Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1011960" data-attributes="member: 32260">Any Applocker hardening adds some important protection. But nowadays, the malware often uses CmdLine access to run DLLs. Unfortunately, the AVs (including Microsoft Defender with ASR rules) usually do not provide the same protection level for DLLs as for EXE files. So malicious DLLs can be a problem. One can use additional protection by:<ol>
<li data-xf-list-type="ol">Efficiently restricting CmdLine access (like H_C or SWH, without blocking DLLs).</li>
<li data-xf-list-type="ol">Efficiently blocking DLLs in UserSpace.</li>
</ol>WDAC and Applocker cannot protect several methods that allow CmdLine access (shortcuts and many file types with active content), so the recommended setup should rely on point 2. One good example is allowing only signed DLLs in userSpace when using Applocker (not possible in WDAC). This can protect home users against many attacks (via unprotected file types) that end with running a DLL or DLL hijacking.</blockquote>

[QUOTE="Andy Ful, post: 1011960, member: 32260"] Any Applocker hardening adds some important protection. But nowadays, the malware often uses CmdLine access to run DLLs. Unfortunately, the AVs (including Microsoft Defender with ASR rules) usually do not provide the same protection level for DLLs as for EXE files. So malicious DLLs can be a problem. One can use additional protection by: [LIST=1] [*]Efficiently restricting CmdLine access (like H_C or SWH, without blocking DLLs). [*]Efficiently blocking DLLs in UserSpace. [/LIST] WDAC and Applocker cannot protect several methods that allow CmdLine access (shortcuts and many file types with active content), so the recommended setup should rely on point 2. One good example is allowing only signed DLLs in userSpace when using Applocker (not possible in WDAC). This can protect home users against many attacks (via unprotected file types) that end with running a DLL or DLL hijacking. [/QUOTE]

Verification