Reply to thread

Message

<blockquote data-quote="wat0114" data-source="post: 962211" data-attributes="member: 91306">Agreed, and I do use OSArmor along with H_C to cover both scenarios of blocking scripts. But I think I can provide evidence as seen below where in the first partial log snippet from H_C events, H_C blocks the sample.hta script directly, without need to block a command line where the LOLBin might be involved.[code]Access to C:\Users\myself\Desktop\sample.hta has been restricted by your Administrator by the default software restriction policy level.[/code]In the second log snippet taken from OSArmor&#039;s logs, I have temporarily disabled H_C&#039;s &quot;Default Deny&quot;, and this is where OSA leaps into action blocking &quot;suspicious command line strings&quot;. For this part of the test I also disabled in OSA &quot;Block execution of uncommon scripts&quot;.[code]Rule Name: Block execution of suspicious command-line stringsCommand Line: &quot;C:\WINDOWS\System32\WScript.exe&quot; &quot;C:\Users\myself\Desktop\ClsTS.vbs&quot;[/code]So isn&#039;t WScript in the command line the LOLBin?Either way, there is lots of overlap with these two utilities - maybe too much even - that can effectively block scripting type attacks.EDITfor better clarity, below is the same .vbs file blocked by H_C&#039;s SRP settings, where it kicks in before OSA.[ATTACH]261463[/ATTACH]</blockquote>

[QUOTE="wat0114, post: 962211, member: 91306"] Agreed, and I do use OSArmor along with H_C to cover both scenarios of blocking scripts. But I think I can provide evidence as seen below where in the first partial log snippet from H_C events, H_C blocks the sample.hta script directly, without need to block a command line where the LOLBin might be involved. [code] Access to C:\Users\myself\Desktop\sample.hta has been restricted by your Administrator by the default software restriction policy level.[/code] In the second log snippet taken from OSArmor's logs, I have temporarily disabled H_C's "Default Deny", and this is where OSA leaps into action blocking "suspicious command line strings". For this part of the test I also disabled in OSA "Block execution of uncommon scripts". [code]Rule Name: Block execution of suspicious command-line strings Command Line: "C:\WINDOWS\System32\WScript.exe" "C:\Users\myself\Desktop\ClsTS.vbs"[/code] So isn't WScript in the command line the LOLBin? Either way, there is lots of overlap with these two utilities - maybe too much even - that can effectively block scripting type attacks. [b]EDIT[/b] for better clarity, below is the same .vbs file blocked by H_C's SRP settings, where it kicks in before OSA. [ATTACH]261463[/ATTACH] [/QUOTE]

Verification