Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 781054" data-attributes="member: 32260">You can use SysHardener to:<ul>
<li data-xf-list-type="ul">disable VBScript and JScript interpreters (wscript.exe and cscript.exe which can host JS, JSE, VBS, VBE, WSF, WSH files),</li>
<li data-xf-list-type="ul">block PowerShell scripts execution from local drives,</li>
<li data-xf-list-type="ul">block fileless PowerShell script execution (from remote locations) and other advanced functions via Constrained Language Mode.</li>
</ul>But there are some other script Interpreters like JavaScript (mshta.exe for HTA files and hh.exe CHM files), etc. which cannot be disabled by the SysHardener ver. 1.5 (actual version). Furthermore,&nbsp; SysHardener does not allow whitelisting.On Windows Pro (GPO or external configurator), one can use SRP and Windows policies to block any Interpreter. Windows Policies do not allow whitelisting, but SRP allows whitelisting VBScript, JScript, and also CMD scripts (BAT and CMD files). SRP has some advantage of compatibility and system stability, because it can block Interpreters started with medium rights and allow those started with higher rights (may be used sometimes by task scheduler).When using OSArmor, the user can disable or restrict many Interpreters like VBScript, JScript, JavaScript, PowerShell, etc. OSArmor allow whitelisting the execution of the particular scripts by whitelisting (adding exclusions). Yet, some Interpreters are still allowed, like hh.exe (for CHM files).There are some other options, like Excubits Bouncer driver, or Anti-Exe applications.</blockquote>

[QUOTE="Andy Ful, post: 781054, member: 32260"] You can use SysHardener to: [LIST] [*]disable VBScript and JScript interpreters (wscript.exe and cscript.exe which can host JS, JSE, VBS, VBE, WSF, WSH files), [*]block PowerShell scripts execution from local drives, [*]block fileless PowerShell script execution (from remote locations) and other advanced functions via Constrained Language Mode. [/LIST] But there are some other script Interpreters like JavaScript (mshta.exe for HTA files and hh.exe CHM files), etc. which cannot be disabled by the SysHardener ver. 1.5 (actual version). Furthermore, SysHardener does not allow whitelisting. On Windows Pro (GPO or external configurator), one can use SRP and Windows policies to [B]block any Interpreter[/B]. Windows Policies do not allow whitelisting, but SRP allows whitelisting VBScript, JScript, and also CMD scripts (BAT and CMD files). SRP has some advantage of compatibility and system stability, because it can block Interpreters started with medium rights and allow those started with higher rights (may be used sometimes by task scheduler). When using OSArmor, the user can disable or restrict many Interpreters like VBScript, JScript, JavaScript, PowerShell, etc. OSArmor allow whitelisting the execution of the particular scripts by whitelisting (adding exclusions). Yet, some Interpreters are still allowed, like hh.exe (for CHM files). There are some other options, like Excubits Bouncer driver, or Anti-Exe applications. [/QUOTE]

Verification