App Review Microsoft Defender vs a ransomware Scriptor

[cruelsister]

Content source

https://www.youtube.com/watch?v=wPf1GRbGPt0

 

[Shadowra]

Still a pity that Microsoft Defender does not block it in script :/

(I also liked the end when you wrote in French )

 

[Kongo]

Did you also perform the test with the Configure Defender utility @Max settings?

 

[wat0114]

Thanks again for another test. I enjoyed the music too!

 

[ForgottenSeer 69673]

When the music started playing, I ran and got my ol jug a moonshine and never made it through the video. What happened? As a side note, I didn't think Appguard would have any trouble with this.

 

[Der.Reisende]

So Defender is finally blocking Magniber by behaviour?
At least this is good news.
I‘m actually also excited about SAC.
Of course nothing new to the security world, but being a default part of Windows (even in the „free“ Home version - upgraded from 10 -> 11, activated itself silently) sounds great to me if it works out and does not generate too many FP.
Mine is currently evaluating, since i fresh-installed Win11 22H2 yesterday.

 

[Shadowra]

So Defender is finally blocking Magniber by behaviour?
At least this is good news.
I‘m actually also excited about SAC.
Of course nothing new to the security world, but being a default part of Windows (even in the „free“ Home version - upgraded from 10 -> 11, activated itself silently) sounds great to me if it works out and does not generate too many FP.
Mine is currently evaluating, since i fresh-installed Win11 22H2 yesterday.

And what do you think of SAC if you have tested it?

I installed W11 22h2 yesterday on VM in fresh install, but didn't have time to test SAC against scripts and other malwares yet

 

[Der.Reisende]

And what do you think of SAC if you have tested it?

I installed W11 22h2 yesterday on VM in fresh install, but didn't have time to test SAC against scripts and other malwares yet

I did not test it yet, too, after setting everything up yesterday and today, I noticed the feature scrolling trough Updates and later Defense settings.
As I have understood from articles, it would mostly default-deny unless app is trusted, like AppGuard (?) and others?
I‘d wish for an option to still run like in SmartScreen, in case of FP. So you don’t need to deactivate SAC?
I understood from articles you can only enable from fresh installs and not re-enable?
Thats kinda limiting factor for now, even i understand the intention behind.

What is Smart App Control? - Microsoft Support

Smart App Control is a feature of Windows 11 that helps to block malicious, untrusted, or potentially unwanted apps from running on your device.

support.microsoft.com

 

[cruelsister]

So Defender is finally blocking Magniber by behaviour?

Well, no, it failed quite well. And as to SAC it is extremely limited as how many ONLY have fresh installs without anything else being on the system? And even then if disabled only another fresh install will enable it.

Further SAC seems to obsess over only allowing legitimately signed applications while rejecting those that are not. This would be an issue for many common programs (like Seamonkey browser) which would not be allowed. This kind of protection routine would leave the final decision in the hands of the user as one would not know what is real and what isn't, never a good thing.

 

[oldschool]

(I also liked the end when you wrote in French )

She often uses some French, or Latin just to throw everybody off. My high school Latin is rusty!

 

[Andy Ful]

What follows from the video?

1. Microsoft did not improve the Controlled Folder Access to block the technique used by Magniber.
2. Scripts are usually more dangerous than other popular file types.

It would be interesting if this malicious script is blocked by Defender's ASR rules + highest Cloud Protection Level. If not, then it would mean that Microsoft still does not treat Magniber as really dangerous in the wild.

 

[Der.Reisende]

Well, no, it failed quite well. And as to SAC it is extremely limited as how many ONLY have fresh installs without anything else being on the system? And even then if disabled only another fresh install will enable it.

Further SAC seems to obsess over only allowing legitimately signed applications while rejecting those that are not. This would be an issue for many common programs (like Seamonkey browser) which would not be allowed. This kind of protection routine would leave the final decision in the hands of the user as one would not know what is real and what isn't, never a good thing.

Almost expected, as blocking happened instant in your video.
Sad M$ still doesn‘t care…

Agree on that
And i bet some blackhats will find a way to override.
Signed malware has always been weak point in AVs.

 

[wat0114]

Almost expected, as blocking happened instant in your video.

I didn't notice any blocks or alerts upon the script file being launched, only the installer (msi) file.

 

[Kongo]

It would be interesting if this malicious script is blocked by Defender's ASR rules + highest Cloud Protection Level.

+1

I don't know what I do wrong to always get ignored by her if I ask something. Maybe you get a reply at least.

 

[Shadowra]

What follows from the video?

1. Microsoft did not improve the Controlled Folder Access to block the technique used by Magniber.
2. Scripts are usually more dangerous than other popular file types.

It would be interesting if this malicious script is blocked by Defender's ASR rules + highest Cloud Protection Level. If not, then it would mean that Microsoft still does not treat Magniber as really dangerous in the wild.

I just tested

Spoiler: MD - High

Spoiler: Magniber - No modification

I didn't touch the script, MD detected it

Spoiler: Magniber - Modified

I rebuilt Magniber in .JS by killing the Microsoft Defender detection.
ASR / High rules are still on... no detection!

 

[wat0114]

I just tested

I rebuilt Magniber in .JS by killing the Microsoft Defender detection.

Cool! In Layman's terms, how did you do that?

 

[Shadowra]

Cool! In Layman's terms, how did you do that?

I modified the file with a malware encryptor, simply (which is not free)

 

[Andy Ful]

I just tested

Spoiler: Magniber - No modification

I didn't touch the script, MD detected itView attachment 269528

Could you look in the ConfigureDefender at the <Defender Security Log> to identify the detection details?

Spoiler: Magniber - Modified

I rebuilt Magniber in .JS by killing the Microsoft Defender detection.
ASR / High rules are still on... no detection!
View attachment 269529

Yes, that is a common issue with AV script detection.

 

[Andy Ful]

+1

I don't know what I do wrong to always get ignored by her if I ask something. Maybe you get a reply at least.

You do not do anything wrong - @cruelsister is usually cruel, but can be sometimes a sister, too.

 

[Shadowra]

Could you look in the ConfigureDefender at the <Defender Security Log> to identify the detection details?

I reset the VM :/ I will test again