Reply to thread

Message

<blockquote data-quote="shmu26" data-source="post: 814498" data-attributes="member: 37647">Microsoft published legitimate apps that can be abused by attackers to bypass the security rules and to infect organizations network through living off the land attack methods...<ul>
<li data-xf-list-type="ul">addinprocess.exe</li>
<li data-xf-list-type="ul">addinprocess32.exe</li>
<li data-xf-list-type="ul">addinutil.exe</li>
<li data-xf-list-type="ul">bash.exe</li>
<li data-xf-list-type="ul">bginfo.exe[1]</li>
<li data-xf-list-type="ul">cdb.exe</li>
<li data-xf-list-type="ul">csi.exe</li>
<li data-xf-list-type="ul">dbghost.exe</li>
<li data-xf-list-type="ul">dbgsvc.exe</li>
<li data-xf-list-type="ul">dnx.exe</li>
<li data-xf-list-type="ul">fsi.exe</li>
<li data-xf-list-type="ul">fsiAnyCpu.exe</li>
<li data-xf-list-type="ul">kd.exe</li>
<li data-xf-list-type="ul">ntkd.exe</li>
<li data-xf-list-type="ul">lxssmanager.dll</li>
<li data-xf-list-type="ul">msbuild.exe[2]</li>
<li data-xf-list-type="ul">mshta.exe</li>
<li data-xf-list-type="ul">ntsd.exe</li>
<li data-xf-list-type="ul">rcsi.exe</li>
<li data-xf-list-type="ul">system.management.automation.dll</li>
<li data-xf-list-type="ul">windbg.exe</li>
<li data-xf-list-type="ul">wmic.exe</li>
</ul><a href="https://gbhackers.com/microsoft-legitimate-apps/" target="_blank">Microsoft Published a List of Legitimate Apps that Attackers Abuse</a>&quot;Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications.&quot; Source: <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules" target="_blank">Microsoft recommended block rules (Windows 10)</a></blockquote>

[QUOTE="shmu26, post: 814498, member: 37647"] Microsoft published legitimate apps that can be abused by attackers to bypass the security rules and to infect organizations network through living off the land attack methods... [LIST] [*]addinprocess.exe [*]addinprocess32.exe [*]addinutil.exe [*]bash.exe [*]bginfo.exe[1] [*]cdb.exe [*]csi.exe [*]dbghost.exe [*]dbgsvc.exe [*]dnx.exe [*]fsi.exe [*]fsiAnyCpu.exe [*]kd.exe [*]ntkd.exe [*]lxssmanager.dll [*]msbuild.exe[2] [*]mshta.exe [*]ntsd.exe [*]rcsi.exe [*]system.management.automation.dll [*]windbg.exe [*]wmic.exe [/LIST] [URL="https://gbhackers.com/microsoft-legitimate-apps/"]Microsoft Published a List of Legitimate Apps that Attackers Abuse[/URL] "Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications." Source: [URL="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"]Microsoft recommended block rules (Windows 10)[/URL] [/QUOTE]

Verification