New ransomware abuses Windows PowerShell, Word document macros

instead of using the word etc. can you be nice to print entire list of exe's?

thank you.

as I was not aware of cscript and more.

Ironically i am soon to test sdefend, but I prefer not to overload myself with third party tools and instead use built in windows Protection/hardening and a very limited set of 3rd party tools when possible, this is to avoid conflicts, bloat, etc.

My initial testing of radar no exe pro software isnt great, I had issues like config randomlly disappearing and random times when exe works and then does not work, I found if brute force try to start exe radar no exe pro gets overwhelmed and allows it. Not good. Whilst SRP is at least consistent but does have buggy dll protection. Applocker for me is by far the best of the 3 but microsoft stupidly made it corporate only so is a no go.

The 2 reg keys are now hardened in that I removed rights for my user to modify/delete them.

 

You could define a common set of security settings:

https://thinkpowershell.com/powershell-execution-policy-explained/