Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 945840" data-attributes="member: 32260">Post updated.Simple Windows Hardening vs. NOBELIUM attacks.I posted about these attacks in another thread, but it is interesting that simple prevention can stop such sophisticated attacks.[ATTACH=full]258772[/ATTACH]LNK file is used to run the malicious payload (like malicious DLL or shellcode encoded in the RTF document). It is a common technique to make detection harder by abusing LOLBins.SWH will prevent the attack on the delivery stage by blocking the LNK files in UserSpace, so the execution of the malicious payload is stopped.<s>If the user does not use ISO images of optical disks (CD, DVD, Blue-ray), then the ISO file extension can be also added to the extensions blocked by SWH settings </s> Edit1.Unfortunately, the opening of the ISO files is managed by the Windows built-in handler that does not support SRP. But, ISO files can be still protected by SRP when they are opened by 3rd party applications like WinISO or Deamon Tools.Edit2.Nobelium uses RunDll LOLBin to execute DLL payloads. This can also be blocked when using Microsoft Defender with the enabled ASR rule &quot;Block executable files from running unless they meet a prevalence, age, or trusted list criteria&quot;.</blockquote>

[QUOTE="Andy Ful, post: 945840, member: 32260"] Post updated. [B][SIZE=5]Simple Windows Hardening vs. NOBELIUM attacks.[/SIZE][/B] I posted about these attacks in another thread, but it is interesting that simple prevention can stop such sophisticated attacks. [ATTACH type="full" alt="1622928187539.png"]258772[/ATTACH] LNK file is used to run the malicious payload (like malicious DLL or shellcode encoded in the RTF document). It is a common technique to make detection harder by abusing LOLBins. SWH will prevent the attack on the delivery stage by blocking the LNK files in UserSpace, so the execution of the malicious payload is stopped. [S]If the user does not use ISO images of optical disks (CD, DVD, Blue-ray), then the ISO file extension can be also added to the extensions blocked by SWH settings [/S] Edit1. Unfortunately, the opening of the ISO files is managed by the Windows built-in handler that does not support SRP. But, ISO files can be still protected by SRP when they are opened by 3rd party applications like WinISO or Deamon Tools. Edit2. Nobelium uses RunDll LOLBin to execute DLL payloads. This can also be blocked when using Microsoft Defender with the enabled ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria". [/QUOTE]

Verification