Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 853013" data-attributes="member: 32260">The profile is OK but requires some comment.Unfortunately, there are many cases where 3rd party software can use cmd.exe, wscript.exe, cscript.exe or mshta.exe with standard rights. That can be seen for example from OSArmor threads on MT and Wilderssecurity forums. From personal experience, the Intel software can use BAT files to start some tools with Windows. That is why the files with BAT, CMD, VBS, JS, and HTA extensions are blocked by SRP with the possibility to whitelist the blocked events. Blocking the sponsors do not allow whitelisting, so this has to be done only after testing the system for some time and looking at the H_C Log of blocked events.The MAX Protection level will prevent users from running most of the unknown programs by applying&nbsp; SmartScreen and one ASR rule related to the file prevalence. It is close to blocking unknown programs, but SmartScreen will work only for files with MOTW. The ASR rule will block sometimes the application updates. The user can open/run on-demand any new file via &quot;Run By SmartScreen&quot;, to get the full protection against unknown files.</blockquote>

[QUOTE="Andy Ful, post: 853013, member: 32260"] The profile is OK but requires some comment. Unfortunately, there are many cases where 3rd party software can use cmd.exe, wscript.exe, cscript.exe or mshta.exe with standard rights. That can be seen for example from OSArmor threads on MT and Wilderssecurity forums. From personal experience, the Intel software can use BAT files to start some tools with Windows. That is why the files with BAT, CMD, VBS, JS, and HTA extensions are blocked by SRP with the possibility to whitelist the blocked events. Blocking the sponsors do not allow whitelisting, so this has to be done only after testing the system for some time and looking at the H_C Log of blocked events. The MAX Protection level will prevent users from running most of the unknown programs by applying SmartScreen and one ASR rule related to the file prevalence. It is close to blocking unknown programs, but SmartScreen will work only for files with MOTW. The ASR rule will block sometimes the application updates. The user can open/run on-demand any new file via "Run By SmartScreen", to get the full protection against unknown files. [/QUOTE]

Verification