Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 938323" data-attributes="member: 32260">You should not say this. It is clear that your knowledge about the current Defender&#039;s anti-script protection requires the update. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Anyway, it is true that any popular Home AV on default settings has only mediocre anti-script protection.Microsoft knows better if it is useless or not on the basis of successful attacks in the wild. It can be probably sufficient for now, but far from being a comprehensive solution - still, the attack surface is too big. Some other AVs (like Kaspersky) have stronger anti-tampering (the AV services cannot be disabled even with TrustedInstaller privileges).You are right that the method of the attack from the OP is clearly a kind of vulnerability. It could be used in the wild as a primary infection vector (sometimes even successfully). Fortunately, it has also many drawbacks as the primary infection vector so it is very unpopular despite the fact that it is known for many years.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Do you know any example of such an attack in the wild? I know only the examples where this method was used by the malware as one of many post-infection actions (not primary infection vector).Furthermore, this method can be easily detected by behavior-based modules. If it is not for now (I do not know) then this would strongly suggest that it is not used in the wild as a primary infection vector (or used very rarely).</blockquote>

[QUOTE="Andy Ful, post: 938323, member: 32260"] You should not say this. It is clear that your knowledge about the current Defender's anti-script protection requires the update. :) Anyway, it is true that any popular Home AV on default settings has only mediocre anti-script protection. Microsoft knows better if it is useless or not on the basis of successful attacks in the wild. It can be probably sufficient for now, but far from being a comprehensive solution - still, the attack surface is too big. Some other AVs (like Kaspersky) have stronger anti-tampering (the AV services cannot be disabled even with TrustedInstaller privileges). You are right that the method of the attack from the OP is clearly a kind of vulnerability. It could be used in the wild as a primary infection vector (sometimes even successfully). Fortunately, [B]it has also many drawbacks as[/B][COLOR=rgb(184, 49, 47)][B] the primary infection vector [/B][/COLOR][B]so it is very unpopular despite the fact that it is known for many years[/B].(y) Do you know any example of such an attack in the wild? I know only the examples where this method was used by the malware as one of many post-infection actions (not primary infection vector). Furthermore, this method can be easily detected by behavior-based modules. If it is not for now (I do not know) then this would strongly suggest that it is not used in the wild as a primary infection vector (or used very rarely). [/QUOTE]

Verification