Most important layers in security setup

[JM Safe]

Yes, for users who are going to run script files by themselves (casual users). Yet, this kind of protection can be bypassed when the script is run by opening documents, media files, or shortcuts. Disabling the second possibility is not easy. The stronger script blocking can be done by blocking the script interpreters by hash. The other way (not recomended) is blocking script engine DLLs.

Agree.

 

[Windows_Security]

Ironic conclusion that IMO the most effective protection against embedded code/scripts in rich content document/files comes from free programs like SysHardener and OSArmor (with anti-exe) and or DocumentsAntiExploit and HardConfigurator (using Windows Software Restriction Policies).

Question to @Andy Ful
Does HardConfigurator also removes user write access to RunOnce, Run, Run Only etc registry entries in HKCU (so only elevated software/admin users can change it)?

Regards Kees

 

[Andy Ful]

...
Question to @Andy Ful
Does HardConfigurator also removes user write access to RunOnce, Run, Run Only etc registry entries in HKCU (so only elevated software/admin users can change it)?

Regards Kees

I thought about it, because those Registry keys are often used to run the malware after reboot.
Unfortunately, also many legal software and sometimes Windows processes (especially after updates) can also use RunOnce or Run keys to do something after reboot on the particular user account. That would be a problem, because removing user write access would block silently any changes in those keys.So, they are not blocked in Hard_Configurator, but the payload which would try to start with Windows, will be blocked in the UserSpace.

Yet, monitoring/checking those Registry keys and some others would be an important security layer. I usually do this via Sysinternals Autoruns.

Regards.