Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 770657">It is just craziness. An overly complicated mousetrap that sometimes catches mice and other times does nothing or, perhaps, smashes the trap setter&#039;s fingers.&nbsp; Users looking at ASR and asking &quot;Wut ?... Will it protect against this ?&quot; And then the user not realizing that the ASR rules must be present (Microsoft has to create them - and they are always playing catch-up) and enabled. If not, they have to figure it out and then do it.It&#039;s fine for us that want to tinker and figure stuff out, but for others who just want to protect their systems this Microsoft spaghetti protection is insane. Not to mention it is just a matter of time that the malc0ders bypass the fixed bypass. It&#039;s cuck-cah !SRP can be crafted such that there is no wondering about &quot;Will this protect against this ?&quot; The only real protection to be had is at the process level - either allowing or denying the process. The fine-grained rules blocking specific behaviors is a pipe-dream fallacy - because new malicious behaviors that bypass current rules are implemented. Merely disable wscript and the rest of unwanted stepchild processes. This is not difficult. This is really easy. It is almost &quot;push button&quot; protection.</blockquote>

[QUOTE="509322, post: 770657"] It is just craziness. An overly complicated mousetrap that sometimes catches mice and other times does nothing or, perhaps, smashes the trap setter's fingers. Users looking at ASR and asking "Wut ?... Will it protect against this ?" And then the user not realizing that the ASR rules must be present (Microsoft has to create them - and they are always playing catch-up) and enabled. If not, they have to figure it out and then do it. It's fine for us that want to tinker and figure stuff out, but for others who just want to protect their systems this Microsoft spaghetti protection is insane. Not to mention it is just a matter of time that the malc0ders bypass the fixed bypass. It's cuck-cah ! SRP can be crafted such that there is no wondering about "Will this protect against this ?" The only real protection to be had is at the process level - either allowing or denying the process. The fine-grained rules blocking specific behaviors is a pipe-dream fallacy - because new malicious behaviors that bypass current rules are implemented. Merely disable wscript and the rest of unwanted stepchild processes. This is not difficult. This is really easy. It is almost "push button" protection. [/QUOTE]

Verification