Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1057932" data-attributes="member: 32260">By &quot;replaced&quot; I did not mean worse. Both SAC and your setup &quot;WDAC + ISG&quot; cover slightly different attack surfaces.&quot;WDAC + ISG&quot; is vulnerable to some popular attack vectors that SAC covers. These attack vectors have become more dangerous since the year 2023 due to some improvements in transferring MOTW from disk images (ISO, IMG, VHD, VHDX) to their content. Similar improvements will be applied soon to archives (7-Zip, Gz, and RAR). As we know, ISG and SmartScreen are vulnerable to the attack vector via benign/vulnerable EXE + malicious DLL, when the EXE has got MOTW. It is a very simplistic attack when EXE + DLL is contained in the disk image or archive.SAC can be &quot;bypassed&quot; by some signed malware samples, that can be blocked by &quot;WDAC + ISG&quot;.WDAC without ISG is more comprehensive than SAC and &quot;WDAC + ISG&quot;. So yes, Microsoft advises Administrators to use WDAC over SAC. Another reason is that SAC cannot use Managed Installer which automatically allows applications installed by a designated software distribution solution, such as Microsoft Configuration Manager (MEMCM) or Microsoft Intune. WDAC does have several convenient features for Administrators - SAC does not.Both SAC and &quot;WDAC + ISG&quot; cannot be strong protection against targeted attacks and lateral movement, but can be good protection at home and small business.The setup &quot;WDAC + ISG&quot; can be improved by blocking execution in folders where users download files from the Internet, and by blocking execution from removable drives.</blockquote>

[QUOTE="Andy Ful, post: 1057932, member: 32260"] By "replaced" I did not mean worse. Both SAC and [B][COLOR=rgb(41, 105, 176)]your setup "WDAC + ISG"[/COLOR][/B] cover slightly different attack surfaces. "WDAC + ISG" is vulnerable to some popular attack vectors that SAC covers. These attack vectors have become more dangerous since the year 2023 due to some improvements in transferring MOTW from disk images (ISO, IMG, VHD, VHDX) to their content. Similar improvements will be applied soon to archives (7-Zip, Gz, and RAR). As we know, [B][COLOR=rgb(184, 49, 47)]ISG and SmartScreen[/COLOR][/B] are vulnerable to the attack vector via benign/vulnerable EXE + malicious DLL, when the EXE has got MOTW. It is a very simplistic attack when EXE + DLL is contained in the disk image or archive. SAC can be "bypassed" by some signed malware samples, that can be blocked by "WDAC + ISG". WDAC without ISG is more comprehensive than SAC and "WDAC + ISG". So yes, Microsoft advises Administrators to use WDAC over SAC. Another reason is that SAC cannot use Managed Installer which automatically allows applications installed by a designated software distribution solution, such as Microsoft Configuration Manager (MEMCM) or Microsoft Intune. WDAC does have several convenient features for Administrators - SAC does not. Both SAC and "WDAC + ISG" cannot be strong protection against targeted attacks and lateral movement, but can be good protection at home and small business. The setup "WDAC + ISG" can be improved by blocking execution in folders where users download files from the Internet, and by blocking execution from removable drives. [/QUOTE]

Verification