Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 937565" data-attributes="member: 62850">Actually, AutoPilot blocks this attack just fine.&nbsp; I am guessing that have your WLC set to &quot;Allow Safe WhitelistCloud items when OFF or AutoPilot&quot;, which would allow this attack when VS is OFF or on AutoPilot.[ATTACH=full]256511[/ATTACH]SRP does not evaluate the parent process in the attack chain (or parse the command line asaik), so it is blind to a lot of advanced attacks, and to elevated attacks.Here are a couple of different ways security products can mitigate against this attack.1.&nbsp; They can globally block appdata and programdata, which is not granular and results in a lot of unwanted blocks.2.&nbsp; They can evaluate the entire attack chain, which is granular and reduces the number of unwanted blocks, and properly block what needs to be blocked. Evaluating the entire attack chain is absolutely vital if you really want to create a robust &quot;lock&quot;... evaluating the parent process is actually just as vital as evaluating the child process.</blockquote>

[QUOTE="danb, post: 937565, member: 62850"] Actually, AutoPilot blocks this attack just fine. I am guessing that have your WLC set to "Allow Safe WhitelistCloud items when OFF or AutoPilot", which would allow this attack when VS is OFF or on AutoPilot. [ATTACH type="full"]256511[/ATTACH] SRP does not evaluate the parent process in the attack chain (or parse the command line asaik), so it is blind to a lot of advanced attacks, and to elevated attacks. Here are a couple of different ways security products can mitigate against this attack. 1. They can globally block appdata and programdata, which is not granular and results in a lot of unwanted blocks. 2. They can evaluate the entire attack chain, which is granular and reduces the number of unwanted blocks, and [U]properly[/U] block what needs to be blocked. Evaluating the entire attack chain is absolutely vital if you really want to create a robust "lock"... evaluating the parent process is actually just as vital as evaluating the child process. [/QUOTE]

Verification