Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1026564" data-attributes="member: 32260">Back to the discussion. I think that there is a general agreement about blocking LOLBins in businesses. I would like to note that in businesses the LOLBins will be blocked mostly via SRP, AppLocker, WDAC, etc. There is no need to use Exploit Protection for that. It is probable that it can be more popular at home (including home businesses).From my experience, most readers are attracted by restrictions and mitigations used in businesses and try to implement them at home. It is not necessarily a good idea. Home users should rather pay attention to Smart App Control. This is a recommendable approach at home.I am not saying that blocking LOLBins at home is wrong. I am trying to say that it is not the optimal solution at home on Windows 10+.Unfortunately, if one does not like the classic SRP and cannot live with SAC, then some LOLBins should be probably blocked. Blocking cmd, powershell, wscript, and cscript can be a starting point. From my tests, it follows that after installing Windows Updates the system sometimes tries to use cmd, regsvr32, and runonce, but I did not notice any negative impact after such blocks. On most computers, there will be a few blocks per day related to rundll32, because it is used in the Windows telemetry.</blockquote>

[QUOTE="Andy Ful, post: 1026564, member: 32260"] Back to the discussion. I think that there is a general agreement about blocking LOLBins in businesses. I would like to note that in businesses the LOLBins will be blocked mostly via SRP, AppLocker, WDAC, etc. There is no need to use Exploit Protection for that. It is probable that it can be more popular at home (including home businesses). [COLOR=rgb(184, 49, 47)][B]From my experience, most readers are attracted by restrictions and mitigations used in businesses and try to implement them at home. It is not necessarily a good idea.[/B][/COLOR] Home users should rather pay attention to Smart App Control. This is a recommendable approach at home. I am not saying that blocking LOLBins at home is wrong. I am trying to say that it is not the optimal solution at home on Windows 10+. Unfortunately, if one does not like the classic SRP and cannot live with SAC, then some LOLBins should be probably blocked. Blocking cmd, powershell, wscript, and cscript can be a starting point. From my tests, it follows that after installing Windows Updates the system sometimes tries to use cmd, regsvr32, and runonce, but I did not notice any negative impact after such blocks. On most computers, there will be a few blocks per day related to rundll32, because it is used in the Windows telemetry. [/QUOTE]

Verification