Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 766931" data-attributes="member: 32260">Hard_Configurator + Avast Hardened Mode AggressiveIn one of his posts, [USER=37647]@shmu26[/USER] suggested whitelisting both .exe and .tmp files in the above configuration. So, I tested if .tmp files are checked while Avast Hardened Mode is enabled. I used the commands:cmd /k start c:\z\Hard_Configurator(x64).execmd /k start c:\z\Hard_Configurator(x64).tmpwith the newly compiled version of Hard_Configurator executable (the second with changed file extension).In both cases, the executable was blocked.In another test, I used Stephen Fewer&#039;s reflective_dll.x64.dll with a changed content to avoid whitelisting by Avast:control.exe c:\z\reflective_dll.x64.dllcontrol.exe c:\z\reflective_dll.x64.tmpcontrol.exe c:\z\reflective_dll.x64.cplcontrol.exe c:\z\reflective_dll.x64.ocxcontrol.exe c:\z\reflective_dll.x64.any_extensionAll the above commands could run successfully while Avast was set to Hardened Mode Aggressive.It may be worth to mention, that the WD ASR rule : &quot;Block executable files from running unless they meet a prevalence, age, or trusted list criteria&quot; blocked all cases (.exe, .tmp, .dll, .cpl, .ocx, .any_extension). That rule can be very useful when the exploit tries to compile &amp; execute the malware executable - such malware will be blocked by the mentioned WD ASR rule.When using the Hard_Configurator settings form the profile: WIndows_10_Avast_Hardened_Mode_Aggressive.hdcthe extended DLL blocking is disabled anyway, so both .exe and .tmp files can be safely whitelisted.</blockquote>

[QUOTE="Andy Ful, post: 766931, member: 32260"] [B]Hard_Configurator + Avast Hardened Mode Aggressive[/B] In one of his posts, [USER=37647]@shmu26[/USER] suggested whitelisting both [B] .exe[/B] and [B].tmp[/B] files in the above configuration. So, I tested if .tmp files are checked while Avast Hardened Mode is enabled. I used the commands: cmd /k start c:\z\Hard_Configurator(x64).exe cmd /k start c:\z\Hard_Configurator(x64).tmp with the newly compiled version of Hard_Configurator executable (the second with changed file extension). [COLOR=rgb(0, 168, 133)][B]In both cases, the executable was blocked.[/B][/COLOR] In another test, I used Stephen Fewer's [COLOR=rgb(41, 105, 176)][B]reflective_dll.x64.dll[/B][/COLOR] with a changed content to avoid whitelisting by Avast: control.exe c:\z\reflective_dll.x64.dll control.exe c:\z\reflective_dll.x64.tmp control.exe c:\z\reflective_dll.x64.cpl control.exe c:\z\reflective_dll.x64.ocx control.exe c:\z\reflective_dll.x64.any_extension All the above commands could run successfully while Avast was set to Hardened Mode Aggressive. It may be worth to mention, that the WD ASR rule : "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" blocked all cases (.exe, .tmp, .dll, .cpl, .ocx, .any_extension). That rule can be very useful when the exploit tries to compile & execute the malware executable - such malware will be blocked by the mentioned WD ASR rule. [B]When using the Hard_Configurator settings form the profile: [/B][COLOR=rgb(41, 105, 176)][B] WIndows_10_Avast_Hardened_Mode_Aggressive.hdc[/B][/COLOR] [B]the extended DLL blocking is disabled anyway, so both .exe and .tmp files can be safely whitelisted.[/B] [/QUOTE]

Verification