Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 752441" data-attributes="member: 32260">The feature &quot;Allow apps from the store only&quot; uses MOTW. It works only for applications downloaded via the web browser, Microsoft Store, OneDrive (or similar Internet services).It will be bypassed if you have got the executable file (BAT, COM, EXE, MSI) using:<ul>
<li data-xf-list-type="ul">the downloader or torrent application (EagleGet, utorrent etc.);</li>
<li data-xf-list-type="ul">container format file (zip, 7z, arj, rar, etc.);</li>
<li data-xf-list-type="ul">CD/DVD/Blue-ray disc;</li>
<li data-xf-list-type="ul">CD/DVD/Blue-ray disc image (iso, bin, etc.);</li>
<li data-xf-list-type="ul">non-NTFS USB storage device (FAT32 pendrive, FAT32 USB disk);</li>
<li data-xf-list-type="ul">Memory Card;</li>
</ul>Furthermore, I had no problem with bypassing it when running executables from Total Commander (file manager). One can also change the EXE extension to SCR and bypass it.So, this feature is only for restricting the installations initiated by the user. It is very similar to choosing SmartScreen setting equal to BLOCK in WD (Windows 10). Any payload dropper embedded in the malicious document will bypass it. SmartScreen (on run) can check more file extensions (BAT, CMD, COM, CPL, DLL, EXE, JSE, MSI, OCX, PIF, SCR, and VBE). The difference is that SmartScreen will let run the application with a sufficiently good reputation, but &quot;Allow apps from the store only&quot; will block all apps except those from Microsoft Store.Edit.If someone uses Hard_Configurator, then &quot;Run As SmartScreen&quot; and &quot;Run By SmartScreen&quot; work well with &quot;Allow apps from the store only&quot; feature.</blockquote>

[QUOTE="Andy Ful, post: 752441, member: 32260"] The feature "Allow apps from the store only" uses MOTW. It works only for applications downloaded via the web browser, Microsoft Store, OneDrive (or similar Internet services). It will be bypassed if you have got the executable file (BAT, COM, EXE, MSI) using: [LIST] [*]the downloader or torrent application (EagleGet, utorrent etc.); [*]container format file (zip, 7z, arj, rar, etc.); [*]CD/DVD/Blue-ray disc; [*]CD/DVD/Blue-ray disc image (iso, bin, etc.); [*]non-NTFS USB storage device (FAT32 pendrive, FAT32 USB disk); [*]Memory Card; [/LIST] Furthermore, I had no problem with bypassing it when running executables from Total Commander (file manager). One can also change the EXE extension to SCR and bypass it. So, this feature is only for restricting the installations initiated by the user. It is very similar to choosing SmartScreen setting equal to BLOCK in WD (Windows 10). Any payload dropper embedded in the malicious document will bypass it. SmartScreen (on run) can check more file extensions (BAT, CMD, COM, CPL, DLL, EXE, JSE, MSI, OCX, PIF, SCR, and VBE). The difference is that SmartScreen will let run the application with a sufficiently good reputation, but "Allow apps from the store only" will block all apps except those from Microsoft Store. Edit. If someone uses Hard_Configurator, then "Run As SmartScreen" and "Run By SmartScreen" work well with "Allow apps from the store only" feature. [/QUOTE]

Verification