Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 872961" data-attributes="member: 32260">I am finishing tests with H_C beta ver. 5.0.1.0.One of the tests included fighting CXK-NMSL ransomware. The attack performed via the BAT file bypassed many strong AVs.I considered possible attacks as follows:<ol>
<li data-xf-list-type="ol">Initial BAT malware executed manually by the user from UserSpace,</li>
<li data-xf-list-type="ol">Initial BAT malware executed manually by the user from the email client,</li>
<li data-xf-list-type="ol">Initial (original) BAT malware executed manually by the user from the archiver application,</li>
<li data-xf-list-type="ol">Initial (original) EXE file which extracts &amp; runs the BAT malware by using &quot;cmd /c ...&quot; command-line (in-the-wild attack), when EXE was allowed to run by the AV.</li>
</ol>The test was performed on the weakest H_C setting profile e.g. :Windows_*_Basic_Recommended_Settings.hdcThis profile allows EXE and MSI files globally, except when opened from the archiver or e-mail client applications.The BAT malware was blocked in all scenarios. Furthermore, this profile will block any malware which will use one of these scenarios or similar scenarios 1-4 that use Windows native scripts (like BAT, CMD, JS, JSE, VBS, VBE, WSF, WSH, PS1).The users who applied SysHardener should know that such attacks are not blocked in default settings for BAT and CMD files (also the scenario 4 for PowerShell scripts). Some additional tweaks are required:<ol>
<li data-xf-list-type="ol">Unassociate BAT extension (will block the scenarios 1-3 for BAT scripts, but will not block similar attacks via CMD scripts).</li>
<li data-xf-list-type="ol">Disable PowerShell Script Execution (will block all scenarios 1-4 for PowerShell scripts).</li>
</ol>It is not possible to block scenario 4, by using SysHardener.</blockquote>

[QUOTE="Andy Ful, post: 872961, member: 32260"] I am finishing tests with H_C beta ver. 5.0.1.0. One of the tests included fighting CXK-NMSL ransomware. The attack performed via the BAT file bypassed many strong AVs. I considered possible attacks as follows: [LIST=1] [*]Initial BAT malware executed manually by the user from UserSpace, [*]Initial BAT malware executed manually by the user from the email client, [*]Initial (original) BAT malware executed manually by the user from the archiver application, [*]Initial (original) EXE file which extracts & runs the BAT malware by using "cmd /c ..." command-line (in-the-wild attack), when EXE was allowed to run by the AV. [/LIST] The test was performed on the weakest H_C setting profile e.g. : Windows_*_Basic_Recommended_Settings.hdc This profile allows EXE and MSI files globally, except when opened from the archiver or e-mail client applications. The BAT malware was blocked in all scenarios. Furthermore, this profile will block any malware which will use one of these scenarios or similar scenarios 1-4 that use Windows native scripts (like BAT, CMD, JS, JSE, VBS, VBE, WSF, WSH, PS1). The users who applied SysHardener should know that such attacks are not blocked in default settings for BAT and CMD files (also the scenario 4 for PowerShell scripts). Some additional tweaks are required: [LIST=1] [*]Unassociate BAT extension (will block the scenarios 1-3 for BAT scripts, but will not block similar attacks via CMD scripts). [*]Disable PowerShell Script Execution (will block all scenarios 1-4 for PowerShell scripts). [/LIST] It is not possible to block scenario 4, by using SysHardener. [/QUOTE]

Verification