Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 706755" data-attributes="member: 32260">Guys, I think that Andres can cover blocking those files in the way as SRP can do, but the important question is if he should. As [USER=65228]@Opcode[/USER] said the chances to use this hole by malware in the wild is very low. Furthermore, I can see some pros of not blocking those files when executed via external file commander.It would be useful for Andreas to see what people think about it.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Of course, one can imagine the possible way of abusing OSArmor default settings using Office macro to run PowerShell commands and download legitimate portable file commander + some 0-day payloads, and next using that file commander to run those payloads (scripts, .com, .msi or .scr files). But it would be simpler to just download the&nbsp; .exe payload and execute it using MMC20.Application Com object or WMI object. Yet, there is some danger. Some AVs have decent .exe files protection (like Avast Hardened Aggressive mode) but an average detection of&nbsp; .msi files (for example).</blockquote>

[QUOTE="Andy Ful, post: 706755, member: 32260"] Guys, I think that Andres can cover blocking those files in the way as SRP can do, but [B]the important question is if he should. [/B]As [USER=65228]@Opcode[/USER] said the chances to use this hole by malware in the wild is very low. Furthermore, I can see some pros of not blocking those files when executed via external file commander. [B]It would be useful for Andreas to see what people think about it.[/B]:) Of course, one can imagine the possible way of abusing OSArmor default settings using Office macro to run PowerShell commands and download legitimate portable file commander + some 0-day payloads, and next using that file commander to run those payloads ([B]scripts, .com, .msi or .scr[/B] files). But it would be simpler to just download the [B].exe[/B] payload and execute it using MMC20.Application Com object or WMI object. Yet, there is some danger. Some AVs have decent .exe files protection (like Avast Hardened Aggressive mode) but an average detection of .msi files (for example). [/QUOTE]

Verification