Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1021013" data-attributes="member: 32260">Thanks for showing how this configuration can work in practice.&nbsp; <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />SAC can add some protection to MAX settings when non-EXE files are used in the attack (MSI, DLL, CPL, etc.).Kaspersky found 11 leftovers, but it seems that they were related to the Edge cache:%LocalAppData%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\Some malware samples were downloaded via Edge with disabled SmartScreen. Anyway, I can confirm that Defender does not clean some malware leftovers.As I mentioned a few months ago, it would be interesting to test the configurations with SAC against digitally signed samples. But it would be a hard task because most malware samples are unsigned.</blockquote>

[QUOTE="Andy Ful, post: 1021013, member: 32260"] Thanks for showing how this configuration can work in practice. (y) SAC can add some protection to MAX settings when non-EXE files are used in the attack (MSI, DLL, CPL, etc.). Kaspersky found 11 leftovers, but it seems that they were related to the Edge cache: %LocalAppData%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\ Some malware samples were downloaded via Edge with disabled SmartScreen. Anyway, I can confirm that Defender does not clean some malware leftovers. As I mentioned a few months ago, it would be interesting to test the configurations with SAC against digitally signed samples. But it would be a hard task because most malware samples are unsigned. [/QUOTE]

Verification