Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1058020" data-attributes="member: 32260">The post above (made by [USER=97327]@Max90[/USER]) was moved from another thread:[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/do-you-use-smart-app-control-i-know-not-many-of-you.125871/post-1057970[/URL][USER=97327]@Max90[/USER]Please do not be disappointed.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />I already said that both SAC and your &quot;WDAC + ISG&quot; setup can be good protection at home.It is true that adding SWH to &quot;WDAC + ISG&quot; can (currently) prevent most DLL hijacking attacks that could be missed by &quot;WDAC + ISG&quot;. I do not think that such a setup is (currently) worse than WHHLight.My concerns are of different types:<ol>
<li data-xf-list-type="ol">SWH + WDAC + ISG can be mostly reproduced by WHHLight (WDAC OFF) + ConfigureDefender (MAX)</li>
<li data-xf-list-type="ol"><s>ISG requires Microsoft Defender - WHHLight does not.</s></li>
<li data-xf-list-type="ol"><s>ISG will block many software auto-updates - WHHLight will not.</s></li>
</ol>The point 3 is very important to me as a developer. A few days ago I made some tests with ISG on executables/applications/installers executed from the user Temp folder without MOTW (auto-updates do not have MOTW):<ol>
<li data-xf-list-type="ol">About 40% of them were (partially) blocked by ISG in the user Temp folder.</li>
<li data-xf-list-type="ol">About 30% of applications could not be uninstalled (blocked by ISG in the user Temp folder).</li>
</ol>I do not try to convince you that you should use WHHLight because it will be a better solution for you. But, having in mind my concerns, I cannot see sufficient reasons to implement ISG in WHHLight.I think that I fully explained my concerns, so I will not continue this topic for a while (until additional tests will be made).Post edited.</blockquote>

[QUOTE="Andy Ful, post: 1058020, member: 32260"] The post above (made by [USER=97327]@Max90[/USER]) was moved from another thread: [URL unfurl="true"]https://malwaretips.com/threads/do-you-use-smart-app-control-i-know-not-many-of-you.125871/post-1057970[/URL] [USER=97327]@Max90[/USER] Please do not be disappointed.:) I already said that both SAC and your "WDAC + ISG" setup can be good protection at home. It is true that adding SWH to "WDAC + ISG" can (currently) prevent most DLL hijacking attacks that could be missed by "WDAC + ISG". I do not think that such a setup is (currently) worse than WHHLight. My concerns are of different types: [LIST=1] [*]SWH + WDAC + ISG can be mostly reproduced by WHHLight (WDAC OFF) + ConfigureDefender (MAX) [*][S]ISG requires Microsoft Defender - WHHLight does not.[/S] [*][S]ISG will block many software auto-updates - WHHLight will not.[/S] [/LIST] The point 3 is very important to me as a developer. A few days ago I made some tests with ISG on executables/applications/installers executed from the user Temp folder without MOTW (auto-updates do not have MOTW): [LIST=1] [*]About 40% of them were (partially) blocked by ISG in the user Temp folder. [*]About 30% of applications could not be uninstalled (blocked by ISG in the user Temp folder). [/LIST] I do not try to convince you that you should use WHHLight because it will be a better solution for you. But, having in mind my concerns, I cannot see sufficient reasons to implement ISG in WHHLight. I think that I fully explained my concerns, so I will not continue this topic for a while (until additional tests will be made). Post edited. [/QUOTE]

Verification