Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 998455" data-attributes="member: 32260">That is true. The MSI infection vector is usually depreciated (not only for ransomware), probably because it is relatively rare. A similar problem was with scripting attacks a few years ago. In Defender, the ASR rules mostly ignore MSI files and I am not sure if the cloud-delivered protection even supports MSI files. The Microsoft documentation mentioned the support for:<ol>
<li data-xf-list-type="ol">Automatic file submission:&nbsp;&nbsp; files like .bat, .scr, .dll, .exe.</li>
<li data-xf-list-type="ol"> BAFS:&nbsp;&nbsp; files such as .js, .vbs, or macros and executable files.</li>
</ol>But I have nowhere seen clearly enumerated MSI files. Also, the ISG reputation feature in Microsoft Application Control does not support MSI files. I noticed that MSI files are supported by Smart Application Control on Windows 11. Of course, SmartScreen for Explorer supports MSI too.I am afraid that the problem is more general than Microsoft&#039;s approach. For example, the Avast CyberCapture and Hardened mode do not support MSI files too. From several posts on other forums, it follows that Bitdefender detected Magniber for a few weeks only via signatures, etc.So, the most popular free AVs have got rather poor support for MSI files.Let&#039;s hope that AV vendors will face seriously this problem soon.</blockquote>

[QUOTE="Andy Ful, post: 998455, member: 32260"] That is true. The MSI infection vector is usually depreciated (not only for ransomware), probably because it is relatively rare. A similar problem was with scripting attacks a few years ago. In Defender, the ASR rules mostly ignore MSI files and I am not sure if the cloud-delivered protection even supports MSI files. The Microsoft documentation mentioned the support for: [LIST=1] [*]Automatic file submission: files like .bat, .scr, .dll, .exe. [*] BAFS: files such as .js, .vbs, or macros and executable files. [/LIST] But I have nowhere seen clearly enumerated MSI files. Also, the ISG reputation feature in Microsoft Application Control does not support MSI files. I noticed that MSI files are supported by Smart Application Control on Windows 11. Of course, SmartScreen for Explorer supports MSI too. I am afraid that the problem is more general than Microsoft's approach. For example, the Avast CyberCapture and Hardened mode do not support MSI files too. From several posts on other forums, it follows that Bitdefender detected Magniber for a few weeks only via signatures, etc. So, the most popular free AVs have got rather poor support for MSI files. Let's hope that AV vendors will face seriously this problem soon. [/QUOTE]

Verification