Poll Do you use Smart App Control? I know, not many of you!

[Sandbox Breaker - DFIR]

Either Kaspersky Default Deny or Xcitium with Harmony KAV Engine

 

[ForgottenSeer 97327]

By "replaced" I did not mean worse. Both SAC and your setup "WDAC + ISG" cover slightly different attack surfaces.

"WDAC + ISG" is vulnerable to some popular attack vectors that SAC covers. These attack vectors have become more dangerous since the year 2023 due to some improvements in transferring MOTW from disk images (ISO, IMG, VHD, VHDX) to their content. Similar improvements will be applied soon to archives (7-Zip, Gz, and RAR). As we know, ISG and SmartScreen are vulnerable to the attack vector via benign/vulnerable EXE + malicious DLL, when the EXE has got MOTW. It is a very simplistic attack when EXE + DLL is contained in the disk image or archive.

SAC can be "bypassed" by some signed malware samples, that can be blocked by "WDAC + ISG".

WDAC without ISG is more comprehensive than SAC and "WDAC + ISG". So yes, Microsoft advises Administrators to use WDAC over SAC. Another reason is that SAC cannot use Managed Installer which automatically allows applications installed by a designated software distribution solution, such as Microsoft Configuration Manager (MEMCM) or Microsoft Intune. WDAC does have several convenient features for Administrators - SAC does not.

Both SAC and "WDAC + ISG" cannot be strong protection against targeted attacks and lateral movement, but can be good protection at home and small business.
The setup "WDAC + ISG" can be improved by blocking execution in folders where users download files from the Internet, and by blocking execution from removable drives.

Some links with real in the wild bypasses would substatiate your story.

For people unable to run SAC, WDAC-ISG is a great alternative

 

[simmerskool]

other: still chugging along on win10

 

[Andy Ful]

Some links with real in the wild bypasses would substatiate your story.

I have seen this attack vector several times, for example:

When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors

Pentest and adversary emulation tool Brute Ratel C4 is effective at defeating modern detection capabilities – and malicious actors have begun to adopt it.

unit42.paloaltonetworks.com

Figure 6. Viewing ISO image with “show hidden files” enabled.​

In the most popular version, the attackers use shortcuts to run the benign/reputable EXE file. It is easy to change the shortcut icon, so it looks like a document, media file, etc. The intention of such an attack is not to bypass ISG (it is a side effect), but to bypass SmartScreen and fool AVs.
SAC can block such attacks in 2 ways:

1. Before the year 2023, the malicious DLL could be blocked (if it was unsigned).​
2. Since the year 2023, the shortcut can be blocked (if the disk image was downloaded from the Internet).​

Unfortunately, the MOTW improvements from the year 2023 work to the advantage of SAC but are not good for WDAC ISG.
Similar attacks can be performed via flash drives. It is also possible to use archives via CVE-2023-40477 vulnerability if the archiver applications are not updated.

 

[Moonhorse]

Last time i tried using SAC it blocked some stuff like razer synapse so i did not bother with it

Nowadays its more mature, not blocking razer stuff anymore so im using SAC nowadays

 

[ForgottenSeer 97327]

Last time i tried using SAC it blocked some stuff like razer synapse so i did not bother with it

Nowadays its more mature, not blocking razer stuff anymore so im using SAC nowadays

Did you reinstall or use the registry hack trick to enable SAC again?

 

[Moonhorse]

Did you reinstall or use the registry hack trick to enable SAC again?

Did clean install , installed whole computer ready and then enabled SAC, did several reboots to see if anything gets blocked

 

[Freki123]

Rofl SAC blocked starfield for me. Any takers: How many hundred thousands of this game has been sold ? My outlook account will consist of only fp reports for SAC till I get to annoyed and disable it

 

[oldschool]

Rofl SAC blocked starfield for me. Any takers: How many hundred thousands of this game has been sold ? My outlook account will consist of only fp reports for SAC till I get to annoyed and disable it
View attachment 278764

But my question is: was it blocked completely or was it still usable? Looks like the former according to your pic.

 

[Freki123]

But my question is: was it blocked completely or was it still usable? Looks like the former according to your pic.

Of course Smart *Irony tag of* AC blocked the whole exe and the game is not usable. MS allows people to be guinea pigs for their insider build why not offer them a button to test a exe? Funfact: Bethesda (the starfield company) was acquired by Microsoft. Either the reported fp from yesterday will result in solving the problem or I have to get rid of it sooner than thought.
Edit:
I disabled SAC.
Support wrote back they say it's not SAC on there part. Maybe I can file it again under another category they say. After some try and error (DISM repair and such) I gave up. Not in the mood to find out what the problem is when support say it's not SAC when my pc says SAC blocked...