Advanced Plus Security dronefox1166 configuration 2024/2025

[dronefox1166]

I have update my configuration

 

[dronefox1166]

I have Update my configuration

 

[dronefox1166]

I have update my configuration

 

[oldschool]

Why so many Windows tweaking tools? Isn't that confusing to keep track of?

 

[dronefox1166]

Config' updated

 

[dronefox1166]

Configuration updated

 

[dronefox1166]

configuration updated

 

[Parkinsond]

What do you mean by vb codes? Are they related to VBA features of MS Office (Macros, Add-ins, etc.)?
Do the original documents work differently after disabling H_C restrictions?



Most people infected via MS Office thought that the downloaded files were safe. Most of them were infected via MS Office macros or MS Office Add-ins. There are many other ways that can be adopted by the attackers in the near future to bypass the AV protection by using MS Office.
I do not have a convenient solution for you. Most security applications that protect MS Office use parent-child process monitoring, which is insufficient when you allow macros. I can only advise what I already posted:

1. Use a safe application as the default program to open documents. So when you open the document, template, Add-in, etc., from the Desktop or Explorer (file explorer) it is not opened/installed via MS Office.
   This can be done by the custom configuration of default applications via Windows Settings >> Apps & features >> Default apps >> Set defaults by app. Next, choose MS Office Word, Excel, PowerPoint, and change the default application that can open the listed file types to a safe application.
2. You can still open your documents by opening the MS Office application and using File >> Open from the application menu.
3. If you must edit an unsafe document, then do not do it at once. Check it online and if it looks clean, then open it in MS Office after one or more days.
4. You can additionally use Defender with ASR rules or anti-exploit solutions related to MS Office.
5. Harden your firewall to block LOLBins' connections or use H_C to block popular LOLBins.
6. Learn to recognize phishing attempts.

Be safe.

The first step after install of Office is to disable add-ons; macros are disabled by default; is this enough?

 

[Andy Ful]

The first step after install of Office is to disable add-ons; macros are disabled by default; is this enough?

Only macros with MotW are disabled by default. However, malicious macros are not currently as prevalent as they were in 2022, when I wrote the advice you referred to.
Two years ago, weaponized Microsoft Office documents were a dangerous initial attack vector. Currently, they are dangerous as payloads (fortunately, not so prevalent).
For example, the attacker can use tricks disguised as a document opening:

Read_this_document.bat ----> weaponized DOC file downloaded with no MotW -----> DOC file opened ----> macro executed

ClickFix ----> PowerShell code ----> weaponized DOC file downloaded with no MotW -----> DOC file opened ----> macro executed

In the above examples, the user expects that the document is going to be opened. Most people will not notice anything suspicious.

 

[Victor M]

So why is the countermeasure so dependent on motw? Shouldnt we disable macros altogether? Who uses them anyways, not the avergage joe. We just use MS Word as a glorified notepad.

 

[Parkinsond]

So why is the countermeasure so dependent on motw? Shouldnt we disable macros altogether? Who uses them anyways, not the avergage joe. We just use MS Word as a glorified notepad.

Disabled all the time

Spoiler: MS Word settings

 

[Andy Ful]

So why is the countermeasure so dependent on motw? Shouldnt we disable macros altogether? Who uses them anyways, not the avergage joe. We just use MS Word as a glorified notepad.

Dependence on MotW is practical, especially in Enterprises (documents downloaded from the Internet are restricted, but local resources are not). Security layers must be usable.
However, most people do not need macros. Disabling macros is a good prevention against dangerous threats.

 

[Andy Ful]

Generally, Microsoft Office is vulnerable to exploitation. For example, it contains VBA support, which can be used as a programming language (similar to Python, Java, etc.). The attackers can use scripting or a simple loader to enable access to Visual Basic Object Model (VBOM) in MS Office and silently run VBA malware without running MS Office applications or opening documents.

 

[Fan-of-spyshelter]

@dronefox1166

Screenshot protection is a pro feature, for 5$ per year, and now they have a new version, see the change logs : https://www.schiffer.tech/software/ghostpress/changelog.txt
modification : 4 June 2024.

for u information, I am using this version and it works good with every browser