Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 911387" data-attributes="member: 32260">What additional protection can apply the H_C Basic_Recommended_Settings over the WD + ConfigureDefender MAX preset?First, one can use any ConfigureDefender settings with H_C. So, all other H_C settings cover additional vectors of attack:<ol>
<li data-xf-list-type="ol">Scripting.</li>
<li data-xf-list-type="ol">LOLBins executed via shortcuts.</li>
<li data-xf-list-type="ol">Non-executable files with active content.</li>
</ol>The above vectors often end with EXE payload which will be blocked by WD with ConfigureDefender MAX and usually the infection will be neutralized after reboot. This observation follows from tests on Malware Hub. But, in the fileless attacks, the situation is slightly worse because the WD ASR rules can stop only the popular methods. This is still very good protection, as we can see from MRG Effitas tests (Exploit/Fileless samples), for example (<a href="https://www.mrg-effitas.com/wp-content/uploads/2020/09/MRG_Effitas_2020Q2_360.pdf" target="_blank">360 Assessment &amp; Certification – Q2 2020</a>):[ATTACH=full]248169[/ATTACH]Yet, there are several less popular methods that can bypass ASR rules but would be blocked by the H_C Basic_Recommended_Settings and FirewallHardening. Some rare examples can be found on Malware Hub and in the articles about bypassing ASR rules. I made two ransomware scripts that could bypass WD with ConfigureDefender MAX preset (including Controlled Folder Access). These settings and SmartScreen can be also bypassed by DLL hijacking.Anyway, WD + ConfigureDefender MAX preset will be very strong protection even for demanding users.</blockquote>

[QUOTE="Andy Ful, post: 911387, member: 32260"] [B]What additional protection can apply the [COLOR=rgb(41, 105, 176)]H_C Basic_Recommended_Settings[/COLOR] over the [COLOR=rgb(0, 168, 133)]WD + ConfigureDefender MAX[/COLOR] preset?[/B] First, one can use any ConfigureDefender settings with H_C. So, all other H_C settings cover additional vectors of attack: [LIST=1] [*]Scripting. [*]LOLBins executed via shortcuts. [*]Non-executable files with active content. [/LIST] The above vectors often end with EXE payload which will be blocked by WD with ConfigureDefender MAX and usually the infection will be neutralized after reboot. This observation follows from tests on Malware Hub. But, in the fileless attacks, the situation is slightly worse because the WD ASR rules can stop only the popular methods. This is still very good protection, as we can see from MRG Effitas tests (Exploit/Fileless samples), for example ([URL='https://www.mrg-effitas.com/wp-content/uploads/2020/09/MRG_Effitas_2020Q2_360.pdf']360 Assessment & Certification – Q2 2020[/URL]): [ATTACH type="full" alt="1603919716446.png"]248169[/ATTACH] Yet, there are several less popular methods that can bypass ASR rules but would be blocked by the H_C Basic_Recommended_Settings and FirewallHardening. Some rare examples can be found on Malware Hub and in the articles about bypassing ASR rules. I made two ransomware scripts that could bypass WD with ConfigureDefender MAX preset (including Controlled Folder Access). These settings and SmartScreen can be also bypassed by DLL hijacking. Anyway, WD + ConfigureDefender MAX preset will be very strong protection even for demanding users. [/QUOTE]

Verification