Processes protected by exploit security policy

Application processes that run on your endpoint are protected by the exploit security policy.

By default, your exploit security profile protects endpoints from attack techniques that target specific processes. Each exploit protection capability protects a different set of processes that Palo Alto Networks researchers determine are susceptible to attack. The following tables display the processes that are protected by each exploit protection capability for each operating system.

Windows processes protected by exploit security policy
Browser exploits protection
[updated version of Adobe Flash Player for Firefox installed on endpoint] browser_broker.exe chrome.exe firefox.exe	flashutil_activex.exe iexplore.exe microsoftedge.exe microsoftedgecp.exe opera_plugin_wrapper.exe	opera.exe plugin-container.exe safari.exe webkit2webprocess.exe
Logical exploits protection
cliconfg.exe dism.exe dllhost.exe	excel.exe migwiz.exe mmc.exe	powerpnt.exe sysprep.exe winword.exe
Known vulnerable processes protection
7z.exe 7zfm.exe 7zg.exe acrobat.exe acrord32.exe acrord32info.exe allplayer.exe applemobiledeviceservice.exe apwebgrb.exe armsvc.exe blazehdtv.exe bsplayer.exe cmd.exe eqnedt32.exe excel.exe flashfxp.exe fltldr.exe fontdrvhost.exe foxit reader.exe foxitreader.exe groovemonitor.exe hxmail.exe i_view32.exe infopath.exe	ipodservice.exe itunes.exe ituneshelper.exe journal.exe jqs.exe microsoft.photos.exe msaccess.exe mspub.exe mstsc.exe nginx.exe notepad++.exe nslookup.exe outlook.exe powerpnt.exe pptview.exe qttask.exe quicktimeplayer.exe rar.exe reader_sl.exe realconverter.exe realplay.exe realsched.exe skype.exe skypeapp.exe skypehost.exe	SLMail.exe soffice.exe sqlservr.exe telnet.exe unrar.exe vboxservice.exe vboxsvc.exe vboxtray.exe video.ui.exe visio.exe vlc.exe vmware-authd.exe vmware-hostd.exe vmware-vmx.exe vpreview.exe vprintproxy.exe wab.exe w3wp.exe winrar.exe winword.exe wireshark.exe wmplayer.exe wmpnetwk.exe xpsrchvw.exe
Operating system exploit protection
ctfmon.exe dllhost.exe dns.exe lsass.exe msmpeng.exe	runtimebroker.exe spoolsv.exe svchost.exe taskeng.exe	taskhost.exe wmiprvse.exe wmiprvse.exe wwahost.exe

Mac processes protected by exploit security policy
Browser exploits protection
com.apple.safariservices com.apple.webkit.plugin com.apple.webkit.plugin.64 com.apple.webkit.webcontent	firefox firefox-bin google chrome helper google chrome	plugin-container safari seamonkey
Logical exploits protection
adobereader app drive for google drive app drop for dropbox app for dropbox app for facebook app for google drive app for googledocs app for instagram app for linkedin app for youtube com.apple.safariservices com.apple.webkit.plugin com.apple.webkit.plugin.64 com.apple.webkit.webcontent document writer	firefox firefox-bin google chrome helper google chrome itunes helper itunes mail+ for yahoo microsoft excel microsoft outlook microsoft powerpoint microsoft remote desktop microsoft word miniwriterfree parallels client pdf reader pro free	pdf reader x plugin-container quicktime player safari seamonkey slack sonicwall mobile connect textwrangler vlc vmware fusion services vmware fusion vpn shield winmail.dat file viewer
Known vulnerable processes protection
adobereader airmail app drive for google drive app drop for dropbox app for dropbox app for facebook app for google drive app for googledocs app for instagram app for linkedin app for youtube bbedit c-lion cisco anyconnect secure mobility client com.apple.cloudphotosconfiguration	document writer itunes helper itunes jump desktop mail mail+ for yahoo messages microsoft excel microsoft outlook microsoft powerpoint microsoft remote desktop microsoft word miniwriterfree parallels client pdf reader pro free pdf reader x	photos photoshop quickbooks quicktime player signal slack sonicwall mobile connect telegram textmate textwrangler thunderbird vlc vmware fusion services vmware fusion vpn shield winmail.dat file viewer

Linux processes protected by exploit security policy
Known vulnerable processes protection
anacron apache2 authproxy bluetoothd charon chronyd* couriertcpd cron crond cupsd cyrus_pop3d danted dhcpd dovecot exim ftpd httpd ibserver identd lighttpd java kamailio *chronyd is injected in some scenarios, depending on the OS.	mailman master mongod mysqld mysqld_safe named ndsd nginx nmbd node nscd php php5-fpm pmmasterd pop2d pop3d postgres proftpd qmgr rpcbind rsync	samba saned sendmail sendmail.sendmail smartd smbd snmpd squid squid3 starter syslog-ng tinyproxy vsftpd wickedd-dhcp4 wickedd-dhcp6 winbindd xinetd