Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 992878" data-attributes="member: 62850">It is difficult to say without testing, and the last thing I want to do is test some more <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />.&nbsp; What I do know for sure is that in earlier versions, when VS toggled to OFF, it would not have blocked msdt.exe, which is really where this attack needs to be blocked.&nbsp; It might have have blocked something further down the attack chain, but in my opinion, it is irrelevant because it really should have blocked msdt.exe from ever executing in the first place.&nbsp; We could have gone either way on this, simply because the malicious document will arrive either through a web browser or email client, but out of an abundance of caution, the best thing to do is to always block this attack at the msdt.exe stage.And of course when VS was ON, this attack has always been blocked at the msdt.exe stage.We tried to make the new UI look like the DefenderUI interface.&nbsp; If you have any suggestions please let us know, thank you!</blockquote>

[QUOTE="danb, post: 992878, member: 62850"] It is difficult to say without testing, and the last thing I want to do is test some more ;). What I do know for sure is that in earlier versions, when VS toggled to OFF, it would not have blocked msdt.exe, which is really where this attack needs to be blocked. It might have have blocked something further down the attack chain, but in my opinion, it is irrelevant because it really should have blocked msdt.exe from ever executing in the first place. We could have gone either way on this, simply because the malicious document will arrive either through a web browser or email client, but out of an abundance of caution, the best thing to do is to always block this attack at the msdt.exe stage. And of course when VS was ON, this attack has always been blocked at the msdt.exe stage. We tried to make the new UI look like the DefenderUI interface. If you have any suggestions please let us know, thank you! [/QUOTE]

Verification