Vulnerable Processes

[boredog]

Lately one of the most vulnerable Windows things susceptible of attacks.

Actually if you turn off Appguard and run Voodooshield, you will find it blocks these as well. It wont block msra.exe however.

 

[509322]

Lately one of the most vulnerable Windows things susceptible of attacks.

As long as Microsoft ships powershell with Windows it will be one of the primary infection vectors and post-exploit tools. We are only seeing the beginning. Going forward it will become much worse. On top of it, powershell.exe is not Windows powershell; there is much more to it than simply disabling the shell, powershell.exe. Even with powershell.exe disabled, it can be run using a .dll or custom .exe - and in-memory only to complicate matters. Don't get bent out of shape, disabled powershell.exe prevents the vast majority of attacks. The other stuff is advanced attack stuff that virtually nobody sees - yet.

 

[boredog]

As long as Microsoft ships powershell with Windows it will be one of the primary infection vectors and post-exploit tools. We are only seeing the beginning. Going forward it will become much worse. On top of it, powershell.exe is not Windows powershell; there is much more to it than simply disabling the shell, powershell.exe. Even with powershell.exe disabled, it can be run using a .dll or custom .exe - and in-memory only to complicate matters. Don't get bent out of shape, disabled powershell.exe prevents the vast majority of attacks. The other stuff is advanced attack stuff that virtually nobody sees - yet.

I could be wrong but I thought I read that MS was going to disable by default in Creators build. I might have been dreaming too.
I know there is stuff that can detect if you are running a VM and maybe even some POC showing it can break out of the VM an onto the host for those using VMWare or Virtual Box but have not SD.

 

[509322]

I could be wrong but I thought I read that MS was going to disable by default in Creators build. I might have been dreaming too.
I know there is stuff that can detect if you are running a VM and maybe even some POC showing it can break out of the VM an onto the host for those using VMWare or Virtual Box but have not SD.

I only read that access to cmd, powershell and wscript were disabled by default on Windows 10 S. Disabled access and disabled (completely) are two different things - especially with regards to powershell. We'll have to wait-and-see.

The pre-release notes that I read said "disabled access" and not "disabled." So, flip a coin.