects endpoints from attack techniques that target specific processes. Each exploit protection capability protects a different set of processes that Palo Alto Networks researchers determine are susceptible to attack. The following tables display the processes that are protected by each exploit protection capability for each operating system.

| Windows processes protected by exploit security policy                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Browser exploits protection**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| <ul><li>\[updated version of Adobe Flash Player for Firefox installed on endpoint]</li><li>browser\_broker.exe</li><li>chrome.exe</li><li>firefox.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                           | <ul><li>flashutil\_activex.exe</li><li>iexplore.exe</li><li>microsoftedge.exe</li><li>microsoftedgecp.exe</li><li>opera\_plugin\_wrapper.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                     | <ul><li>opera.exe</li><li>plugin-container.exe</li><li>safari.exe</li><li>webkit2webprocess.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                               |
| **Logical exploits protection**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| <ul><li>cliconfg.exe</li><li>dism.exe</li><li>dllhost.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | <ul><li>excel.exe</li><li>migwiz.exe</li><li>mmc.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | <ul><li>powerpnt.exe</li><li>sysprep.exe</li><li>winword.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| **Known vulnerable processes protection**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| <ul><li>7z.exe</li><li>7zfm.exe</li><li>7zg.exe</li><li>acrobat.exe</li><li>acrord32.exe</li><li>acrord32info.exe</li><li>allplayer.exe</li><li>applemobiledeviceservice.exe</li><li>apwebgrb.exe</li><li>armsvc.exe</li><li>blazehdtv.exe</li><li>bsplayer.exe</li><li>cmd.exe</li><li>eqnedt32.exe</li><li>excel.exe</li><li>flashfxp.exe</li><li>fltldr.exe</li><li>fontdrvhost.exe</li><li>foxit reader.exe</li><li>foxitreader.exe</li><li>groovemonitor.exe</li><li>hxmail.exe</li><li>i\_view32.exe</li><li>infopath.exe</li></ul> | <ul><li>ipodservice.exe</li><li>itunes.exe</li><li>ituneshelper.exe</li><li>journal.exe</li><li>jqs.exe</li><li>microsoft.photos.exe</li><li>msaccess.exe</li><li>mspub.exe</li><li>mstsc.exe</li><li>nginx.exe</li><li>notepad++.exe</li><li>nslookup.exe</li><li>outlook.exe</li><li>powerpnt.exe</li><li>pptview\.exe</li><li>qttask.exe</li><li>quicktimeplayer.exe</li><li>rar.exe</li><li>reader\_sl.exe</li><li>realconverter.exe</li><li>realplay.exe</li><li>realsched.exe</li><li>skype.exe</li><li>skypeapp.exe</li><li>skypehost.exe</li></ul> | <ul><li>SLMail.exe</li><li>soffice.exe</li><li>sqlservr.exe</li><li>telnet.exe</li><li>unrar.exe</li><li>vboxservice.exe</li><li>vboxsvc.exe</li><li>vboxtray.exe</li><li>video.ui.exe</li><li>visio.exe</li><li>vlc.exe</li><li>vmware-authd.exe</li><li>vmware-hostd.exe</li><li>vmware-vmx.exe</li><li>vpreview\.exe</li><li>vprintproxy.exe</li><li>wab.exe</li><li>w3wp.exe</li><li>winrar.exe</li><li>winword.exe</li><li>wireshark.exe</li><li>wmplayer.exe</li><li>wmpnetwk.exe</li><li>xpsrchvw\.exe</li></ul> |
| **Operating system exploit protection**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| <ul><li>ctfmon.exe</li><li>dllhost.exe</li><li>dns.exe</li><li>lsass.exe</li><li>msmpeng.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                    | <ul><li>runtimebroker.exe</li><li>spoolsv.exe</li><li>svchost.exe</li><li>taskeng.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <ul><li>taskhost.exe</li><li>wmiprvse.exe</li><li>wmiprvse.exe</li><li>wwahost.exe</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                            |

