Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1035687">I am using <a href="https://apps.microsoft.com/store/detail/pdf-viewer-plus/9NBLGGH513HH" target="_blank">PDF viewer Plus (from Micorsoft Store),</a> it runs in AppContainer and with Microsoft Defender Exploit Protection (which also works when you use a different AV), you can further restrict this PDF viewer (executable has another name: FlexPdfViewer.exe)FlexPdfViewer.exe- Block low-integrity images- Block remote images- Code Integrity Guard (on, but also allow loading images of Microsoft Store)- Control Flow Guard- Data Execution Prevention- Disable extension points- Do not allow child processes- Mandatory ASLR- Bottom-up ASLR- (enable) SEHOP- Validate HEAP integrity- Validate image dependency integrityAs said, the PDF viewer Plus runs in an APPCOINTAINER integrity rights sandbox, so with above hardening malware has to take a few extra hurdless to escape this strenghtened sandbox.</blockquote>

[QUOTE="ForgottenSeer 97327, post: 1035687"] I am using [URL='https://apps.microsoft.com/store/detail/pdf-viewer-plus/9NBLGGH513HH']PDF viewer Plus (from Micorsoft Store),[/URL] it runs in AppContainer and with Microsoft Defender Exploit Protection (which also works when you use a different AV), you can further restrict this PDF viewer (executable has another name: FlexPdfViewer.exe) FlexPdfViewer.exe - Block low-integrity images - Block remote images - Code Integrity Guard (on, but also allow loading images of Microsoft Store) - Control Flow Guard - Data Execution Prevention - Disable extension points - Do not allow child processes - Mandatory ASLR - Bottom-up ASLR - (enable) SEHOP - Validate HEAP integrity - Validate image dependency integrity As said, the PDF viewer Plus runs in an APPCOINTAINER integrity rights sandbox, so with above hardening malware has to take a few extra hurdless to escape this strenghtened sandbox. [/QUOTE]

Verification