Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 993070" data-attributes="member: 32260">From a theoretical point of view, it is interesting that SWH settings do not need to block the malicious PowerShell CmdLines used in the exploit. So, this malicious PowerShell code can be of any kind. SWH blocks the <a href="https://docs.microsoft.com/en-us/previous-versions/windows/desktop/wintt/running-the-troubleshooting-package" target="_blank">troubleshooting pack</a> for Program Compatibility Wizard, which executes some diagnostic PowerShell scripts required to further execute the malicious code embedded in the exploit. Some useful info can be found in the article:[URL unfurl=&quot;true&quot;]https://www.paloaltonetworks.com/blog/security-operations/prevention-hunting-and-playbooks-for-msdt-zero-day-cve-2022-30190/[/URL]The SWH blocks are applied via * Admin PowerShell Scripts * = Restricted. This is a system-wide Windows Policy, that does not allow whitelisting. The PS1 script files will be blocked in any location, even from the Windows folder.In the Follina exploit the system scripts are copied and run from the UserSpace folder:%UserProfile%\Appdata\Local\TempIn such a case they can be blocked also by ConstrainedLanguage Mode when SRP is applied.If these system scripts were run from the original location in the Windows folder (whitelisted in SRP), then PowerShell would use FullLanguage for them and the scripts could not be blocked. In such a case the Constrained Language Mode would apply only for malicious CmdLines used in the exploit.Anyway, blocking the troubleshooting pack for Program Compatibility Wizard may be useful for other possible exploits.</blockquote>

[QUOTE="Andy Ful, post: 993070, member: 32260"] From a theoretical point of view, it is interesting that SWH settings do not need to block the malicious PowerShell CmdLines used in the exploit. So, this malicious PowerShell code can be of any kind. SWH blocks the [URL='https://docs.microsoft.com/en-us/previous-versions/windows/desktop/wintt/running-the-troubleshooting-package']troubleshooting pack[/URL] for Program Compatibility Wizard, which executes some diagnostic PowerShell scripts required to further execute the malicious code embedded in the exploit. Some useful info can be found in the article: [URL unfurl="true"]https://www.paloaltonetworks.com/blog/security-operations/prevention-hunting-and-playbooks-for-msdt-zero-day-cve-2022-30190/[/URL] The SWH blocks are applied via * Admin PowerShell Scripts * = Restricted. This is a system-wide Windows Policy, that does not allow whitelisting. The PS1 script files will be blocked in any location, even from the Windows folder. In the Follina exploit the system scripts are copied and run from the UserSpace folder: %UserProfile%\Appdata\Local\Temp In such a case they can be blocked also by ConstrainedLanguage Mode when SRP is applied. If these system scripts were run from the original location in the Windows folder (whitelisted in SRP), then PowerShell would use FullLanguage for them and the scripts could not be blocked. In such a case the Constrained Language Mode would apply only for malicious CmdLines used in the exploit. Anyway, blocking the troubleshooting pack for Program Compatibility Wizard may be useful for other possible exploits. [/QUOTE]

Verification