Reply to thread

Message

<blockquote data-quote="Windows_Security" data-source="post: 795469" data-attributes="member: 50782">I have put Windows 10 Pro on my desktop to replace Windows 7 Enterprise. Setup is simple, hardening through GPO, UAC denies elevation of unsigned, risky commands are disabled except PowerShell through WD Exploit Protection (WD EP). Office is hardened though GPO and WD EP using Andy;s excellent Configure Defender, Protected Folders is on and SRP default deny implemented.Nice thing of WD that it reports from time to time what it has done: I am proud to announce that the PC officially was infected <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />. Notice the sneaky location (browser cache). Does someone know whether it is possible to see whether WD found it during on demand disk access (write) or on execution? Would be interesting to know whether it was executed (meaning it had escaped Chrome sandbox).On the 29th I ran with Chromium stable V71 (I updated to V72 Yesterday). I remember on the 29th in the morning I was collecting information for a blog (of a customer for which I am ghostwriter) and I had to enable scripts for HTTP://* websites (which I have disabled by default in Chrome content settings) to view the content. Chrome Safe browsing and BitDefender Traffic Light did not throw a warning[ATTACH=full]207614[/ATTACH]</blockquote>

[QUOTE="Windows_Security, post: 795469, member: 50782"] I have put Windows 10 Pro on my desktop to replace Windows 7 Enterprise. Setup is simple, hardening through GPO, UAC denies elevation of unsigned, risky commands are disabled except PowerShell through WD Exploit Protection (WD EP). Office is hardened though GPO and WD EP using Andy;s excellent Configure Defender, Protected Folders is on and SRP default deny implemented. Nice thing of WD that it reports from time to time what it has done: I am proud to announce that the PC officially was infected :-). Notice the sneaky location (browser cache). Does someone know whether it is possible to see whether WD found it during on demand disk access (write) or on execution? Would be interesting to know whether it was executed (meaning it had escaped Chrome sandbox). On the 29th I ran with Chromium stable V71 (I updated to V72 Yesterday). I remember on the 29th in the morning I was collecting information for a blog (of a customer for which I am ghostwriter) and I had to enable scripts for HTTP://* websites (which I have disabled by default in Chrome content settings) to view the content. Chrome Safe browsing and BitDefender Traffic Light did not throw a warning [ATTACH=full]207614[/ATTACH] [/QUOTE]

Verification