Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1066306" data-attributes="member: 32260">SWH vs. URL ATTACKS[URL unfurl=&quot;FALSE&quot;]https://malwaretips.com/threads/hackers-exploiting-windows-smartscreen-zero-day-flaw-to-deploy-remcos-rat.127330/[/URL][URL unfurl=&quot;FALSE&quot;]https://infosecwriteups.com/cve-2023-36025-an-in-depth-analysis-of-circumventing-windows-smartscreen-security-6ff05c8b69d0[/URL]Infection chain:phishing email ---&gt;&nbsp; URL file&nbsp; ---&gt; malicious website or harmful code execution via exploitSWH can block such attacks by default (via SRP + system tweak).[ATTACH=full]279857[/ATTACH]******** SRP blocks ************************************Event[0]:Event Id = 865Local Time:&nbsp; 2023/11/24 15:02:04EventRecordID = 20148Execution ProcessID = &#039;1724&#039; ThreadID=&#039;2312&#039;Computer = XXXXUserID=&#039;XXXXAttempted Path = k:\extensions\Read Me.urlDescription: Default Level SRP block****************************************************************************</blockquote>

[QUOTE="Andy Ful, post: 1066306, member: 32260"] SWH vs. URL ATTACKS [URL unfurl="FALSE"]https://malwaretips.com/threads/hackers-exploiting-windows-smartscreen-zero-day-flaw-to-deploy-remcos-rat.127330/[/URL] [URL unfurl="FALSE"]https://infosecwriteups.com/cve-2023-36025-an-in-depth-analysis-of-circumventing-windows-smartscreen-security-6ff05c8b69d0[/URL] Infection chain: phishing email ---> URL file ---> malicious website or harmful code execution via exploit SWH can block such attacks by default (via SRP + system tweak). [ATTACH type="full" alt="1700834505310.png"]279857[/ATTACH] ******** SRP blocks ******** **************************** Event[0]: Event Id = 865 Local Time: 2023/11/24 15:02:04 EventRecordID = 20148 Execution ProcessID = '1724' ThreadID='2312' Computer = XXXX UserID='XXXX Attempted Path = k:\extensions\Read Me.url Description: Default Level SRP block ************************************** ************************************** [/QUOTE]

Verification