Advice Request Kaspersky interactive mode and MS Word

[509322]

While on the subject of configuring Application Control: it is best not to modify it any more than necessary, but I do think it's good to move the 4 powershell processes to Untrusted. That way, even if they get launched via dll or other tricks, they still will not be able to do anything.

The .dll is self-contained and does not rely upon the powershell shell being enabled. In other words, moving them to untrusted is not going to stop powershell from running on the system. Depending upon the type of attack, it could be in-memory only or malware can supply its own self-contained version of powershell that does not require anything that is shipped on the system.

Plus, there is a toggle switch so there is no need to move to Untrusted.

 

[shmu26]

The .dll is self-contained and does not rely upon the powershell shell being enabled. In other words, moving them to untrusted is not going to stop powershell from running on the system.

Now that is interesting. Thanks for clarification. Is there any easy fix the user can do to protect against that dll?

 

[509322]

Now that is interesting. Thanks for clarification. Is there any easy fix the user can do to protect against that dll?

Block the .dll from loading. Don't enable Office macros, block malware from running in User Space, keep system patched,... the usual stuff.

Malware can even copy Windows files in System Space, paste them in User Space and then execute them. That's one of the reasons I recommend Locked Down mode... it disables the Trusted Publisher List and will block the copy-pasted files from executing.

Is that much of a risk ? - no, it isn't.

 

[shmu26]

Malware can even copy Windows files in System Space, paste them in User Space and then execute them. That's one of the reasons I recommend Locked Down mode... it disables the Trusted Publisher List and will block the copy-pasted files from executing.

Is that much of a risk ? - no, it isn't.

Fortunately, powershell and other common script interpreters are not digitally signed, so the Trusted Publisher List shouldn't allow them or their clones to run from user space.