Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 957068" data-attributes="member: 32260">In the H_C Recommended Settings, two hidden folders are whitelisted for EXE and MSI files: user Appdata and Program Data (other files are still forbidden).&nbsp; This is controlled by SmartScreen and H_C settings:&lt;Update Mode&gt; = ON&lt;Harden Archivers&gt;&nbsp; = ON&lt;Harden Email Clients&gt; = ONSo, all software auto-updates can be made without issues via EXE or MSI updaters, and &quot;Install By SmartScreen&quot; can work without forcing high privileges. Also, there will be no problems with applications that install in UserSpace (most such installations are made by default in user AppData or ProgramData subfolders).Users normally do not see these folders (they are hidden in the default Explorer settings). Some web browsers can drop &amp; execute files from user AppData, but this is controlled by SmartScreen (block alert prompts after executing unsafe files). The archive applications and email clients can also do it, but this will be blocked by H_C (&lt;Harden Archivers&gt;&nbsp; and &lt;Harden Email Clients&gt;). Other H_C settings prevent malware files and CmdLines, so there is no direct attack vector that could drop into &amp; run EXE or MSI files from user Appdata and Program Data.These settings can hardly be bypassed in the home environment except if something is exploited. But even in such a case, the attack will be usually prevented because exploits often use scripting methods that are still blocked.The Recommended Settings on Windows 10, &lt;Update Mode&gt;, &lt;Harden Archivers&gt;, and &lt;Harden Email Clients&gt; are explained in the help files and H_C manual.If the user wants to update applications manually, then Strict_Recommended_Settings can be used instead of Recommended_Settings. In Strict_Recommended_Settings all protected files (also EXE and MSI) are blocked also in the user Appdata and Program Data folders. Most software auto-updates will be blocked (except for updates made via scheduled tasks with high privileges) and all applications installed in %UserProfile% will require additional whitelisting.</blockquote>

[QUOTE="Andy Ful, post: 957068, member: 32260"] In the H_C Recommended Settings, two hidden folders are whitelisted for EXE and MSI files: user Appdata and Program Data (other files are still forbidden). This is controlled by SmartScreen and H_C settings: <Update Mode> = ON <Harden Archivers> = ON <Harden Email Clients> = ON So, all software auto-updates can be made without issues via EXE or MSI updaters, and "Install By SmartScreen" can work without forcing high privileges. Also, there will be no problems with applications that install in UserSpace (most such installations are made by default in user AppData or ProgramData subfolders). Users normally do not see these folders (they are hidden in the default Explorer settings). Some web browsers can drop & execute files from user AppData, but this is controlled by SmartScreen (block alert prompts after executing unsafe files). The archive applications and email clients can also do it, but this will be blocked by H_C (<Harden Archivers> and <Harden Email Clients>). Other H_C settings prevent malware files and CmdLines, so there is no direct attack vector that could drop into & run EXE or MSI files from user Appdata and Program Data. These settings can hardly be bypassed in the home environment except if something is exploited. But even in such a case, the attack will be usually prevented because exploits often use scripting methods that are still blocked. The Recommended Settings on Windows 10, <Update Mode>, <Harden Archivers>, and <Harden Email Clients> are explained in the help files and H_C manual. If the user wants to update applications manually, then Strict_Recommended_Settings can be used instead of Recommended_Settings. In Strict_Recommended_Settings all protected files (also EXE and MSI) are blocked also in the user Appdata and Program Data folders. Most software auto-updates will be blocked (except for updates made via scheduled tasks with high privileges) and all applications installed in %UserProfile% will require additional whitelisting. [/QUOTE]

Verification