Hello,
NOTE: If anyone sees problem with this suggestion, please let me know. It has been working fine on my system without any problems.
Quick-Guide.
Problem:
Malware writers produce some clever, malicious scripts that can use Windows interpreters (cmd.exe, wscript.exe, cscript.exe, powershell.exe, java.exe, etc.) and other files for nefarious purposes.
Typically, this involves an internet connection to download malwares.
If you use a firewall, then you can reduce some risk by setting the firewall to "Prompt/Alert/Notifiy" for connection attempts made by the following:
cmd.exe
wscript.exe
cscript.exe
java.exe
rundll32.exe
powershell.exe
powershell_ISE.exe
NOTE: On 64-bit systems need to make firewall rules for above files located in both System32 and SysWOW64 folders.
For convenience I create remote IP address specific firewall rules for these files. For example, PowerShell Help connects to various Microsoft servers to install and update the help files. So I allow connect to those Microsoft servers by inputting their IP address into rule.
Using this method I've caught sneaky network connects... plus it at least gives you notification even when the remote IP address is not in the malicious URL database.
Notable example would be the JS.Encoder\Secured.BAT Vault sample posted on MalwareTips' Malware Hub by @Petrovic.
NOTE: If anyone sees problem with this suggestion, please let me know. It has been working fine on my system without any problems.
Quick-Guide.
Problem:
Malware writers produce some clever, malicious scripts that can use Windows interpreters (cmd.exe, wscript.exe, cscript.exe, powershell.exe, java.exe, etc.) and other files for nefarious purposes.
Typically, this involves an internet connection to download malwares.
If you use a firewall, then you can reduce some risk by setting the firewall to "Prompt/Alert/Notifiy" for connection attempts made by the following:
cmd.exe
wscript.exe
cscript.exe
java.exe
rundll32.exe
powershell.exe
powershell_ISE.exe
NOTE: On 64-bit systems need to make firewall rules for above files located in both System32 and SysWOW64 folders.
For convenience I create remote IP address specific firewall rules for these files. For example, PowerShell Help connects to various Microsoft servers to install and update the help files. So I allow connect to those Microsoft servers by inputting their IP address into rule.
Using this method I've caught sneaky network connects... plus it at least gives you notification even when the remote IP address is not in the malicious URL database.
Notable example would be the JS.Encoder\Secured.BAT Vault sample posted on MalwareTips' Malware Hub by @Petrovic.
Last edited by a moderator:
