Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1057784" data-attributes="member: 96560">Hi Everyone,I recently deployed Windows Defender Exploit Protection for all my applications that are allowed through the firewall. This is in accordance with PCI DSS 2.5.5b. It is mediocre protection I know, but it stopped my red team for half an hour. Are there any commercial programs that do this kind of thing? I know there is MalwareBytes Anti-Exploit, but it only protects a few apps chosen by them. Are there any others who implement Windows Dedender Exploit Protection&#039;s methods but in a more reliable way? The apps that I allow through the firewall are few, and they are these:&nbsp; WWAHost, AuthHost, smartscreen, deviceCensus, MSEdge, svchost, NcsiUwpApp, Recommended Troubleshooting Client and SecHealthUI. All of them are Windows native exe&#039;s.&nbsp; My red team is obviously targeting one or two of those apps or else they wouldn&#039;t have been stuck.By the way, OpenEDR is great and has good and useful alerts. And I like their Comodo AV&#039;s App Container. My red team has yet to penetrate that.</blockquote>

[QUOTE="Victor M, post: 1057784, member: 96560"] Hi Everyone, I recently deployed Windows Defender Exploit Protection for all my applications that are allowed through the firewall. This is in accordance with PCI DSS 2.5.5b. It is mediocre protection I know, but it stopped my red team for half an hour. Are there any commercial programs that do this kind of thing? I know there is MalwareBytes Anti-Exploit, but it only protects a few apps chosen by them. Are there any others who implement Windows Dedender Exploit Protection's methods but in a more reliable way? The apps that I allow through the firewall are few, and they are these: WWAHost, AuthHost, smartscreen, deviceCensus, MSEdge, svchost, NcsiUwpApp, Recommended Troubleshooting Client and SecHealthUI. All of them are Windows native exe's. My red team is obviously targeting one or two of those apps or else they wouldn't have been stuck. By the way, OpenEDR is great and has good and useful alerts. And I like their Comodo AV's App Container. My red team has yet to penetrate that. [/QUOTE]

Verification