Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1058229" data-attributes="member: 32260">I am thinking and testing .... <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />After our discussion, I did not change much my opinion about ISG, but you helped me to see how well SWH compensates the cons of ISG (nice combo).I also noticed that the Microsoft improvements of SmartScreen from this year, made SWH + SmartScreen much stronger. Before those improvements, the attackers could easily skirt around SmartScreen to run EXE or MSI files without MOTW, by using archives and disk images. So, the user had to use the RunBySmartscreen tool. Now, it is not so easy and will be even harder when Microsoft implements native support for 7-zip, Gz, and Rar.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Andy Ful, post: 1058229, member: 32260"] I am thinking and testing .... :) After our discussion, I did not change much my opinion about ISG, but you helped me to see how well SWH compensates the cons of ISG (nice combo). I also noticed that the Microsoft improvements of SmartScreen from this year, made SWH + SmartScreen much stronger. Before those improvements, the attackers could easily skirt around SmartScreen to run EXE or MSI files without MOTW, by using archives and disk images. So, the user had to use the RunBySmartscreen tool. Now, it is not so easy and will be even harder when Microsoft implements native support for 7-zip, Gz, and Rar.:) [/QUOTE]

Verification