Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1114709" data-attributes="member: 32260">It is unimportant because the ISO file is not an executable/application. In my tests I used Edge.These rules should work in the same way as:Action - Run Virtually, File Group - All Applications, File Origin - Removable MediaAction - Run Virtually, File Group - All Applications, File Origin - InternetAction - Run Virtually, File Group - All Applications, File Rating - Unrecognized (default policy)Simply, all applications executed from Removable Media and Internet are contained. The Unrecognized applications are contained everywhere. The Proactive setup includes also three Block rules for Malicious Applications, Suspicious Locations, and Containment FoldersThese settings will <s>contain most of my POCs and</s> prevent most malware including 0-day ones. It is a very strong setup.It is possible to bypass such a setup by using shortcuts + abusing the Trusted applications already installed in the system (LOLBins, MS Office, etc.). For example, Comodo&#039;s challenge method used in my video is not blocked (shortcut + LOLBin abused) and all my POCs are not blocked when running office macros.I would also enable Embedded Code Detection for cmd[.]exe (to prevent many attacks via shortcuts), and block macros in office applications.Post edited.</blockquote>

[QUOTE="Andy Ful, post: 1114709, member: 32260"] It is unimportant because the ISO file is not an executable/application. In my tests I used Edge. These rules should work in the same way as: Action - Run Virtually, File Group - All Applications, File Origin - Removable Media Action - Run Virtually, File Group - All Applications, File Origin - Internet Action - Run Virtually, File Group - All Applications, File Rating - Unrecognized (default policy) Simply, all applications executed from Removable Media and Internet are contained. The Unrecognized applications are contained everywhere. The Proactive setup includes also three Block rules for Malicious Applications, Suspicious Locations, and Containment Folders These settings will [S]contain most of my POCs and[/S] prevent most malware including 0-day ones. It is a very strong setup. It is possible to bypass such a setup by using shortcuts + abusing the Trusted applications already installed in the system (LOLBins, MS Office, etc.). For example, Comodo's challenge method used in my video is not blocked (shortcut + LOLBin abused) and all my POCs are not blocked when running office macros. I would also enable Embedded Code Detection for cmd[.]exe (to prevent many attacks via shortcuts), and block macros in office applications. Post edited. [/QUOTE]

Verification