[1709, fcu] Controlled folder access

[DJ-1701]

Just a word to the wise. I tried to enable this the other day, but certain things broke, such as running reports on SIMS (Pulsar.exe was blocked from modifying the Documents folder) and some custom SCCM software deployments interacting with the Desktop. So looks like a bit of planning is needed before releasing to the masses.

 

Personally I haven't got my head around the 'Administrative Templates/Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access/Configure allowed applications' policy yet, as I haven't seen an example of how to set one and my tests haven't been successful as of yet. So might be worth waiting for some examples come out of how to use it first.

[mavhc]

Does it have an audit mode we can run for a few months?

[DJ-1701]

Does it have an audit mode we can run for a few months?

 

Good point, yes it does, though you will have to scan through the Event logs on the computers to pick up this information.

[Arthur]

might be worth waiting for some examples come out of how to use it first.

See the section titled "Enabling and managing Controlled folder access in enterprise networks".

 

https://blogs.technet.microsoft.com/mmpc/2017/10/23/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access/

[free780]

I think you have to have the cloud /maps enabled and not blocked. The list in Group Policy would be a pain to maintain. If it could use the Applocker policy that would be good.

[DJ-1701]

See the section titled "Enabling and managing Controlled folder access in enterprise networks".

 

https://blogs.technet.microsoft.com/mmpc/2017/10/23/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access/

 

I may be being daft, but I can't find any examples of the Configure allowed applications policy in use.

[free780]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications

Stores the entries.

I did try:

 

$apps = Get-ChildItem -Path "C:\Program Files (x86)" -Include *.exe -Recurse -Verbose | Select-Object -ExpandProperty FullName

foreach ($app in $apps){

Set-MpPreference -ControlledFolderAccessAllowedApplications $app -Verbose}

 

$apps = Get-ChildItem -Path "C:\Program Files" -Include *.exe -Recurse -Verbose | Select-Object -ExpandProperty FullName

foreach ($app in $apps){

Set-MpPreference -ControlledFolderAccessAllowedApplications $app -Verbose}

But this would need to run as a script on every boot up.

 

MS need more documentation. If Defender could just 'phone home' that would be better.

Edited November 2, 2017 by free780

[DJ-1701]

To find out which applications have been blocked from running (or will be blocked from running if you are currently in audit mode), you can filter the event log by

 

Event Logs: Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC

Event IDs: 1123,1124,5007

 

IDs 1123 and 1124 appear to be the helpful ones here.

 

Still not exactly sure what information it wants me to put in what field of the GPO though...

[DJ-1701]

To find out which applications have been blocked from running (or will be blocked from running if you are currently in audit mode), you can filter the event log by

 

Event Logs: Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC

Event IDs: 1123,1124,5007

 

IDs 1123 and 1124 appear to be the helpful ones here.

 

Still not exactly sure what information it wants me to put in what field of the GPO though...

[ATTACH=CONFIG]46055[/ATTACH]

 

Also asked the question about how to use the GPO here https://answers.microsoft.com/en-us/windows/forum/windows_10-security/controlled-folder-access-configure-allowed/43f3bedd-e245-4b03-80ac-79bbcaafebf5?tm=1509998935329

[Arthur]

Still not exactly sure what information it wants me to put in what field of the GPO though...

According to this article, the path to the folder or application goes in the value name box and a 0 goes in the value box.

 

 

 

That makes perfect sense, Microsoft!!!!!! 🤔 🙄

 

Other Windows Defender GPOs also use a 0 too so I guess at least it's consistent with them...

 

https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus

 

Also asked the question about how to use the GPO here

Great example, btw.

 

To find out which applications have been blocked from running (or will be blocked from running if you are currently in audit mode), you can filter the event log

I came across the following PowerShell script which looks quite useful...

 

https://gist.github.com/gschizas/94f432c68944dfc53414bb4cc7f7a2bb

 

Edited November 7, 2017 by Arthur

[DJ-1701]

According to this article, the path to the folder or application goes in the value name box and a 0 goes in the value box.

 

 

 

That makes perfect sense, Microsoft!!!!!! 🤔 🙄

 

Other Windows Defender GPOs also use a 0 too so I guess at least it's consistent with them...

 

https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus

 

...

 

I came across the following PowerShell script which looks quite useful...

 

https://gist.github.com/gschizas/94f432c68944dfc53414bb4cc7f7a2bb

 

 

Excellent @Arthur! Thanks very much as always, I'll give it a go.

 

Also asked the question about how to use the GPO here

 

Great example, btw.

 

Haha, thanks.

 

Just in case anyone else is interested, this the the result of my audit so far on a few machines of applications that would have been blocked for modifying/creating files in user profiles...

 

C:\Program Files (x86)\CyberLink\PowerDVD12\OLRSubmission\OLRStateCheck.exe

C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe

C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE

C:\Program Files (x86)\SMART Technologies\Education Software\Notebook.exe

C:\Program Files\7-Zip\7zG.exe

C:\Program Files\SIMS\SIMS .net\Pulsar.exe

C:\Windows\SysWOW64\cmd.exe

 

The last one was part of an installation I was running which includes copying a shortcut to the public desktop.

[Arthur]

Umm! :eek:

 

Windows 10's security feature "Controlled Folder Access" can be circumvented by simple OLE scripting

 

Vulnerability

By default, Office executables are included in the whitelist so these programs could make changes in protected folders without restrictions.

 

This access level is granted even if a malicious user uses OLE/COM objects to drive Office executables programmatically.

 

So a ransomware developer could adapt their software to use OLE objects to change / delete / encrypt files invisibly for the files owner.

 

[...]

 

But this python code:

 

import win32com.client
filetoberansom = r'C:/Users/YJ/Documents/test.docx'
word = win32com.client.Dispatch("Word.Application")
word.visible = 0
doc = word.Documents.Open(filetoberansom)
word.Documents.Item(1).Password= '12345678'
word.Documents.Item(1).Save()
word.Documents.Item(1).Close()
word.Application.Quit()

 

Do the magic!

 

1. open the file
   
2. encrypt it with password 12345678 (using native Office Document protection)
   
3. save it
   

Why? Because this code uses OLE Word Object to do the work, so in fact is Word who is doing the job

 

Using this technique an attacker could perform a ransomware attack bypassing Windows Defender protection activating the native encryption feature of Microsoft Office.

 

In a environment with Office+Windows (the most common) Microsoft Anti Ransom is totally useless

 

Microsoft's answer

I have notified to Microsoft on 23 January and on 31 I got this response

 

The most relevant part is:

 

We aren't classifying this as a security vulnerability because Defender Exploit Guard isn't meant to be a security boundary

 

But if you read this Microsoft defines Exploit guard as 'Windows system and application exploit mitigations using Windows Defender Exploit Guard (WDEG)'

 

Also relevant

 

'Instead, we will address this through an improvement to the Controlled Folder Access functionality'

 

That really means Microsoft will fix the vulnerability that should be classified as Mitigation bypass without acknowledgment

[DJ-1701]

Umm! :eek:

 

Windows 10's security feature "Controlled Folder Access" can be circumvented by simple OLE scripting

 

Yeah, it does seem though that allowing certain applications to run could be opening big holes though too. Such as when I found I needed to let cmd though for a script... wonderful protection.

[mavhc]

Basically you suid'd Word, and Word isn't validating input. At least it only affects files Office can load and put a password on.

 

Office needs to extend its Trusted features.