Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 779014" data-attributes="member: 32260">In some way, the PowerShell scripts and macros are blocked by default (for the users). But, that is not the same as saying that they are disabled by default in the system.If the user wants to open the .ps1 script by the mouse-click, then the script will not be executed, but opened in the notepad. So, it is true - in some way it will be disabled for the user.In the default settings, If the user will choose to open the&nbsp; .ps1&nbsp; script by the option &quot;Run with PowerShell&quot;, then in Windows 10 Home (ver. 1809), the PowerShell console will be opened with some options (Y option will allow running the scripts until reboot).If the exploit wants to run the .ps1 script, then it will use -bypass switch in the command line to bypass PowerShell execution policy. But, usually it will use the scripts from the remote locations or will not use scripts but PowerShell commandlines, which easily can bypass the execution policy.So, the PowerShell scripts are restricted by default for the users, but not for the exploits, or the other Windows scripts (VBScript, JScript, etc. can run PowerShell scripts and command lines).In MS Office (versions supported by Microsoft), macros in documents downloaded from the Internet will be blocked, because documents will be opened in the &quot;Protected view&quot;. Yet, the user still has the option to open the documents normally. Most average users usually choose to open documents normally, especially when they can see the instruction that it is necessary (known phishing trick).</blockquote>

[QUOTE="Andy Ful, post: 779014, member: 32260"] In some way, the PowerShell scripts and macros are blocked by default (for the users). But, that is not the same as saying that they are disabled by default in the system. If the user wants to open the .ps1 script by the mouse-click, then the script will not be executed, but opened in the notepad. So, it is true - in some way it will be disabled for the user. In the default settings, If the user will choose to open the .ps1 script by the option "Run with PowerShell", then in Windows 10 Home (ver. 1809), the PowerShell console will be opened with some options (Y option will allow running the scripts until reboot). If the exploit wants to run the .ps1 script, then it will use -bypass switch in the command line to bypass PowerShell execution policy. But, usually it will use the scripts from the remote locations or will not use scripts but PowerShell commandlines, which easily can bypass the execution policy. So, the PowerShell scripts are restricted by default for the users, but not for the exploits, or the other Windows scripts (VBScript, JScript, etc. can run PowerShell scripts and command lines). In MS Office (versions supported by Microsoft), macros in documents downloaded from the Internet will be blocked, because documents will be opened in the "Protected view". Yet, the user still has the option to open the documents normally. Most average users usually choose to open documents normally, especially when they can see the instruction that it is necessary (known phishing trick). [/QUOTE]

Verification