Reply to thread

Message

<blockquote data-quote="wat0114" data-source="post: 995925" data-attributes="member: 91306">I&#039;m thinking the SRP-enforced rules used in H_C (Hard_Configurator) would maybe block either of the UAC elevation commands using C:\Windows\System32\wbem\WMIC.exe as explained further down the cybereason article in this link:<a href="https://www.cybereason.com/blog/threat-analysis-report-printnightmare-and-magniber-ransomware" target="_blank">Threat Analysis Report: PrintNightmare and Magniber Ransomware</a>Of course we don&#039;t yet know if CS&#039; test resulted in the malware gaining elevated privileges, and whether or not the test even utilized that UAC elevation method.Actually, any possibility CS could test this malware with H_C ? <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />EDITI tried to include the quoted UAC elevation methods from the article, but I was unable to post for some reason <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" /></blockquote>

[QUOTE="wat0114, post: 995925, member: 91306"] I'm thinking the SRP-enforced rules used in H_C (Hard_Configurator) would [I]maybe[/I] block either of the UAC elevation commands using [B]C:\Windows\System32\wbem\WMIC.exe[/B] as explained further down the cybereason article in this link: [URL='https://www.cybereason.com/blog/threat-analysis-report-printnightmare-and-magniber-ransomware']Threat Analysis Report: PrintNightmare and Magniber Ransomware[/URL] Of course we don't yet know if CS' test resulted in the malware gaining elevated privileges, and whether or not the test even utilized that UAC elevation method. Actually, any possibility CS could test this malware with H_C ? :) [B]EDIT[/B] I tried to include the quoted UAC elevation methods from the article, but I was unable to post for some reason :( [/QUOTE]

Verification