Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 733275">Due to how the product is designed its main capability stems around post-exploitation payload blocking IMO. Either way the product is useful and great, I like it a lot.If your browser gets hit with a file-less RCE exploit from the web, NVT OSArmor is not going to be able to stop it. However, the post-exploitation payload might cause additional process creation instead of continuing code execution on the host environment via the browser process for the rest of the operation -&gt; NVT OSArmor monitoring scope is now in action.Bear in mind, things like registry operations would indirectly cause reg.exe to spawn, and NVT OSArmor monitors this as well (for example). So even without directly spawning another process, an operation performed by the payload could cause it... and thus lead to being blocked by NVT OSArmor.Even if payload is not stopped immediately, better later than never... = less damage in the end.Don&#039;t expect it to behave like other &quot;Anti-Exploit&quot;, it doesn&#039;t patch memory to intercept on code execution flow nor scan memory for in-memory signatures... or things like call stack checking. It simply doesn&#039;t work like that. However because of how it works, it&#039;ll behave very light and won&#039;t manipulate 3rd party software, plus it is still useful. And should be compatible when combined with other AE. That way you can use one AE to cover those areas, and NVT OSArmor to focus on different things, and lock down the configuration a bit more to help cut off legs of an attackers payload.Think of it like an Anti-Executable except it isn&#039;t an Anti-Executable but will automatically block process creation depending on the configuration. If the configuration has an enabled rule about bcdedit.exe, the command line will be checked when it is spawned (before the main thread of bcdedit.exe is resumed so it doesn&#039;t start any operation yet) and depending on that command line matching the rule in the configuration -&gt; block process creation (as an example).</blockquote>

[QUOTE="Deleted member 65228, post: 733275"] Due to how the product is designed its main capability stems around post-exploitation payload blocking IMO. Either way the product is useful and great, I like it a lot. If your browser gets hit with a file-less RCE exploit from the web, NVT OSArmor is not going to be able to stop it. However, the post-exploitation payload might cause additional process creation instead of continuing code execution on the host environment via the browser process for the rest of the operation -> NVT OSArmor monitoring scope is now in action. Bear in mind, things like registry operations would indirectly cause reg.exe to spawn, and NVT OSArmor monitors this as well (for example). So even without directly spawning another process, an operation performed by the payload could cause it... and thus lead to being blocked by NVT OSArmor. Even if payload is not stopped immediately, better later than never... = less damage in the end. Don't expect it to behave like other "Anti-Exploit", it doesn't patch memory to intercept on code execution flow nor scan memory for in-memory signatures... or things like call stack checking. It simply doesn't work like that. However because of how it works, it'll behave very light and won't manipulate 3rd party software, plus it is still useful. And should be compatible when combined with other AE. That way you can use one AE to cover those areas, and NVT OSArmor to focus on different things, and lock down the configuration a bit more to help cut off legs of an attackers payload. Think of it like an Anti-Executable except it isn't an Anti-Executable but will automatically block process creation depending on the configuration. If the configuration has an enabled rule about bcdedit.exe, the command line will be checked when it is spawned (before the main thread of bcdedit.exe is resumed so it doesn't start any operation yet) and depending on that command line matching the rule in the configuration -> block process creation (as an example). [/QUOTE]

Verification