Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 589097" data-attributes="member: 32260">Secure Shell extensions.Registry settings:*****************************************************************************************************************Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]&quot;EnforceShellExtensionSecurity&quot;=dword:00000001*****************************************************************************************************************A shell extension only runs if there is an entry in at least one of the following locations in Registry:Shell Extensions approved by Administrator for all users:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\ApprovedShell Extensions to run on a per-user basis:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\ApprovedThere were problems with this setting, even for Microsoft software (Internet Explorer, Microsoft Security Essentials), because developers sometimes forget to add shell integration registry value to one of the above Registry keys.Securing Shell Extensions prevents well known path that malware can use for persistence. Anyway, it is worth to know that there is a trick that can bypass EnforceShellExtensionSecurity setting, to obtain persistence without Administrative Rights:<a href="http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/" target="_blank">Malware Persistence: HKEY_CURRENT_USER Shell Extension Handlers</a>Secure Shell extensions option will be added soon in Hard_Configurator.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Andy Ful, post: 589097, member: 32260"] [B]Secure Shell extensions.[/B] Registry settings: ***************************************************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] "EnforceShellExtensionSecurity"=dword:00000001 ***************************************************************************************************************** A shell extension only runs if there is an entry in at least one of the following locations in Registry: Shell Extensions approved by Administrator for all users: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved Shell Extensions to run on a per-user basis: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved There were problems with this setting, even for Microsoft software (Internet Explorer, Microsoft Security Essentials), because developers sometimes forget to add shell integration registry value to one of the above Registry keys. Securing Shell Extensions prevents well known path that malware can use for persistence. Anyway, it is worth to know that there is a trick that can bypass EnforceShellExtensionSecurity setting, to obtain persistence without Administrative Rights: [URL="http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/"]Malware Persistence: HKEY_CURRENT_USER Shell Extension Handlers[/URL] Secure Shell extensions option will be added soon in Hard_Configurator.:) [/QUOTE]

Verification