Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 839264" data-attributes="member: 32260">RunAsSmartScreen and DLL hijacking.The purpose of using &quot;Run As SmartScreen&quot; is slightly different from &quot;Run By SmartScreen&quot;. The second is intended for opening/running all files which are located in an unsafe location (like USB drives, Download folder, etc.). The first is intended for:<ul>
<li data-xf-list-type="ul">running safely the EXE or MSI installers which are located in unsafe locations,</li>
<li data-xf-list-type="ul">running already installed applications to update them without turning off the H_C default-deny protection,</li>
<li data-xf-list-type="ul">running Windows administrative tools with admin rights.</li>
</ul>So, &quot;Run As SmartScreen&quot; is prepared to work with default-deny setup (EXE not allowed) and &quot;Run By SmartScreen&quot; works with &quot;Allow EXE and TMP&quot;.The &quot;Run As SmartScreen&quot; will automatically allow EXE files from whitelisted locations and will show the below alert in the case of detected DLLs:&quot;This file cannot be Run As SmartScreen from the current location. One or more DLL files are in the same location, and this can bypass SmartScreen via DLL hijacking. The file will be executed from another location, without loading the DLL files from the current location.Warning.Do not run this file from the current location without using &#039;Run As SmartScreen&#039; or &#039;Run By SmartScreen&#039;, until you are sure that DLL files in the current location are clean. Please note, that they can be often hidden, except when Windows Explorer is set to show hidden files.&quot;</blockquote>

[QUOTE="Andy Ful, post: 839264, member: 32260"] [B][SIZE=5]Run[COLOR=rgb(184, 49, 47)]As[/COLOR]SmartScreen and DLL hijacking.[/SIZE][/B] [SIZE=4]The purpose of using "Run [COLOR=rgb(184, 49, 47)][B]As[/B][/COLOR] SmartScreen" is slightly different from "Run [B][COLOR=rgb(184, 49, 47)]By [/COLOR][/B]SmartScreen". The second is intended for opening/running all files which are located in an unsafe location (like USB drives, Download folder, etc.). The first is intended for:[/SIZE] [LIST] [*]running safely the EXE or MSI installers which are located in unsafe locations, [*]running already installed applications to update them without turning off the H_C default-deny protection, [*]running Windows administrative tools with admin rights. [/LIST] So, "Run [B][COLOR=rgb(184, 49, 47)]As[/COLOR][/B] SmartScreen" is prepared to work with default-deny setup ([B]EXE not allowed[/B]) and "Run [COLOR=rgb(184, 49, 47)][B]By [/B][/COLOR]SmartScreen" works with "[B]Allow EXE and TMP[/B]". The "Run As SmartScreen" will automatically allow EXE files from whitelisted locations and will show the below alert in the case of detected DLLs: "[I]This file cannot be Run As SmartScreen from the current location. One or more DLL files are in the same location, and this can bypass SmartScreen via DLL hijacking. The file will be executed from another location, without loading the DLL files from the current location. Warning. Do not run this file from the current location without using 'Run As SmartScreen' or 'Run By SmartScreen', until you are sure that DLL files in the current location are clean. Please note, that they can be often hidden, except when Windows Explorer is set to show hidden files.[/I]" [/QUOTE]

Verification