Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 978466" data-attributes="member: 32260">Microsoft does not agree with you:[URL unfurl=&quot;false&quot;]https://docs.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies[/URL]This article applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012. SRP is used on servers to apply it on client machines with Windows 7 and 10.You are right, that classic SRP ignores the context that could help to differentiate the unknown from malicious. That is how also work: all other SRP, default-deny, reputation file lookup, HIPS, and similar solutions. The world is much greater than the parent/child and command-line features.You seem to see upside down the SRP used in SWH. These SRP settings do not block by path and do not block globally the extensions.Post edited/shortened.Edit.The SRP is an old but very useful security idea. A few years ago it seemed that Microsoft would like to get rid of classic SRP. But, classic SRP is still used in many organzations, because it is simpler to deploy and some of its features were not implemented in Applocker and MDAC. That is why it is still present in Windows 11 and Windows Server 2022.SWH uses special SRP settings adjusted for fileless methods (especially as an initial vector).In the examples included in this thread, I used some targeted attacks seen in the wild, if the adopted methods could be reused in the widespread attacks (dangerous also for home users).</blockquote>

[QUOTE="Andy Ful, post: 978466, member: 32260"] Microsoft does not agree with you: [URL unfurl="false"]https://docs.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies[/URL] This article applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012. SRP is used on servers to apply it on client machines with Windows 7 and 10. You are right, that classic SRP ignores the context that could help to differentiate the unknown from malicious. That is how also work: all other SRP, default-deny, reputation file lookup, HIPS, and similar solutions. The world is much greater than the parent/child and command-line features. You seem to see upside down the SRP used in SWH. These SRP settings do not block by path and do not block globally the extensions. Post edited/shortened. Edit. The SRP is an old but very useful security idea. A few years ago it seemed that Microsoft would like to get rid of classic SRP. But, classic SRP is still used in many organzations, because it is simpler to deploy and some of its features were not implemented in Applocker and MDAC. That is why it is still present in Windows 11 and Windows Server 2022. SWH uses special SRP settings adjusted for fileless methods (especially as an initial vector). In the examples included in this thread, I used some targeted attacks seen in the wild, if the adopted methods could be reused in the widespread attacks (dangerous also for home users). [/QUOTE]

Verification