Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 998881" data-attributes="member: 32260">The Magniber usually deletes shadow copies. I assume that in your video in the OP the UAC was bypassed and files in the protected folders were encrypted without an alert. But still, we can see the Controlled Folder Access alert that svchost.exe was prevented from making changes to the memory.-------------------------------------------------------------------------------------------------------------------<table style='width: 100%'><tr><th>Event ID: 1127</th><th></th></tr><tr><td>Symbolic name:</td><td>MALWAREPROTECTION_FOLDER_GUARD_SECTOR_BLOCK</td></tr><tr><td>Message:</td><td>Controlled Folder Access(CFA) blocked an untrusted process from making changes to the memory.</td></tr><tr><td>Description:</td><td>Controlled Folder Access has blocked an untrusted process from potentially modifying disk sectors.</td></tr></table>-------------------------------------------------------------------------------------------------------------------[URL unfurl=&quot;true&quot;]https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide[/URL]Protection against modifying disk sectors is independent of protecting files in folders. The alert from the video strongly suggests that shadow copies were not deleted (protected by CFA). If not, then Magniber could also exploit the protected disk sectors (MBR, shadow copies, etc.).</blockquote>

[QUOTE="Andy Ful, post: 998881, member: 32260"] The Magniber usually deletes shadow copies. I assume that in your video in the OP the UAC was bypassed and files in the protected folders were encrypted without an alert. But still, we can see the Controlled Folder Access alert that svchost.exe was prevented from making changes to the memory. ------------------------------------------------------------------------------------------------------------------- [TABLE] [TR] [TH]Event ID: 1127[/TH] [TH][/TH] [/TR] [TR] [TD]Symbolic name:[/TD] [TD][B]MALWAREPROTECTION_FOLDER_GUARD_SECTOR_BLOCK[/B][/TD] [/TR] [TR] [TD]Message:[/TD] [TD][B]Controlled Folder Access(CFA) blocked an untrusted process from making changes to the memory.[/B][/TD] [/TR] [TR] [TD]Description:[/TD] [TD]Controlled Folder Access has blocked an untrusted process from potentially modifying disk sectors.[/TD] [/TR] [/TABLE] ------------------------------------------------------------------------------------------------------------------- [URL unfurl="true"]https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide[/URL] Protection against modifying disk sectors is independent of protecting files in folders. The alert from the video strongly suggests that shadow copies were not deleted (protected by CFA). If not, then Magniber could also exploit the protected disk sectors (MBR, shadow copies, etc.). [/QUOTE]

Verification