Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1113415" data-attributes="member: 32260">It is possible that after videos made by [USER=7463]@cruelsister[/USER], me, and [USER=109212]@vitao[/USER] (thank Loyisa) we have got a more objective picture of CIS protection. The [USER=7463]@cruelsister[/USER] videos showed that in a non-enterprise environment, CIS (tweaked) can be one of the strongest solutions. This is still true after the bypasses presented recently. Nothing changed for the members of MT and Wilders Security forums.The videos made by me and [USER=109212]@vitao[/USER] showed that auto-containment is not enough in some special scenarios. Highly targeted attacks that exploit Trusted applications can bypass CIS even with very restrictive settings. It is unclear how such bypasses can impact Enterprises and we do not know if anyone used them in the wild against CIS or Xcitium.But, some in-the-wild attacks could be effective against CIS. [USER=115951]@Loyisa[/USER] used an in-the-wild (slightly modified) sample in one of her POCs. I reported another possibility via PE injection coded in the office macro.</blockquote>

[QUOTE="Andy Ful, post: 1113415, member: 32260"] [B]It is possible that after videos made by [USER=7463]@cruelsister[/USER], me, and [USER=109212]@vitao[/USER] (thank Loyisa) we have got a more objective picture of CIS protection. [/B] The [USER=7463]@cruelsister[/USER] videos showed that in a non-enterprise environment, CIS (tweaked) can be one of the strongest solutions. This is still true after the bypasses presented recently. Nothing changed for the members of MT and Wilders Security forums. The videos made by me and [USER=109212]@vitao[/USER] showed that auto-containment is not enough in some special scenarios. Highly targeted attacks that exploit Trusted applications can bypass CIS even with very restrictive settings. It is unclear how such bypasses can impact Enterprises and we do not know if anyone used them in the wild against CIS or Xcitium. But, some in-the-wild attacks could be effective against CIS. [USER=115951]@Loyisa[/USER] used an in-the-wild (slightly modified) sample in one of her POCs. I reported another possibility via PE injection coded in the office macro. [/QUOTE]

Verification