Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1118761" data-attributes="member: 32260">Enabling Smart App Control on Windows 11, or advanced Windows features (Windows Policies, AppLocker, SRP, WDAC) could prevent this concrete attack flow. [ATTACH=full]287603[/ATTACH]But, this probably would not stop the attackers, just as ATP features of AVs.The attackers were highly motivated to compromise a few targets in &quot;the United Arab Emirates with a distinct interest in aviation and satellite communications organizations, along with critical transportation infrastructure&quot;. In such a case it is always possible to bypass the protection, assuming that the attacker knows the details of applied security.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite113" alt=":confused:" title="Confused&nbsp; &nbsp; :confused:" loading="lazy" data-shortname=":confused:" /></blockquote>

[QUOTE="Andy Ful, post: 1118761, member: 32260"] Enabling Smart App Control on Windows 11, or advanced Windows features (Windows Policies, AppLocker, SRP, WDAC) could prevent this concrete attack flow. [ATTACH type="full" width="291px" alt="1741086262035.png"]287603[/ATTACH] But, this probably would not stop the attackers, just as ATP features of AVs. The attackers were highly motivated to compromise a few targets in "the United Arab Emirates with a distinct interest in aviation and satellite communications organizations, along with critical transportation infrastructure". In such a case it is always possible to bypass the protection, assuming that the attacker knows the details of applied security.:confused: [/QUOTE]

Verification