Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 867584" data-attributes="member: 32260">[USER=62850]@danb[/USER],Is it possible that RunBySmartScreen executable which is digitally signed could run any other executable (EXE or MSI) without VT alerts? This would be probably an interesting way of applying the VS golden rule in AutoPilot Mode in simplified form:Do not allow files that are alerted by VS.<ol>
<li data-xf-list-type="ol">All files opened/executed normally (by the user, software auto-update, scheduled tasks, exploit, payload, etc.) will be protected by VS, with a strong default suggestion of not allowing the execution of alerted files (smart-default-deny).</li>
<li data-xf-list-type="ol">EXE and MSI files could be run by the user via the right-click Explorer context menu &quot;Run By SmartScreen&quot; without VS alerts (except maybe those with very high-risk scoring).</li>
</ol>I noticed that some users on MT applied this method in practice. If I correctly remember, there was a similar option in Comodo Firewall.Edit.I noticed that this method can be also applied by WD Application Control available in Windows E3 or E5 versions. The EXE files are allowed when checked &amp; accepted by SmartScreen App Rep, even when they are normally blocked by Intelligent Security Graph.[URL unfurl=&quot;true&quot;]https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph[/URL]</blockquote>

[QUOTE="Andy Ful, post: 867584, member: 32260"] [USER=62850]@danb[/USER], Is it possible that RunBySmartScreen executable which is digitally signed could run any other executable (EXE or MSI) without VT alerts? This would be probably an interesting way of applying the VS golden rule in AutoPilot Mode in simplified form: [B][I][COLOR=rgb(184, 49, 47)]Do not allow files that are alerted by VS[/COLOR][COLOR=rgb(0, 168, 133)].[/COLOR][/I][/B] [LIST=1] [*]All files opened/executed normally (by the user, software auto-update, scheduled tasks, exploit, payload, etc.) will be protected by VS, with a strong default suggestion of not allowing the execution of alerted files (smart-default-deny). [*]EXE and MSI files could be run by the user via the right-click Explorer context menu "Run By SmartScreen" without VS alerts (except maybe those with very high-risk scoring). [/LIST] I noticed that some users on MT applied this method in practice. If I correctly remember, there was a similar option in Comodo Firewall. Edit. I noticed that this method can be also applied by WD Application Control available in Windows E3 or E5 versions. The EXE files are allowed when checked & accepted by SmartScreen App Rep, even when they are normally blocked by Intelligent Security Graph. [URL unfurl="true"]https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph[/URL] [/QUOTE]

Verification