Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1061489" data-attributes="member: 32260">I did many times. SRP has been tested for many years by many people. The scripts are blocked, so they cannot deliver anything.You can easily test it:<ol>
<li data-xf-list-type="ol">Create any *.txt file on the desktop and rename its extension txt ---&gt; bat (Explorer must be tweaked to show file extensions).</li>
<li data-xf-list-type="ol">Try to execute this file with a mouse click.</li>
<li data-xf-list-type="ol">Try to execute it from the CMD console (do not use Administrator CMD).</li>
<li data-xf-list-type="ol">Look into the H_C log of blocked events (the blocks will be visible in the log).</li>
<li data-xf-list-type="ol">Repeat points 1-4 for other script extensions (CMD, JS, JSE, VBS, VBE, WSF, WSH, PS1).</li>
</ol>If you ask if SRP can block all possible fileless attack vectors, then the answer is negative. But, almost all vectors can be covered on SUA with the H_C MAX settings.When using the Recommended_Settings, one has to also use ConfigureDefender, FirewallHardening, and DocumentsAntiExploit for maximum protection.</blockquote>

[QUOTE="Andy Ful, post: 1061489, member: 32260"] I did many times. SRP has been tested for many years by many people. The scripts are blocked, so they cannot deliver anything. You can easily test it: [LIST=1] [*]Create any *.txt file on the desktop and rename its extension txt ---> bat (Explorer must be tweaked to show file extensions). [*]Try to execute this file with a mouse click. [*]Try to execute it from the CMD console (do not use Administrator CMD). [*]Look into the H_C log of blocked events (the blocks will be visible in the log). [*]Repeat points 1-4 for other script extensions (CMD, JS, JSE, VBS, VBE, WSF, WSH, PS1). [/LIST] If you ask if SRP can block all possible fileless attack vectors, then the answer is negative. But, almost all vectors can be covered on SUA with the H_C MAX settings. When using the Recommended_Settings, one has to also use ConfigureDefender, FirewallHardening, and DocumentsAntiExploit for maximum protection. [/QUOTE]

Verification