Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 824073" data-attributes="member: 32260">Yes, these are the common malware sources. But, such malware samples are usually nothing new from the viewpoint of advanced techniques applied by modern AVs. Most of them are reused &amp; modified malware samples which were used already in targetted attacks in the past. The best method of bypassing AV protection is using scripts &amp; exploits:[ATTACH=full]216659[/ATTACH][URL unfurl=&quot;true&quot;]https://github.com/microsoft/MSRC-Security-Research/blob/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf[/URL]But, new exploits are rarely used in the widespread attacks (see the above article about software exploits) up to one month from disclosing the vulnerability. So, exploits are not so dangerous for home users who update system/software regularly. The opposite is true for organizations and enterprises because they avoid frequent updates.Still, the problem of scripts remains because they are commonly used also in the widespread attacks and they are not well detected by AVs. Many people on MT forum recommend to block/restrict scripts by using SysHardener, OSA, H_C (Windows built-in SRP), or installing/configuring the AV which can block/restrict scripting.In Windows Defender the Windows native scripts can be restricted by enabling ASR rules - yet, this will not restrict scripts introduced via Java or Python engines.</blockquote>

[QUOTE="Andy Ful, post: 824073, member: 32260"] Yes, these are the common malware sources. But, such malware samples are usually nothing new from the viewpoint of advanced techniques applied by modern AVs. Most of them are reused & modified malware samples which were used already in targetted attacks in the past. The best method of bypassing AV protection is using scripts & exploits: [ATTACH type="full" alt="216659"]216659[/ATTACH] [URL unfurl="true"]https://github.com/microsoft/MSRC-Security-Research/blob/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf[/URL] But, new exploits are rarely used in the widespread attacks (see the above article about software exploits) up to one month from disclosing the vulnerability. So, exploits are not so dangerous for home users who update system/software regularly. The opposite is true for organizations and enterprises because they avoid frequent updates. Still, the problem of scripts remains because they are commonly used also in the widespread attacks and they are not well detected by AVs. Many people on MT forum recommend to block/restrict scripts by using SysHardener, OSA, H_C (Windows built-in SRP), or installing/configuring the AV which can block/restrict scripting. In Windows Defender the Windows native scripts can be restricted by enabling ASR rules - yet, this will not restrict scripts introduced via Java or Python engines. [/QUOTE]

Verification