Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1058695" data-attributes="member: 32260">That is true for pentesters but not for Blue Teams or Red Teams. WDAC and hardening cannot stop skillful teams.I can. For example, by disabling macros in documents, I can prevent any malware that would be downloaded and executed by this macro.WDAC restrictions for scripts can prevent many malware, that could be downloaded and executed.Of course, if the malware was not downloaded it could not be detected.Mostly yes, but we have also attacks via exploits. Metasploit can be used in such attacks. It is probable that the author of this thread is in such a situation.Edit.I am not sure if our discussion is still on topic and interesting for the readers. Although I like to use/test WDAC and hardening, most users will never touch such solutions.Anyway, if the author is ready then it would be interesting to see if your tight hardening could stop his Red Team.</blockquote>

[QUOTE="Andy Ful, post: 1058695, member: 32260"] That is true for pentesters but not for Blue Teams or Red Teams. WDAC and hardening cannot stop skillful teams. I can. For example, by disabling macros in documents, I can prevent any malware that would be downloaded and executed by this macro. WDAC restrictions for scripts can prevent many malware, that could be downloaded and executed. Of course, if the malware was not downloaded it could not be detected. Mostly yes, but we have also attacks via exploits. Metasploit can be used in such attacks. It is probable that the author of this thread is in such a situation. Edit. I am not sure if our discussion is still on topic and interesting for the readers. Although I like to use/test WDAC and hardening, most users will never touch such solutions. Anyway, if the author is ready then it would be interesting to see if your tight hardening could stop his Red Team. [/QUOTE]

Verification