topic DLP (DataPatrol) signed DLL injection into Word blocked by agent — permanent exception? in General Topics https://live.paloaltonetworks.com/t5/general-topics/dlp-datapatrol-signed-dll-injection-into-word-blocked-by-agent/m-p/1257867#M126678 <P>Our DLP watermarks documents by injecting a <STRONG>signed</STRONG> DLL into <CODE>WINWORD.EXE</CODE> on print. The Cortex agent blocks the injection — page prints with no watermark, DLL never loads. Works fine with the agent removed. Persists in Report mode, generates <STRONG>no alert/prevention event</STRONG>.</P> <P>Tried a <STRONG>Disable Prevention rule</STRONG> (signer + thumbprint, all modules, global) — no effect, so it's not a prevention module. A <STRONG>Disable Injection &amp; Prevention rule</STRONG> works but is time-limited and process-wide.</P> <P>Has anyone made a <STRONG>permanent, signer-scoped</STRONG> exception so a trusted signer can inject into a protected process (Office) — without disabling injection protection for Word entirely? Which module actually enforces this? Thanks.</P> Wed, 01 Jul 2026 10:24:13 GMT H.Eldessouki 2026-07-01T10:24:13Z DLP (DataPatrol) signed DLL injection into Word blocked by agent — permanent exception? https://live.paloaltonetworks.com/t5/general-topics/dlp-datapatrol-signed-dll-injection-into-word-blocked-by-agent/m-p/1257867#M126678 <P>Our DLP watermarks documents by injecting a <STRONG>signed</STRONG> DLL into <CODE>WINWORD.EXE</CODE> on print. The Cortex agent blocks the injection — page prints with no watermark, DLL never loads. Works fine with the agent removed. Persists in Report mode, generates <STRONG>no alert/prevention event</STRONG>.</P> <P>Tried a <STRONG>Disable Prevention rule</STRONG> (signer + thumbprint, all modules, global) — no effect, so it's not a prevention module. A <STRONG>Disable Injection &amp; Prevention rule</STRONG> works but is time-limited and process-wide.</P> <P>Has anyone made a <STRONG>permanent, signer-scoped</STRONG> exception so a trusted signer can inject into a protected process (Office) — without disabling injection protection for Word entirely? Which module actually enforces this? Thanks.</P> Wed, 01 Jul 2026 10:24:13 GMT https://live.paloaltonetworks.com/t5/general-topics/dlp-datapatrol-signed-dll-injection-into-word-blocked-by-agent/m-p/1257867#M126678 H.Eldessouki 2026-07-01T10:24:13Z