| Mac processes protected by exploit security policy                                                                                                                                                                                                                                                                                                                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Browser exploits protection**                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                     |
| <ul><li>com.apple.safariservices</li><li>com.apple.webkit.plugin</li><li>com.apple.webkit.plugin.64</li><li>com.apple.webkit.webcontent</li></ul>                                                                                                                                                                                                                                                                                                 | <ul><li>firefox</li><li>firefox-bin</li><li>google chrome helper</li><li>google chrome</li></ul>                                                                                                                                                                                                                                                                                          | <ul><li>plugin-container</li><li>safari</li><li>seamonkey</li></ul>                                                                                                                                                                                                                                                                                 |
| **Logical exploits protection**                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                     |
| <ul><li>adobereader</li><li>app drive for google drive</li><li>app drop for dropbox</li><li>app for dropbox</li><li>app for facebook</li><li>app for google drive</li><li>app for googledocs</li><li>app for instagram</li><li>app for linkedin</li><li>app for youtube</li><li>com.apple.safariservices</li><li>com.apple.webkit.plugin</li><li>com.apple.webkit.plugin.64</li><li>com.apple.webkit.webcontent</li><li>document writer</li></ul> | <ul><li>firefox</li><li>firefox-bin</li><li>google chrome helper</li><li>google chrome</li><li>itunes helper</li><li>itunes</li><li>mail+ for yahoo</li><li>microsoft excel</li><li>microsoft outlook</li><li>microsoft powerpoint</li><li>microsoft remote desktop</li><li>microsoft word</li><li>miniwriterfree</li><li>parallels client</li><li>pdf reader pro free</li></ul>          | <ul><li>pdf reader x</li><li>plugin-container</li><li>quicktime player</li><li>safari</li><li>seamonkey</li><li>slack</li><li>sonicwall mobile connect</li><li>textwrangler</li><li>vlc</li><li>vmware fusion services</li><li>vmware fusion</li><li>vpn shield</li><li>winmail.dat file viewer</li></ul>                                           |
| **Known vulnerable processes protection**                                                                                                                                                                                                                                                                                                                                                                                                         |                                                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                     |
| <ul><li>adobereader</li><li>airmail</li><li>app drive for google drive</li><li>app drop for dropbox</li><li>app for dropbox</li><li>app for facebook</li><li>app for google drive</li><li>app for googledocs</li><li>app for instagram</li><li>app for linkedin</li><li>app for youtube</li><li>bbedit</li><li>c-lion</li><li>cisco anyconnect secure mobility client</li><li>com.apple.cloudphotosconfiguration</li></ul>                        | <ul><li>document writer</li><li>itunes helper</li><li>itunes</li><li>jump desktop</li><li>mail</li><li>mail+ for yahoo</li><li>messages</li><li>microsoft excel</li><li>microsoft outlook</li><li>microsoft powerpoint</li><li>microsoft remote desktop</li><li>microsoft word</li><li>miniwriterfree</li><li>parallels client</li><li>pdf reader pro free</li><li>pdf reader x</li></ul> | <ul><li>photos</li><li>photoshop</li><li>quickbooks</li><li>quicktime player</li><li>signal</li><li>slack</li><li>sonicwall mobile connect</li><li>telegram</li><li>textmate</li><li>textwrangler</li><li>thunderbird</li><li>vlc</li><li>vmware fusion services</li><li>vmware fusion</li><li>vpn shield</li><li>winmail.dat file viewer</li></ul> |

| Linux processes protected by exploit security policy                                                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                        |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Known vulnerable processes protection**                                                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                        |
| <ul><li>anacron</li><li>apache2</li><li>authproxy</li><li>bluetoothd</li><li>charon</li><li>chronyd\*</li><li>couriertcpd</li><li>cron</li><li>crond</li><li>cupsd</li><li>cyrus\_pop3d</li><li>danted</li><li>dhcpd</li><li>dovecot</li><li>exim</li><li>ftpd</li><li>httpd</li><li>ibserver</li><li>identd</li><li>lighttpd</li><li>java</li><li>kamailio</li></ul><p>\*chronyd is injected in some scenarios, depending on the OS.</p> | <ul><li>mailman</li><li>master</li><li>mongod</li><li>mysqld</li><li>mysqld\_safe</li><li>named</li><li>ndsd</li><li>nginx</li><li>nmbd</li><li>node</li><li>nscd</li><li>php</li><li>php5-fpm</li><li>pmmasterd</li><li>pop2d</li><li>pop3d</li><li>postgres</li><li>proftpd</li><li>qmgr</li><li>rpcbind</li><li>rsync</li></ul> | <ul><li>samba</li><li>saned</li><li>sendmail</li><li>sendmail.sendmail</li><li>smartd</li><li>smbd</li><li>snmpd</li><li>squid</li><li>squid3</li><li>starter</li><li>syslog-ng</li><li>tinyproxy</li><li>vsftpd</li><li>wickedd-dhcp4</li><li>wickedd-dhcp6</li><li>winbindd</li><li>xinetd</li></ul> |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/processes-protected-by-exploit-security-policy.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.