Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 833913" data-attributes="member: 32260">PowerShell and malicious shortcuts.The shortcuts are very useful and that is why they are also dangerous.They can run command-lines, so the shortcut can run any script interpreter (including PowerShell) or another LOLBin.One of SRP features I like, is the ability to block shortcuts by default in UserSpace and whitelist only some locations (for usability). So, if the user will download the malicious shortcut from the Internet to the Download folder, then the shortcut will be blocked.Although blocking shortcuts in SRP is slightly buggy, there is a way to do it properly (not widely known).SRP is exceptional, because shortcuts cannot be blocked (so far) in Applocker, WD Application Control, SysHardener, OSArmor, VoodooShield, etc. I cannot also recall any AV which could do it. I am not sure about AppGuard - it is SRP software so it should be able to block shortcuts. Some security software can restrict shortcut command-lines, by comparing them against the command-line whitelist (blacklist) or by using heuristics.Shortcuts in UserSpace (with some exclusions) are blocked in H_C settings. This can be seen when looking at the option &lt;More SRP ...&gt; &lt;Protect Shortcuts&gt;.</blockquote>

[QUOTE="Andy Ful, post: 833913, member: 32260"] [B]PowerShell and malicious shortcuts.[/B] The shortcuts are very useful and that is why they are also dangerous. They can run [B][COLOR=rgb(184, 49, 47)]command-lines[/COLOR][/B], so the shortcut can run any script interpreter (including PowerShell) or another LOLBin. One of SRP features I like, is the ability to block shortcuts by default in UserSpace and whitelist only some locations (for usability). So, if the user will download the malicious shortcut from the Internet to the Download folder, then the shortcut will be blocked. Although blocking shortcuts in SRP is slightly buggy, there is a way to do it properly (not widely known). SRP is exceptional, because shortcuts cannot be blocked (so far) in Applocker, WD Application Control, SysHardener, OSArmor, VoodooShield, etc. I cannot also recall any AV which could do it. I am not sure about AppGuard - it is SRP software so it should be able to block shortcuts. Some security software can restrict shortcut command-lines, by comparing them against the command-line whitelist (blacklist) or by using heuristics. Shortcuts in UserSpace (with some exclusions) are blocked in H_C settings. This can be seen when looking at the option [B][COLOR=rgb(41, 105, 176)]<More SRP ...> <Protect Shortcuts>[/COLOR][/B]. [/QUOTE]

Verification