Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 980046" data-attributes="member: 32260">Anyway, sometimes it refuses to work on some computers for some reason. It is like eating mushrooms. Most people can eat them all their life without problems, but some die. Furthermore, blocking LOLBins on a home computer (Windows 10) is really not necessary when using properly configured SWH. Of course, there is nothing wrong with blocking some of them if one likes/needs such restrictions. The easiest way is simply using H_C.There is a difference between SWH (H_C) and common configurations of Applocker or MDAC. So the necessity of blocking LOLBins in Applocker and MDAC does not pass to SWH (H_C). For example, in MDAC the scripts are not blocked (like in SWH or H_C) but only restricted. Furthermore, shortcuts are allowed, and this opens a wide road for using LOLBins. When using SWH or H_C, the scripts, shortcuts, and many files with executable content are blocked. The setup is much more restricted. So, the attacker can hardly use LOLBins, except when exploiting something.</blockquote>

[QUOTE="Andy Ful, post: 980046, member: 32260"] Anyway, sometimes it refuses to work on some computers for some reason. It is like eating mushrooms. Most people can eat them all their life without problems, but some die. Furthermore, blocking LOLBins on a home computer (Windows 10) is really not necessary when using properly configured SWH. Of course, there is nothing wrong with blocking some of them if one likes/needs such restrictions. The easiest way is simply using H_C. There is a difference between SWH (H_C) and common configurations of Applocker or MDAC. So the necessity of blocking LOLBins in Applocker and MDAC does not pass to SWH (H_C). For example, in MDAC the scripts are not blocked (like in SWH or H_C) but only restricted. Furthermore, shortcuts are allowed, and this opens a wide road for using LOLBins. When using SWH or H_C, the scripts, shortcuts, and many files with executable content are blocked. The setup is much more restricted. So, the attacker can hardly use LOLBins, except when exploiting something. [/QUOTE]

Verification