nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpq7yf7cxzxz4kwf24zmflvyqqtrylsjwm5q9a074u5ger57rmzz0aq0ufle4 (nprofile…fle4) Disabling WinKey entirely may be problematic because many large orgs (especially retail, hospitality and medical) who have previous campaigns on teaching users to use Win+L (lock).
But you can target R specifically in the registry. To take effect you only need to restart explorer.
It however leaves WinX which you cannot disable with the same key as R. For this I suggest simply deleting the PowerShell, Run and Command Line shortcuts per profile.
I'm talking on "low regret" ClickFix mitigations at a Tanium User Group this Thursday and then I'll post my deck and code (not Tanium specific) on Win+R, Win+X and setting PowerShell canaries.
B'ad Samurai 🐐 /
npub1h2…ufrea
2025-05-14 01:14:50
in reply to nevent1q…x8sc
Author Public Key
npub1h273mmy42fw56svgqpvx6nw3k3lxrsntvstqetpxajskwxxkcrtslufreaPublished at
2025-05-14 01:14:50Event JSON
{
"id": "dbe565d863ce5d853d659a6daeea2258857cd955c214340df4074d2913d122de",
"pubkey": "babd1dec95525d4d418800586d4dd1b47e61c26b64160cac26eca16718d6c0d7",
"created_at": 1747185290,
"kind": 1,
"tags": [
[
"p",
"f113ec1846156ce4aaa2da7ec2000b193f093b74017aff579446474f0f6213fa",
"wss://relay.mostr.pub"
],
[
"p",
"3ba412ac4b14c4b37cd6ed16b9d262ad4ffefb05c5b6c6b3e15e381471b1221a",
"wss://relay.mostr.pub"
],
[
"e",
"41f015756b803b975c88ce9fced9d7ea6ad0e250ae819a6b157d4caf3d1b7e43",
"wss://relay.mostr.pub",
"reply"
],
[
"proxy",
"https://infosec.exchange/users/badsamurai/statuses/114503535191018354",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.mostr.pub"
]
],
"content": "nostr:nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpq7yf7cxzxz4kwf24zmflvyqqtrylsjwm5q9a074u5ger57rmzz0aq0ufle4 Disabling WinKey entirely may be problematic because many large orgs (especially retail, hospitality and medical) who have previous campaigns on teaching users to use Win+L (lock).\n\nBut you can target R specifically in the registry. To take effect you only need to restart explorer.\n\nIt however leaves WinX which you cannot disable with the same key as R. For this I suggest simply deleting the PowerShell, Run and Command Line shortcuts per profile.\n\nI'm talking on \"low regret\" ClickFix mitigations at a Tanium User Group this Thursday and then I'll post my deck and code (not Tanium specific) on Win+R, Win+X and setting PowerShell canaries.",
"sig": "a7fc6f36fc233646317928089cefa22de09b0fddcf92b338cab99bfab8829f8ac2856bd3aa4f6692af283e5f26b4a7abcbbbae08f86ab1cb795fec8556967aec"
}