Reply to thread

Message

<blockquote data-quote="Vitali Ortzi" data-source="post: 1114632" data-attributes="member: 57714">Basically you had a shell and we&#039;re able to do at least limited operations without raising behavior monitoring to flag the operation as malicious So it&#039;s something you made so no signature , behavior wasn&#039;t malicious enough to cause av software to filter it and since av software by default are configured to have low false positives and auto allowed based on emulation,behavior , signatures and maybe more tricks depending on the av The reason Andy asked for an any.run is because that sandbox automates every action of an executable , command and shows what mitre tactics were used and it helps a lot in understanding if and wich malicious behaviors are&nbsp; used You&#039;re totally correct that default settings especially on defender &nbsp;allows shell even with privileges and future malicious behavior can be executed (no malicious behavior at first )Yes it is a security issue and there is no solution that isn&#039;t aggressive and Microsoft is working on vbs , adminless (security by default )&nbsp; that should not allow privilege access (under vbs , standard user privileges or lower )Unfortunately the solution Microsoft is working on is aggressive but should make windows more like other consumer os systems like chrome os , android , iOS&nbsp; where every third party process is restricted in a sandbox with limited permission</blockquote>

[QUOTE="Vitali Ortzi, post: 1114632, member: 57714"] Basically you had a shell and we're able to do at least limited operations without raising behavior monitoring to flag the operation as malicious So it's something you made so no signature , behavior wasn't malicious enough to cause av software to filter it and since av software by default are configured to have low false positives and auto allowed based on emulation,behavior , signatures and maybe more tricks depending on the av The reason Andy asked for an any.run is because that sandbox automates every action of an executable , command and shows what mitre tactics were used and it helps a lot in understanding if and wich malicious behaviors are used You're totally correct that default settings especially on defender allows shell even with privileges and future malicious behavior can be executed (no malicious behavior at first ) Yes it is a security issue and there is no solution that isn't aggressive and Microsoft is working on vbs , adminless (security by default ) that should not allow privilege access (under vbs , standard user privileges or lower ) Unfortunately the solution Microsoft is working on is aggressive but should make windows more like other consumer os systems like chrome os , android , iOS where every third party process is restricted in a sandbox with limited permission [/QUOTE]

Verification