Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1075175" data-attributes="member: 32260">WHHLight vs. Raspberry Robin(Smart App Control set to OFF)[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/raspberry-robin-malware-returns-with-early-access-to-windows-exploits.128932/post-1074940[/URL][URL unfurl=&quot;false&quot;]https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/[/URL]The attack was dangerous due to exploiting the vulnerability that allows a local attacker to escalate privileges to SYSTEM (Local Privilege Escalation). The exploit was sold on Dark Web forums several months before Microsoft and CISA released an advisory on active exploitation.But in this post, I focus on the initial phase of the attack to show how WHHLight could prevent the attack in the wild.Attack flow:[ATTACH=full]281537[/ATTACH]Such attacks via EXE files can be blocked when &lt; WDAC &gt; = ON in WHHLight.The OleView.exe is a benign executable so it will be allowed by SmartScreen and WDAC ISG. But, the malicious DLL side-loading can be blocked by WDAC ISG.Edit.It is worth mentioning that DLL hijacking (0-day malware) can be a challenge for Microsoft Defender, even in MAX settings. The ASR rule &quot;Block executable files from running unless they meet a prevalence, age, or trusted list criteria&quot; does not cover this attack vector.</blockquote>

[QUOTE="Andy Ful, post: 1075175, member: 32260"] [B][SIZE=5]WHHLight vs. Raspberry Robin[/SIZE] (Smart App Control set to OFF)[/B] [URL unfurl="false"]https://malwaretips.com/threads/raspberry-robin-malware-returns-with-early-access-to-windows-exploits.128932/post-1074940[/URL] [URL unfurl="false"]https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/[/URL] The attack was dangerous due to exploiting the vulnerability that allows a local attacker to escalate privileges to SYSTEM (Local Privilege Escalation). The exploit was sold on Dark Web forums several months before Microsoft and CISA released an advisory on active exploitation. But in this post, I focus on the initial phase of the attack to show how WHHLight could prevent the attack in the wild. [B][COLOR=rgb(184, 49, 47)]Attack flow:[/COLOR][/B] [ATTACH type="full" alt="1707770110306.png"]281537[/ATTACH] Such attacks via EXE files can be blocked when < WDAC > = ON in WHHLight. The OleView.exe is a benign executable so it will be allowed by SmartScreen and WDAC ISG. But, the malicious DLL side-loading can be blocked by WDAC ISG. Edit. It is worth mentioning that DLL hijacking (0-day malware) can be a challenge for Microsoft Defender, even in MAX settings. The ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" does not cover this attack vector. [/QUOTE]

Verification