Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1049879">Blocking risky file extension execution is a simpler and far more effective approach than a script emulator for home users. Because people pay for advanced protection they like to believe they don&#039;t need Windows build in protections. It is like saying, I don&#039;t need to run as standard user, because my security is so advanced I can run as Admin.The risk surface for home use can be easily reduced by taking a few measures, for instance running SUA, blocking risky file extensions in user folders (Simple Windows Hardening) and allowing only known good (white listed) executables to execute (Configure Defender on MAX). Alternatively you could switch to a more restrictieve OS which does not allow the user to weaken security.In the corporate environment the endpoint protection is not the problem, it is the user who is using that endpoint. Best in class security provides automated analysis of events on endpoints and provides signals when users are sloppy or fall into tricks. In these use cases a script emulator is a watch guard which provides valuable insights for the EDR-system.</blockquote>

[QUOTE="ForgottenSeer 97327, post: 1049879"] Blocking risky file extension execution is a simpler and far more effective approach than a script emulator for home users. Because people pay for advanced protection they like to believe they don't need Windows build in protections. It is like saying, I don't need to run as standard user, because my security is so advanced I can run as Admin. The risk surface for home use can be easily reduced by taking a few measures, for instance running SUA, blocking risky file extensions in user folders (Simple Windows Hardening) and allowing only known good (white listed) executables to execute (Configure Defender on MAX). Alternatively you could switch to a more restrictieve OS which does not allow the user to weaken security. In the corporate environment the endpoint protection is not the problem, it is the user who is using that endpoint. Best in class security provides automated analysis of events on endpoints and provides signals when users are sloppy or fall into tricks. In these use cases a script emulator is a watch guard which provides valuable insights for the EDR-system. [/QUOTE]

Verification