Reply to thread

Message

<blockquote data-quote="ForgottenSeer 98186" data-source="post: 1032572">Yes, IIRC the attack requires a reverse shell (e.g. via a weaponized document or an agent). That type of attack is thwarted easily by using SWH. Not really a threat to a home user - unless that home user is a member of National Security Bureau (Polish: Biuro Bezpieczeństwa Narodowego, BBN) with data on their system that a nation state adversary wants.IIRC this was how Morphisec bypassed CIG.The injection can be easily thwarted again by preventing execution of common file types. SWH is going to prevent these sorts of attacks. I&#039;m sure there are corner cases where such an attack could succeed, but realistically they are not much of a threat. So hardening the system against them is overkill for the unlikely instance of a system exploit or other clever attack.Adding a bunch of processes to CIG is the exploit protection equivalent of adding 250 LOLBins to a block list. While both can be done at the home user level, it just is not necessary for a home user except in extreme circumstances (e.g. a home user lives in a nation that oppresses dissidents and they are being targeted by the government; think FinSpy).It is always good infos to know, just-in-case. Overall though, as you&#039;ve previously stated, these sorts of configurations provide little additional protection.My data collected from the field shows: svchost, explorer, taskhost and lsass (less commonly targeted now due to Microsoft&#039;s increased lsass memory protections).</blockquote>

[QUOTE="ForgottenSeer 98186, post: 1032572"] Yes, IIRC the attack requires a reverse shell (e.g. via a weaponized document or an agent). That type of attack is thwarted easily by using SWH. Not really a threat to a home user - unless that home user is a member of National Security Bureau (Polish: Biuro Bezpieczeństwa Narodowego, BBN) with data on their system that a nation state adversary wants. IIRC this was how Morphisec bypassed CIG. The injection can be easily thwarted again by preventing execution of common file types. SWH is going to prevent these sorts of attacks. I'm sure there are corner cases where such an attack could succeed, but realistically they are not much of a threat. So hardening the system against them is overkill for the unlikely instance of a system exploit or other clever attack. Adding a bunch of processes to CIG is the exploit protection equivalent of adding 250 LOLBins to a block list. While both can be done at the home user level, it just is not necessary for a home user except in extreme circumstances (e.g. a home user lives in a nation that oppresses dissidents and they are being targeted by the government; think FinSpy). It is always good infos to know, just-in-case. Overall though, as you've previously stated, these sorts of configurations provide little additional protection. My data collected from the field shows: svchost, explorer, taskhost and lsass (less commonly targeted now due to Microsoft's increased lsass memory protections). [/QUOTE]

Verification