Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 923638" data-attributes="member: 32260">Allowing shortcuts in UserSpace opens the command-line access which would be an important loophole in your security. The malicious shortcuts can use LOLBins to run the malware (also filelessly) from the remote servers or malicious code embedded in innocent files (photos, plain text files, etc.). It is even possible that the shortcut&#039;s command line will extract &amp; execute the encrypted code embedded somewhere in the shortcut&#039;s body. So, keeping .LNK files in the Designated File Types list is highly recommended.If you do not have SRP default-deny setup, then the files on DFT list are not blocked by default in UserSpace! You have to apply custom Disallowed rules for that! Using Unrestricted and Disallowed rules to block the concrete files is not easy, and usually, the users do not know how to do it in the right way.If you use default-deny configured by H_C (Recommended Settings, Strict Recommended Settings, etc.), then you will be prevented from running the malicious code. So, the file modifications on the Desktop will not happen.The exception is turning off the protection by the user or exploiting the system/software. On Windows 10 with well updated Windows and well updated software, you have excellent anti-exploit protection by default. If you use vulnerable applications then you can use &lt;Block Sponsors&gt; or FirewallHardening to block/restrict LOLBins.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 923638, member: 32260"] Allowing shortcuts in UserSpace opens the command-line access which would be an important loophole in your security. The malicious shortcuts can use LOLBins to run the malware (also filelessly) from the remote servers or malicious code embedded in innocent files (photos, plain text files, etc.). It is even possible that the shortcut's command line will extract & execute the encrypted code embedded somewhere in the shortcut's body. So, keeping .LNK files in the Designated File Types list is highly recommended. If you do not have SRP default-deny setup, then the files on DFT list are not blocked by default in UserSpace! You have to apply custom Disallowed rules for that! Using Unrestricted and Disallowed rules to block the concrete files is not easy, and usually, the users do not know how to do it in the right way. If you use default-deny configured by H_C (Recommended Settings, Strict Recommended Settings, etc.), then you will be prevented from running the malicious code. So, the file modifications on the Desktop will not happen. The exception is turning off the protection by the user or exploiting the system/software. On Windows 10 with well updated Windows and well updated software, you have excellent anti-exploit protection by default. If you use vulnerable applications then you can use <Block Sponsors> or FirewallHardening to block/restrict LOLBins.(y) [/QUOTE]

Verification