Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 625241">Do it as an experiment in VM.PowerShell can be run by using a custom *.dll or executable = even if you disable PowerShell in the Windows Shell and, I believe, disable System.Management.Automation.dll (not 100 % sure on this), then PowerShell can still run on the system.&nbsp; For example, as a post-exploit.That is why you want to run commonly exploited programs - like Office and browsers - with robust restricted privileges.&nbsp; You might end up with a User Session infection that can still cause problems, but once you reboot the system it should not persist if the restrictions are robust with inheritance.Restricted Privileges does not prevent encryption, key-logging, data theft, network connects, etc; it blocks persistence.&nbsp; Encryption does not need persistence.&nbsp; That is why additional User Space policies are needed to bolster Restricted Privileges.</blockquote>

[QUOTE="509322, post: 625241"] Do it as an experiment in VM. PowerShell can be run by using a custom *.dll or executable = even if you disable PowerShell in the Windows Shell and, I believe, disable System.Management.Automation.dll (not 100 % sure on this), then PowerShell can still run on the system. For example, as a post-exploit. That is why you want to run commonly exploited programs - like Office and browsers - with robust restricted privileges. You might end up with a User Session infection that can still cause problems, but once you reboot the system it should not persist if the restrictions are robust with inheritance. Restricted Privileges does not prevent encryption, key-logging, data theft, network connects, etc; it blocks persistence. Encryption does not need persistence. That is why additional User Space policies are needed to bolster Restricted Privileges. [/QUOTE]

Verification