Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1007196" data-attributes="member: 32260">The video shows only half of the attack. The attacker has also to deliver a payload to the victim and convince the victim to execute it. The attack can also exploit some vulnerabilities in the victim&#039;s environment (mostly in businesses). After execution, the payload connects to the HTTP server which is controlled by the attacker.I think that some business AVs (with firewalls) could possibly block the reverse shell attack.The attack from the video can be easily prevented by simple firewall hardening (PowerShell outbound connection restrictions).This video is very different from the Magniber (MSI version). In the Magniber campaign, many victims could be also home users. The attack in the video is a typical penetration event, related to the business environment. It would be better to use the business version of Defender with settings recommended by Microsoft (ASR rules, firewall rules, enabled policies, etc.).The free Windows built-in security on default settings is known to be insufficient protection in businesses.Post edited.</blockquote>

[QUOTE="Andy Ful, post: 1007196, member: 32260"] The video shows only half of the attack. The attacker has also to deliver a payload to the victim and convince the victim to execute it. The attack can also exploit some vulnerabilities in the victim's environment (mostly in businesses). After execution, the payload connects to the HTTP server which is controlled by the attacker. I think that some business AVs (with firewalls) could possibly block the reverse shell attack. The attack from the video can be easily prevented by simple firewall hardening (PowerShell outbound connection restrictions). This video is very different from the Magniber (MSI version). In the Magniber campaign, many victims could be also home users. The attack in the video is a typical penetration event, related to the business environment. It would be better to use the business version of Defender with settings recommended by Microsoft (ASR rules, firewall rules, enabled policies, etc.). The free Windows built-in security on default settings is known to be insufficient protection in businesses. Post edited. [/QUOTE]

Verification