Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 978504" data-attributes="member: 32260">I would like to add some more comments to the problem of &quot;context&quot;.In their simplest form, both the SRP approach and Parent/Child + CmdLines solutions are kinda dumb when dealing with the &quot;context&quot;. So, the Administrators must add some &quot;context&quot; by using their knowledge to create the rules or the cloud backend has to be used to see the different contexts of benign and malicious actions. But, why does Microsoft still like the SRP approach? The answer is pretty much simple. Microsoft uses Local AI, ASR rules, AMSI, and cloud backend to enhance Parent/Child + CmdLines solutions. The SRP + &quot;system hardening via Policies&quot; is an additional &amp; important protection layer, based on a different approach.In SWH (and H_C) I followed a similar security approach (AV + SRP + basic hardening) and adjusted it to the home environment with a home Administrator.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 978504, member: 32260"] I would like to add some more comments to the problem of "context". [B]In their simplest form, both the SRP approach and Parent/Child + CmdLines solutions are kinda dumb when dealing with the "context". [/B]So, the Administrators must add some "context" by using their knowledge to create the rules or the cloud backend has to be used to see the different contexts of benign and malicious actions. But, why does Microsoft still like the SRP approach? The answer is pretty much simple. Microsoft uses Local AI, ASR rules, AMSI, and cloud backend to enhance Parent/Child + CmdLines solutions. The SRP + "system hardening via Policies" is an additional & important protection layer, based on a different approach. In SWH (and H_C) I followed a similar security approach (AV + SRP + basic hardening) and adjusted it to the home environment with a home Administrator.(y) [/QUOTE]

Verification