Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1128589" data-attributes="member: 32260">Hi,It is always interesting to discuss the No-AV setup.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Many attacks will be blocked, but some popular attack vectors are still possible. Therefore, the user must be cautious and have extensive knowledge and experience in using Process Hacker (System Informer).In your case, the problem may be related to game mods or game updates. For example, when the gaming server is compromised, the malicious content will be installed. In such cases, the protection provided by NextDNS is often slowed.Unfortunately, the installed malware often uses trusted IP ranges and HTTPS.ProcessHacker with VT integration is a good protection layer, but may be insufficient nowadays. Many malware use DLLs (no integration with VT) for persistence.It would be interesting to use SAC or a specially adjusted WDAC policy to periodically audit non-system DLLs and drivers. The audit starts when enabling SAC in Evaluate mode or copying the WDAC policy to the appropriate folder.</blockquote>

[QUOTE="Andy Ful, post: 1128589, member: 32260"] Hi, It is always interesting to discuss the No-AV setup.:) Many attacks will be blocked, but some popular attack vectors are still possible. Therefore, the user must be cautious and have extensive knowledge and experience in using Process Hacker (System Informer). In your case, the problem may be related to game mods or game updates. For example, when the gaming server is compromised, the malicious content will be installed. In such cases, the protection provided by NextDNS is often slowed. Unfortunately, the installed malware often uses trusted IP ranges and HTTPS. ProcessHacker with VT integration is a good protection layer, but may be insufficient nowadays. Many malware use DLLs (no integration with VT) for persistence. It would be interesting to use SAC or a specially adjusted WDAC policy to periodically audit non-system DLLs and drivers. The audit starts when enabling SAC in Evaluate mode or copying the WDAC policy to the appropriate folder. [/QUOTE]

Verification