4 ms·
Will the patch include any kind of auditing mechanism to determine if your system already has files w/spoofed signatures? Or is there a recommended procedure t
by wyldfire 7y ago
Will the patch include any kind of auditing mechanism to determine if your system already has files w/spoofed signatures? Or is there a recommended procedure to execute this audit?
- CiPHPerCoder 7y agoI would expect the signatures to start failing after you update and restart.
- wyldfire 7y agoSorry, I'm not familiar with basic details: signature verification happens each time the program is started? Or only when it's installed? If it fails the signature check, what is the default policy? Not to install/execute the binary? Or just log/warn?
- mzs 7y agoalready there, read threads below for more details >No fancy EDR required to capture CVE-2020-0601 attempts (after patching). Just ensure you're forwarding Application log events. Currently, CVE-2020-0601 is the only Microsoft code (AFAIK) that calls the CveEventWrite API so event noise is not a concern. https://twitter.com/mattifestation/status/1217179698008068096 https://twitter.com/mattifestation/status/121717969800806809...