Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 996393" data-attributes="member: 32260">Comodo Firewall with CS settings is very powerful because it properly handles the attacks via unknown Portable Executable files (like *.exe, *.dll, etc.). After many years, Microsoft is going to include (optionally) similarly strong protection in Windows 11, which is called Smart App Control (SAC). Unfortunately, SAC is far less usable (for now) compared to CF.Both SAC and CF can be probably defeated by the special fileless attacks which use custom script loaders to execute Portable Executable payloads or shellcode (avoiding standard APIs to create processes or load DLLs). I noticed that some MT members use additionally the SWH to prevent such types of fileless attacks, but it seems unnecessary at home. Such attacks are rare and almost absent in the attacks on home users. Currently, most fileless attacks can be <s>prevented</s> mitigated by the CF (CS settings) alone.</blockquote>

[QUOTE="Andy Ful, post: 996393, member: 32260"] Comodo Firewall with CS settings is very powerful because it properly handles the attacks via unknown Portable Executable files (like *.exe, *.dll, etc.). After many years, Microsoft is going to include (optionally) similarly strong protection in Windows 11, which is called Smart App Control (SAC). Unfortunately, SAC is far less usable (for now) compared to CF. Both SAC and CF can be probably defeated by the special fileless attacks which use custom script loaders to execute Portable Executable payloads or shellcode (avoiding standard APIs to create processes or load DLLs). I noticed that some MT members use additionally the SWH to prevent such types of fileless attacks, but it seems unnecessary at home. Such attacks are rare and almost absent in the attacks on home users. Currently, most fileless attacks can be [S]prevented[/S] mitigated by the CF (CS settings) alone. [/QUOTE]

Verification