Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 796776" data-attributes="member: 32260">Let&#039;s suppose that one uses MS Office version, which is not supported by Microsoft (previous to MS Office 2010) and cannot fully apply ASR. In the home environment, the H_C default-deny (enhanced) settings + non-system-wide Documents Anti-Exploit will be required to stop the threats in the wild. But, there is some additional danger, if one is forced to use frequently the documents from the Enterprise. For example, the Enterprise could be under the targeted attack via specially crafted &amp; weaponized document. I can recommend in such situation the below precautions:<ol>
<li data-xf-list-type="ol">Use &lt;Block Sponsors&gt; in H_C (like [USER=37647]@shmu26[/USER] did).</li>
<li data-xf-list-type="ol">Block the Internet connection to MS Office applications.</li>
<li data-xf-list-type="ol">Block the Internet connection to: certutil.exe, cmstp.exe, control.exe, dnscmd.exe, explorer.exe, ie4uinit.exe, rundll32.exe.</li>
</ol>The above sponsors can be used to run DLLs directly from a remote server or via other ways like .inf files. There are some others, but they are included already on H_C sponsors lists. The same should be done, if for some reason, the sponsor from H_C settings cannot be blocked directly.</blockquote>

[QUOTE="Andy Ful, post: 796776, member: 32260"] Let's suppose that one uses [COLOR=rgb(184, 49, 47)][B]MS Office version, which is not supported[/B][/COLOR] by Microsoft (previous to MS Office 2010) and [COLOR=rgb(184, 49, 47)][B]cannot fully apply ASR[/B][/COLOR]. In the home environment, the H_C default-deny (enhanced) settings + non-system-wide Documents Anti-Exploit will be required to stop the threats in the wild. But, there is some additional danger, if one is forced to use frequently the documents from the Enterprise. For example, the Enterprise could be under the targeted attack via specially crafted & weaponized document. I can recommend in such situation the below precautions: [LIST=1] [*]Use <Block Sponsors> in H_C (like [USER=37647]@shmu26[/USER] did). [*]Block the Internet connection to MS Office applications. [*]Block the Internet connection to: certutil.exe, cmstp.exe, control.exe, dnscmd.exe, explorer.exe, ie4uinit.exe, rundll32.exe. [/LIST] The above sponsors can be used to run DLLs directly from a remote server or via other ways like .inf files. There are some others, but they are included already on H_C sponsors lists. The same should be done, if for some reason, the sponsor from H_C settings cannot be blocked directly. [/QUOTE]

Verification