Reply to thread

Message

<blockquote data-quote="shmu26" data-source="post: 796650" data-attributes="member: 37647">So how common is it for MS Office exploits to use rundll32?I use MS Office, I open docs that come in through email, and I don&#039;t want to enable the ASR rule for block child processes, because then my print-to-fax driver fails. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />And SRP doesn&#039;t offer protection for rundll32. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />On the other hand, I enabled system-wide documents anti-exploit. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Doctor, what are my chances to live to a ripe old age?</blockquote>

[QUOTE="shmu26, post: 796650, member: 37647"] So how common is it for MS Office exploits to use rundll32? I use MS Office, I open docs that come in through email, and I don't want to enable the ASR rule for block child processes, because then my print-to-fax driver fails. :( And SRP doesn't offer protection for rundll32. :( On the other hand, I enabled system-wide documents anti-exploit. :) Doctor, what are my chances to live to a ripe old age? [/QUOTE]

Verification