Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1057970" data-attributes="member: 32260">I have seen this attack vector several times, for example:[URL unfurl=&quot;true&quot;]https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/[/URL][ATTACH=full]278673[/ATTACH]Figure 6. Viewing ISO image with “show hidden files” enabled.In the most popular version, the attackers use shortcuts to run the benign/reputable EXE file. It is easy to change the shortcut icon, so it looks like a document, media file, etc. The intention of such an attack is not to bypass ISG (it is a side effect), but to bypass SmartScreen and fool AVs.SAC can block such attacks in 2 ways:<ol>
<li data-xf-list-type="ol">Before the year 2023, the malicious DLL could be blocked (if it was unsigned).
</li>
<li data-xf-list-type="ol">Since the year 2023, the shortcut can be blocked (if the disk image was downloaded from the Internet).
</li>
</ol>Unfortunately, the MOTW improvements from the year 2023 work to the advantage of SAC but are not good for WDAC ISG.Similar attacks can be performed via flash drives. It is also possible to use archives via CVE-2023-40477 vulnerability if the archiver applications are not updated.</blockquote>

[QUOTE="Andy Ful, post: 1057970, member: 32260"] I have seen this attack vector several times, for example: [URL unfurl="true"]https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/[/URL] [ATTACH type="full" alt="1694994093359.png"]278673[/ATTACH] [CENTER]Figure 6. Viewing ISO image with “show hidden files” enabled.[/CENTER] In the most popular version, the attackers use shortcuts to run the benign/reputable EXE file. It is easy to change the shortcut icon, so it looks like a document, media file, etc. The intention of such an attack is not to bypass ISG (it is a side effect), but to bypass SmartScreen and fool AVs. SAC can block such attacks in 2 ways: [LIST=1] [*][LEFT]Before the year 2023, the malicious DLL could be blocked (if it was unsigned).[/LEFT] [*][LEFT]Since the year 2023, the shortcut can be blocked (if the disk image was downloaded from the Internet).[/LEFT] [/LIST] Unfortunately, the MOTW improvements from the year 2023 work to the advantage of SAC but are not good for WDAC ISG. Similar attacks can be performed via flash drives. It is also possible to use archives via CVE-2023-40477 vulnerability if the archiver applications are not updated. [/QUOTE]

Verification