Reply to thread

Message

<blockquote data-quote="Marana" data-source="post: 923789" data-attributes="member: 69370">[USER=32260]@Andy Ful[/USER] Thank you for sheding some light to my blind spot! <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> (after reviewing your excellent H_C and SRP documentation I realized that I also used the term &quot;default deny&quot; in somewhat vague way in my question, but that&#039;s another story...)But anyway, just to check if I got it correctly this time: When running a default deny setup (e.g. H_C &quot;Disallowed&quot; + &quot;All files&quot;), and having .LNK in the DFT list but &quot;%USERPROFILE%\Desktop\*.lnk&quot; whitelisted, I guess that a malicious drive-by download of &quot;Microsoft Edge.LNK&quot; replacing the original link on my desktop would naturally still be possible... and if I have not taken care of LOLBAS protection and would not be blocking uncontrolled outgoing firewall traffic, I could still have my system compromised - or am I still missing something obvious...?</blockquote>

[QUOTE="Marana, post: 923789, member: 69370"] [USER=32260]@Andy Ful[/USER] Thank you for sheding some light to my blind spot! :) (after reviewing your excellent H_C and SRP documentation I realized that I also used the term "default deny" in somewhat vague way in my question, but that's another story...) But anyway, just to check if I got it correctly this time: When running a default deny setup (e.g. H_C "Disallowed" + "All files"), and having .LNK in the DFT list but "%USERPROFILE%\Desktop\*.lnk" whitelisted, I guess that a malicious drive-by download of "Microsoft Edge.LNK" replacing the original link on my desktop would naturally still be possible... and if I have not taken care of LOLBAS protection and would not be blocking uncontrolled outgoing firewall traffic, I could still have my system compromised - or am I still missing something obvious...? [/QUOTE]

Verification