Reply to thread

Message

<blockquote data-quote="wat0114" data-source="post: 945917" data-attributes="member: 91306">Likewise, the occasional issue here, but it does seem to work well.[USER=32260]@Andy Ful[/USER] ,wouldn&#039;t a LOLBin have to launch a malicious file typically dropped in user space? And if this is the case, tight SRP or other anti-executable restrictions should probably stop it?I think I verified it stops the executable in user space. I created a small batch file:[code]start powershell.exe Start-Process C:\users\myname\desktop\wfc6setup.exe[/code] and just called it powershell.batwfc6setup.exe is just a simple firewall interface utility. SRP blocked it: &nbsp;[code]Access to C:\Users\myname\Desktop\wfc6setup.exe has been restricted by your Administrator by the default software restriction policy level.[/code]BTW, just to get this to execute this far, I had to literally add two exclusions to OSArmor, as it&#039;s LOLBin protections wouldn&#039;t allow the batch file to launch <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /> In fact, I had to create an allow path rule in SRP in order to launch the batch file.</blockquote>

[QUOTE="wat0114, post: 945917, member: 91306"] Likewise, the occasional issue here, but it does seem to work well. [USER=32260]@Andy Ful[/USER] , wouldn't a LOLBin have to launch a malicious file typically dropped in user space? And if this is the case, tight SRP or other anti-executable restrictions should probably stop it? I think I verified it stops the executable in user space. I created a small batch file: [code]start powershell.exe Start-Process C:\users\myname\desktop\wfc6setup.exe[/code] and just called it powershell.bat wfc6setup.exe is just a simple firewall interface utility. SRP blocked it: [code]Access to C:\Users\myname\Desktop\wfc6setup.exe has been restricted by your Administrator by the default software restriction policy level.[/code] BTW, just to get this to execute this far, I had to literally add two exclusions to OSArmor, as it's LOLBin protections wouldn't allow the batch file to launch (y) In fact, I had to create an allow path rule in SRP in order to launch the batch file. [/QUOTE]

Verification