Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1056090" data-attributes="member: 32260">Yes.&quot;Run By SmartScreen&quot; works the same, but in WDAC-ISG the user is not forced to use it.By applying WDAC which blocks EXE and MSI files by default. If the user wants to run them, this can be safely done via the right-click Explorer context menu by choosing &quot;Run By SmartScreen&quot;.Before executing the EXE or MSI file, RunBySmartscreen copies the file to another location, so the EXE cannot find the DLLs.Most of the attacks at home are of a different kind. They use a single EXE file vulnerable to DLL hijacking and a hidden DLL - the files are contained in an archive or disk image (ISO, IMG, VHD, VHDX) downloaded from the Internet or USB drive. The DLL is usually a modified system DLL (like version.dll) - it is unrelated to the installation files. The EXE can be often seen in Explorer as a document or picture. When the user opens the file, the hidden DLL is loaded and executed.For example:[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/testing-dll-search-order-hijacking-against-security-features.101171/post-1001945[/URL][URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/testing-dll-search-order-hijacking-against-security-features.101171/post-1007070[/URL]</blockquote>

[QUOTE="Andy Ful, post: 1056090, member: 32260"] Yes. "Run By SmartScreen" works the same, but in WDAC-ISG the user is not forced to use it. By applying WDAC which blocks EXE and MSI files by default. If the user wants to run them, this can be safely done via the right-click Explorer context menu by choosing "Run By SmartScreen". Before executing the EXE or MSI file, RunBySmartscreen copies the file to another location, so the EXE cannot find the DLLs. Most of the attacks at home are of a different kind. They use a single EXE file vulnerable to DLL hijacking and a hidden DLL - the files are contained in an archive or disk image (ISO, IMG, VHD, VHDX) downloaded from the Internet or USB drive. The DLL is usually a modified system DLL (like version.dll) - it is unrelated to the installation files. The EXE can be often seen in Explorer as a document or picture. When the user opens the file, the hidden DLL is loaded and executed. For example: [URL unfurl="true"]https://malwaretips.com/threads/testing-dll-search-order-hijacking-against-security-features.101171/post-1001945[/URL] [URL unfurl="true"]https://malwaretips.com/threads/testing-dll-search-order-hijacking-against-security-features.101171/post-1007070[/URL] [/QUOTE]

Verification