Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1107208" data-attributes="member: 32260">I conducted a simple test with restricted RunDLL32 via Script Analysis and the unknown DLL (other settings like in the Comodo killer).When the DLL was executed by RunDLL32, it was contained. When the same DLL was loaded via DLL hijacking, it was not contained.&nbsp; <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />It is not good, because such an attack is very simple and does not require an exploit.In the standard attacks via LOLBins, the DLL can be contained if the LOLBin that can execute the DLL is restricted.My DLL was unknown but not harmful, so malicious actions of DLL hijacking can probably be mitigated by HIPS/VirusScope.Edit.Added VirusScope.</blockquote>

[QUOTE="Andy Ful, post: 1107208, member: 32260"] I conducted a simple test with restricted RunDLL32 via Script Analysis and the unknown DLL (other settings like in the Comodo killer). When the DLL was executed by RunDLL32, it was contained. When the same DLL was loaded via DLL hijacking, it was not contained. :unsure: It is not good, because such an attack is very simple and does not require an exploit. [B][COLOR=rgb(0, 168, 133)]In the standard attacks via LOLBins, the DLL can be contained if the LOLBin that can execute the DLL is restricted.[/COLOR][/B] My DLL was unknown but not harmful, so malicious actions of DLL hijacking can probably be mitigated by HIPS/[COLOR=rgb(184, 49, 47)]VirusScope[/COLOR]. Edit. Added [COLOR=rgb(184, 49, 47)]VirusScope[/COLOR]. [/QUOTE]

Verification