0

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform.

Recorded Future Blog: https://www.recordedfuture.com/blog/

Specific Post: Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018

Within that post, Recorded Future states the following:

Additionally, there are no mitigating factors available to prevent CVE-2016-0189 — the only workarounds are restricting access to two common dynamic-linked library files: VBScript.dll and JScript.dll.

Question 1: What exactly does it mean to restrict access to VBScript.dll and JScript.dll?

Question 2: How best to do this with PowerShell or Group Policy at scale?

0

Point 1 - Restricting access means to block certain user groups from accessing these files. You don't want them to use them or interact with them.

Addressing point 2 - how to restrict access, I suggest using App Locker to block this.

  1. In Local Security Policy, expand Application Control Policies -> AppLocker

    1a. Before proceeding - select configure rule enforcement -> advanced -> Enable DLL rule collection, apply -> back to enforcement tab, at the bottom under DLL rules: check configured and then press ok.

  2. Right click DLL Rules -> Create New Rule

  3. Select Deny and the user or group who it should be denied to

  4. Since the Path of the file can be changed, select the File Hash option for blocking

  5. Browse to the file in question, and add it

  6. Create!

  • 2
    For DLLs you can't use the normal AppLocker rules. You need a DLL rule. – Polynomial Mar 20 at 13:36
  • Edited to reflect the DLL rule - thanks. – Crumblez Mar 20 at 13:41
  • Very uncertain how restricting user groups would impact normal browsing behaviors, and, how effective this method is. Any additional info is welcome. – RealDrGordonFreeman Mar 20 at 13:53
  • You can restrict non administrative users from accessing the VBScript.dll file. Standard users on the floor would not be administrators and so would not be able to access the VBS dll. – Crumblez Mar 20 at 14:22
  • Okay. I've given your answer a try. Now searching for a good way to test if it functions as intended. – RealDrGordonFreeman Mar 20 at 21:03
0

One simple approach would be to add a "Deny read&execute" ACE to those 2 files, using cacls or icacls. On Windows 7 and later, this does not impact the system at all, provided you don't use VBS scripts obviously. Not sure about the exact command-line syntax, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.