Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1111554" data-attributes="member: 32260">I think that the attack can be blocked by using only Comodo Firewall (antivirus disabled) and disabling cloud backend:[ATTACH=full]286666[/ATTACH]The idea is to trust only the files whitelisted by the user or signed by Trusted Vendors. Other executables will be considered Unrecognized, even if they are trusted by signatures or in Comodo&#039;s cloud. This should block most attacks via DLL hijacking.However, the setup without a cloud backend must be well tested - I am unsure if Comodo can properly recognize the catalog-signed system files (the certificate is not embedded in a system file).Edit.This setup can be strengthened with Microsoft Defender + ASR rule &quot;Block use of copied or impersonated system tools (preview)&quot;.&nbsp; That rule will prevent using system LOLBins (copied/dropped to UserSpace) vulnerable to DLL hijacking.</blockquote>

[QUOTE="Andy Ful, post: 1111554, member: 32260"] I think that the attack can be blocked by using only Comodo Firewall (antivirus disabled) and disabling cloud backend: [ATTACH type="full" alt="1734474580133.png"]286666[/ATTACH] The idea is to trust only the files whitelisted by the user or signed by Trusted Vendors. Other executables will be considered Unrecognized, even if they are trusted by signatures or in Comodo's cloud. This should block most attacks via DLL hijacking. However, the setup without a cloud backend must be well tested - I am unsure if Comodo can properly recognize the catalog-signed system files (the certificate is not embedded in a system file). Edit. This setup can be strengthened with Microsoft Defender + ASR rule "Block use of copied or impersonated system tools (preview)". That rule will prevent using system LOLBins (copied/dropped to UserSpace) vulnerable to DLL hijacking. [/QUOTE]

Verification