Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 891076" data-attributes="member: 32260">Yes, they can be very dangerous if executed. There are several solutions, for example:<ol>
<li data-xf-list-type="ol">Prevent LOLBin execution by avoiding exploits (Windows/Software Updates, MS Office hardening, Adobe Reader hardening)</li>
<li data-xf-list-type="ol">Blocking command-line access (default-deny for shortcuts, scripts, scriptlets, unsafe files, etc.).</li>
<li data-xf-list-type="ol">Applying the application reputation service for PE files (like SmartScreen Application Reputation).</li>
<li data-xf-list-type="ol">Applying other surface reduction methods that can cut off using any LOLBin.</li>
<li data-xf-list-type="ol">Allowing some vectors from points 1-4, but blocking the concrete set of popular LOLBins or blocking the Internet access for other LOLBins.</li>
</ol>Hard_Configurator Recommended Settings are focused on the remediation based on points 1-4 (PREVENTION).If such prevention is not possible on the concrete computer, then it is necessary to apply also point 5 (BLOCKING).</blockquote>

[QUOTE="Andy Ful, post: 891076, member: 32260"] Yes, they can be very dangerous if executed. There are several solutions, for example: [LIST=1] [*]Prevent LOLBin execution by avoiding exploits (Windows/Software Updates, MS Office hardening, Adobe Reader hardening) [*]Blocking command-line access (default-deny for shortcuts, scripts, scriptlets, unsafe files, etc.). [*]Applying the application reputation service for PE files (like SmartScreen Application Reputation). [*]Applying other surface reduction methods that can cut off using any LOLBin. [*]Allowing some vectors from points 1-4, but blocking the concrete set of popular LOLBins or blocking the Internet access for other LOLBins. [/LIST] Hard_Configurator Recommended Settings are focused on the remediation based on points 1-4 (PREVENTION). If such prevention is not possible on the concrete computer, then it is necessary to apply also point 5 (BLOCKING). [/QUOTE]

Verification