Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 932304" data-attributes="member: 32260">I could do it, but I am afraid that this would make SWH overcomplicated. Furthermore, LOLBins are dangerous in the home environment when the user can accidentally run command-lines via shortcuts, scripts, scriptlets, macros, or files with active content. But, such actions are already prevented by SWH. The users who have MS Office installed can use ConfigureDefender HIGH Protection Level (or DocumentsAntiExploit tool) to prevent running LOLBins via weaponized documents.Blocking LOLBins in Windows 10 could make sense when using MS Office with allowed macros and shortcuts - that is a common case in businesses. It could also make sense to prevent targeted attacks. That is why LOLBins are often blocked via SRP, Applocker, or Defender Application Control. For similar reasons, they are blocked/blacklisted when using business-oriented applications like AppGuard or VoodooShield (shortcuts and some files with active content are allowed).</blockquote>

[QUOTE="Andy Ful, post: 932304, member: 32260"] I could do it, but I am afraid that this would make SWH overcomplicated. Furthermore, LOLBins are dangerous in the home environment when the user can accidentally run command-lines via shortcuts, scripts, scriptlets, macros, or files with active content. But, such actions are already prevented by SWH. The users who have MS Office installed can use ConfigureDefender HIGH Protection Level (or DocumentsAntiExploit tool) to prevent running LOLBins via weaponized documents. Blocking LOLBins in Windows 10 could make sense when using MS Office with allowed macros and shortcuts - that is a common case in businesses. It could also make sense to prevent targeted attacks. That is why LOLBins are often blocked via SRP, Applocker, or Defender Application Control. For similar reasons, they are blocked/blacklisted when using business-oriented applications like AppGuard or VoodooShield (shortcuts and some files with active content are allowed). [/QUOTE]

Verification