Reply to thread

Message

<blockquote data-quote="ForgottenSeer 98186" data-source="post: 1026511">I would agree, but Microsoft says otherwise. It blocks LOLBins on its own OS and advocates that users do the same - IF - they do not need the process. There is a lot of paranoia about &quot;What-If&quot; this or that gets blocked during usage and, in reality, those cases are rare or easily solved.Examining SRP block logs from thousands upon thousands of endpoints, shows that a block that breaks something is rare. Even then, it is not permanently broken. It just takes a fix. But I get that most unmanaged home users have no inclination or aptitude for this.I know there has been lots of mis-information that global blocking creates an overwhelmingly negative user experience. That just ain&#039;t true. That claim is just what it is - deliberate mis-information FUD spread by those with an agenda.LOLBin blocking is a higher-level protection model. It takes a bit of knowledge, but its not as if people could not learn it - IF - they wanted to. The whole premise of LOLBin blocking is to throw-up a major speed-bump-wall against more sophisticated threat actors. Most home users don&#039;t even know what that is, let alone care. The protection model is not absolutely effective under any possible circumstances. However, to a large extent it handily deters all those talented malc0ders looking to exploit the chink in the armor.There is no right or wrong protection model. Users should be provided ALL of the information so that they can determine for themselves what works best for them personally.</blockquote>

[QUOTE="ForgottenSeer 98186, post: 1026511"] I would agree, but Microsoft says otherwise. It blocks LOLBins on its own OS and advocates that users do the same - IF - they do not need the process. There is a lot of paranoia about "What-If" this or that gets blocked during usage and, in reality, those cases are rare or easily solved. Examining SRP block logs from thousands upon thousands of endpoints, shows that a block that breaks something is rare. Even then, it is not permanently broken. It just takes a fix. But I get that most unmanaged home users have no inclination or aptitude for this. I know there has been lots of mis-information that global blocking creates an overwhelmingly negative user experience. That just ain't true. That claim is just what it is - deliberate mis-information FUD spread by those with an agenda. LOLBin blocking is a higher-level protection model. It takes a bit of knowledge, but its not as if people could not learn it - IF - they wanted to. The whole premise of LOLBin blocking is to throw-up a major speed-bump-wall against more sophisticated threat actors. Most home users don't even know what that is, let alone care. The protection model is not absolutely effective under any possible circumstances. However, to a large extent it handily deters all those talented malc0ders looking to exploit the chink in the armor. There is no right or wrong protection model. Users should be provided ALL of the information so that they can determine for themselves what works best for them personally. [/QUOTE]

Verification