Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 770210" data-attributes="member: 32260">This attack uses the technique which bypasses the WD ASR rules, if the script is run directly from Explorer (like in the video). It may be blocked by &#039;Network Protection&#039; feature, if the malware website with the payload is on the blacklist (not very probable for 0-day).It can be stopped by ASR when the script is embedded in MS Office document and opened by MS Office application.The malware will be also blocked (but not by ConfigureDefender settings), if one of the below points is true:<ul>
<li data-xf-list-type="ul">disacossiated .js and .jse extensions from wscript.exe (cscript.exe);</li>
<li data-xf-list-type="ul">blocked JScript interpreters (wscript.exe, cscript.exe);</li>
<li data-xf-list-type="ul">PowerShell set to Constrained Language mode</li>
<li data-xf-list-type="ul">blocked PowerShell interpreters (powershell.exe, powershell_ise.exe)</li>
</ul>Of course, the malware will be blocked by default-deny setup which can block Windows scripts.</blockquote>

[QUOTE="Andy Ful, post: 770210, member: 32260"] This attack uses the technique which bypasses the WD ASR rules, if the script is run directly from Explorer (like in the video). It may be blocked by 'Network Protection' feature, if the malware website with the payload is on the blacklist (not very probable for 0-day). It can be stopped by ASR when the script is embedded in MS Office document and opened by MS Office application. The malware will be also blocked (but not by ConfigureDefender settings), if one of the below points is true: [LIST] [*]disacossiated .js and .jse extensions from wscript.exe (cscript.exe); [*]blocked JScript interpreters (wscript.exe, cscript.exe); [*]PowerShell set to Constrained Language mode [*]blocked PowerShell interpreters (powershell.exe, powershell_ise.exe) [/LIST] Of course, the malware will be blocked by default-deny setup which can block Windows scripts. [/QUOTE]

Verification