Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 840526" data-attributes="member: 32260">It is worth to recall how the &lt;Validate Admin C.S.&gt; option works. If it is set to ON, then the UAC prompt will be not displayed when the unsigned file is executed and the execution will be blocked if the elevation of privileges is required. But, if the malware can bypass UAC, then this setting will not block the execution with an elevation of privileges.So, &lt;Validate Admin C.S.&gt; can be useful to stop the installation of malware that pretends to be a legal application, but will not stop the malware which uses UAC bypass.&lt;Validate Admin C.S.&gt; is stronger on Standard User Account (SUA), because most of the known UAC bypasses (except a few) do not work on SUA.I also analyzed over 20 of Windows Defender (MAX settings) tests made on Malware Hub this year by [USER=51905]Evjl&#039;s Rain[/USER] and [USER=78686]SeriousHoax[/USER]. Only one EXE sample (among all EXE samples) was missed. So, it seems that ConfigureDefender MAX Profile is extremely good for detecting/blocking EXE samples and can be used safely with the H_C profile: Windows_10_MT_Windows_Security_hardening.</blockquote>

[QUOTE="Andy Ful, post: 840526, member: 32260"] It is worth to recall how the <Validate Admin C.S.> option works. If it is set to ON, then the UAC prompt will be not displayed when the unsigned file is executed and the execution will be blocked if the elevation of privileges is required. [COLOR=rgb(184, 49, 47)][B]But, if the malware can bypass UAC, then this setting will not block the execution with an elevation of privileges.[/B][/COLOR] So, <Validate Admin C.S.> can be useful to stop the installation of malware that pretends to be a legal application, but will not stop the malware which uses UAC bypass. <Validate Admin C.S.> is stronger on Standard User Account (SUA), because most of the known UAC bypasses (except a few) do not work on SUA. I also analyzed over 20 of Windows Defender ([B]MAX settings[/B]) tests made on Malware Hub this year by [USER=51905]Evjl's Rain[/USER] and [USER=78686]SeriousHoax[/USER]. Only one EXE sample (among all EXE samples) was missed. So, it seems that ConfigureDefender MAX Profile is extremely good for detecting/blocking EXE samples and can be used safely with the H_C profile: [COLOR=rgb(0, 168, 133)][B]Windows_10_MT_Windows_Security_hardening.[/B][/COLOR] [/QUOTE]

Verification