Uncovering cross-process injection with Windows Defender ATP

Discussion in 'other anti-malware software' started by ronjor, Mar 10, 2017.

  1. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    162,658
    Location:
    Texas
    msft-mmpc March 8, 2017

     
  2. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,591
    Location:
    U.S.A.
    Great protection as long as you're running Win 10 Enterprise.
     
  3. Bill_Bright

    Bill_Bright Registered Member

    Joined:
    Jun 29, 2007
    Posts:
    4,040
    Location:
    Nebraska, USA
    According to this, Windows Defender ATP support Windows 10 Pro too.

    I believe it will filter down into a more user-friendly form and all versions of W10 as time moves on. Microsoft is committed to security because they know they will be blamed for it anyway, even if it is the bad guys perpetrating the offenses and the anti-malware industry's failure to stop malware.
     
  4. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499
    Is MS Creators Update going to be for original Windows home users that are getting insider builds?
     
  5. Bill_Bright

    Bill_Bright Registered Member

    Joined:
    Jun 29, 2007
    Posts:
    4,040
    Location:
    Nebraska, USA
  6. guest

    guest Guest

    Just need the cash to buy it :D
     
  7. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,591
    Location:
    U.S.A.
    No way. If MS decides to force subscription to Home users, it's off to Linux which I will probably migrate to anyway.
     
  8. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499
    itman

    you can just create a bootable Linux distro USB and run it off that or install it on your PC. I been using Linux mint for a while now and it is lightening fast.

    Bill so looks like I will get the update then. What I was wondering is does that still mean I would get the new protection?
     
  9. Bill_Bright

    Bill_Bright Registered Member

    Joined:
    Jun 29, 2007
    Posts:
    4,040
    Location:
    Nebraska, USA
    MS is not going to force subscriptions on us.

    It is important note that only Microsoft has the financial incentive to stop malware. As I noted before, there will be those who blame MS anyway, regardless who's fault it is. So MS has every desire to prevent that from happening.

    And it is important to note that ALL the 3rd-party security program makers depend on malware and need malware to thrive. If malware was eradicated, they would go out of business. So the only IT company that really wants malware to go away is Microsoft. Everybody else are like arms dealers - they love war, though are not likely to admit it.

    So Microsoft comes out ahead by keeping security (at least for home and SOHO users) effective and free.
    I don't have fully privy to what is going on at MS, but it is my understanding that as advanced security features mature and are proven effective, they will be integrated with Windows Defender, then pushed down to all us. And just as we can disable Windows Defender now for 3rd-party alternatives, we will be able to disable it in the future too.
     
  10. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,591
    Location:
    U.S.A.
    Perhaps you are following the advice that Brian Krebs gave a while back for safe on-line banking practices for businesses?
    Ref.: https://krebsonsecurity.com/online-banking-best-practices-for-businesses/
     
  11. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499
    itman I do understand your point , however I been reading a lot more Linux stuff is being targeted currently. Mainly because a lot of server are still Linux based. Even the new WikiLeaks show the Government agencies ( CIA ) using tools against Linux and you can bet the bad guys are too.
    And this has been proven and not FUD.
    It is a good idea to check in on Wilders Linux thread from time to time. Those dudes know what they are talking about.
    I had a few issues installing a new printer on my sisters pc running Kubuntu and they were able to help.
     
  12. Bill_Bright

    Bill_Bright Registered Member

    Joined:
    Jun 29, 2007
    Posts:
    4,040
    Location:
    Nebraska, USA
    This is absolutely true. I recommend everyone sign up for the Department of Homeland Security's US-CERT Cyber Security Bulletin Vulnerability Summaries. If you have not checked it out already, you would be surprised at the programs that frequently have newly discovered vulnerabilities reported.

    Check out the summary for the week of Feb 20th and you will see a bunch of "High Vulnerabilities" (the most critical) reported for Apple and Linux operating systems. And under Medium you will note Apple iphone OS. Apple Safari and Google Chrome are listed too.

    Now newly discovered vulnerabilities don't automatically mean there is malware already out there to exploit them, but it does not us that the alternative solutions are not as safe as many want us to believe (especially those in the IT press seeking attention who like to target Microsoft).
     
  13. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499
    Bill

    If I knew someone that worked for the DOD and DARPA as a data analyst do I need to sign up? His boss was David Howell Petraeus
    https://en.wikipedia.org/wiki/David_Petraeus

    I think I taught him how to program in Visual Basic in 1997.

    now he uses Python
     
    Last edited: Mar 10, 2017
  14. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,546
    Location:
    The Netherlands
    LOL, interesting article, but this is a standard feature of HIPS, nothing new or special about this. But OK, I understand they are just trying to promote Win Defender ATP, nothing wrong with this. However, it would have been sexier if they were talking about newer code injection methods.
     
  15. Tarnak

    Tarnak Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    5,274
    I have the Surface Book, which is running default Windows 10 Pro, so I could sign up for a free trial, I guess. ;)
     
  16. NormanF

    NormanF Registered Member

    Joined:
    Feb 20, 2009
    Posts:
    2,870
    Windows Defender ATP is built-in to Windows 10 Enterprise so no third party anti-malware solution is needed. ;)
     
  17. guest

    guest Guest

    On Win10 , with Applocker, GP, WinDef APT, DeviceGuard , you just need a memory protection type of software.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.