Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 992649" data-attributes="member: 32260">I did not say so. You probably refer to my post:[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/windows-defender-bypassed-the-pc-security-channel.114200/post-991800[/URL]This post was a continuation of a few posts about using PowerShell trojan-downloaders. I had in mind the attack method via successful exploit + PowerShell CmdLines that could rarely &quot;bypass&quot; the H_C Recommended_Settings. This method was discussed several times on MT (BITS Transfer cmdlet) - it is almost absent in widespread attacks. Restricting BITS is not recommendable, so a reasonable fix is not possible (as far as I know), except for blocking PowerShell (can be done in H_C). The recommendable way is to avoid vulnerable (unpatched) applications exploited in the wild.If you use such an application then you have to be cautious or use additional protection like blocking some LOLBins (powershell.exe, powershell_ise.exe),&nbsp; using the DocumentsAntiExploit tool, advanced H_C profiles, etc. The details are included in the H_C manual. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 992649, member: 32260"] I did not say so. You probably refer to my post: [URL unfurl="true"]https://malwaretips.com/threads/windows-defender-bypassed-the-pc-security-channel.114200/post-991800[/URL] This post was a continuation of a few posts about using PowerShell trojan-downloaders. I had in mind the attack method via [B][COLOR=rgb(184, 49, 47)]successful exploit[/COLOR][/B] + PowerShell CmdLines that could rarely "bypass" the H_C Recommended_Settings. This method was discussed several times on MT (BITS Transfer cmdlet) - it is almost absent in widespread attacks. Restricting BITS is not recommendable, so a reasonable fix is not possible (as far as I know), except for blocking PowerShell (can be done in H_C). The recommendable way is to avoid vulnerable (unpatched) applications exploited in the wild. If you use such an application then you have to be cautious or use additional protection like blocking some LOLBins (powershell.exe, powershell_ise.exe), using the DocumentsAntiExploit tool, advanced H_C profiles, etc. The details are included in the H_C manual. (y) [/QUOTE]

Verification