Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 838417" data-attributes="member: 32260">1. It is slightly more restrictive for EXE and MSI files, checks all loaded DLLs, and does not require MOTW.2. Works on execution (even when executed by malware as payload), covers child processes.But, the version used in H_C will not use most of this because the system partition is whitelisted. On system partition, H_C will not use this protection, but SRP. Only files on non-system drives/partitions will be blocked by WDAC.Here are some examples:<ol>
<li data-xf-list-type="ol">The user runs a legal (but vulnerable) executable from the USB drive which tries to load malicious DLL from this drive. WDAC will block the execution of malicious DLL.</li>
<li data-xf-list-type="ol">The user has copied the EXE file from the USB drive to the Desktop or Download folder. The file execution will be blocked by SRP, even with the H_C Allow EXE setup.</li>
<li data-xf-list-type="ol">The user has copied the file from an infected USB drive (shortcut malware) which is, in fact, a shortcut to malware (DLL, EXE, etc.) hidden somewhere on the USB drive. The shortctuts on Desktop are normally allowed in H_C, but when the shortcut will be executed, then the malware on USB will be blocked by WDAC, anyway.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 838417, member: 32260"] 1. It is slightly more restrictive for EXE and MSI files, checks all loaded DLLs, and does not require MOTW. 2. Works on execution (even when executed by malware as payload), covers child processes. But, the version used in H_C will not use most of this because the system partition is whitelisted. On system partition, H_C will not use this protection, but SRP. Only files on non-system drives/partitions will be blocked by WDAC. Here are some examples: [LIST=1] [*]The user runs a legal (but vulnerable) executable from the USB drive which tries to load malicious DLL from this drive. WDAC will block the execution of malicious DLL. [*]The user has copied the EXE file from the USB drive to the Desktop or Download folder. The file execution will be blocked by SRP, even with the H_C Allow EXE setup. [*]The user has copied the file from an infected USB drive (shortcut malware) which is, in fact, a shortcut to malware (DLL, EXE, etc.) hidden somewhere on the USB drive. The shortctuts on Desktop are normally allowed in H_C, but when the shortcut will be executed, then the malware on USB will be blocked by WDAC, anyway. [/LIST] [/QUOTE]

Verification