Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 967930" data-attributes="member: 32260">No. The Hardened Mode works only for COM, EXE, and SCR files. Its strength is kinda similar in practice to the Defender ASR rule &quot;Block executable files from running unless they meet a prevalence, age, or trusted list criteria&quot;.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />There are some differences too. For example, the ASR rule can also block unknown DLLs dropped to disk and executed via rundll32.exe.For files downloaded from the Internet (files with MOTW), the SmartScreen AppRep works with COM, EXE, and SCR files similarly to the Avast Hardened Mode. But, SmartScreen can also block MSI files. The advantage of Hardened Mode over SmartScreen follows from the fact that it can block payloads dropped without MOTW.</blockquote>

[QUOTE="Andy Ful, post: 967930, member: 32260"] No. The Hardened Mode works only for COM, EXE, and SCR files. Its strength is kinda similar in practice to the Defender ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria".:( There are some differences too. For example, the ASR rule can also block unknown DLLs dropped to disk and executed via rundll32.exe. For files downloaded from the Internet (files with MOTW), the SmartScreen AppRep works with COM, EXE, and SCR files similarly to the Avast Hardened Mode. But, SmartScreen can also block MSI files. The advantage of Hardened Mode over SmartScreen follows from the fact that it can block payloads dropped without MOTW. [/QUOTE]

Verification