0

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a powershell script using cmd.exe /c "powershell.exe -ExecutionPolicy Bypass ...". Fortunately, I always noticed the extension before running it, but I may not always be so lucky.

I'd like to configure Windows (I'm using Windows 10 Education) to show a confirmation popup whenever I attempt to run any potentially malicious file (exe, msi, cmd, bat and ps1 for starters) outside a list of defined folders. I'm comfortable with GPO and powershell, would like to avoid solutions using 3rd party programs if possible.

I already tried to configure AppLocker, but

  1. it outright blocks the file, which is usually not what I want, as I often download legitimate programs,
  2. for some strange reason, it allows .lnk files with scripts as target.


Ideal scenario:

  1. I run notepad.exe, located in C:/Windows/System32, which is whitelisted as a system folder, and it runs without any confirmation.

  2. I download a file by torrenting, called awesomeMovie.mp4.exe, to a media folder, maybe D:/Movies/Downloaded. After clicking it, a confirmation dialog pops up, and I have to explicitly click Yes before the program runs. If the file was instead called awesomeMovie.mp4, it opens in my media player without any popup.

  • 1
    Some browsers (IE, pretty sure Edge, less sure about Chrome or Firefox) and other download tools add a special flag (using NTFS Alternate Data Streams) indicating where the file came from (Internet, local network, etc.). Windows, by default, will prompt if you try to open a file that has such a flag indicating it came from an untrusted source and the file is a risky type (certainly EXE and such, should include LNK but I can't test this right now). If this isn't happening already, you may need to configure your download client's settings (or switch clients). – CBHacking Jan 15 at 0:26
  • Not an answer to your specific question, but make sure you've unchecked "Hide extensions for known file types" in Explorer's Folder Options|View dialog to at least make such trickery more obvious. (You've very probably done this already, but I feel it worth mentioning just in case). Adding this option – or at least enabling it by default – was, IMHO, one of Microsoft's Worst Decisions Ever™. – TripeHound Jan 15 at 9:12
  • Why not use UAC for this ? This is what it was designed for. – Overmind Jan 15 at 11:45
  • @Overmind - Depending on what the script does, UAC may never get involved: If the script just zips up the user directory and mails it home, the user will be considered to have all the relevant permissions already, no elevation needed. – Clockwork-Muse Jan 15 at 17:37
  • Doesn't the Windows User Account Control do this for you? – xorist Jan 16 at 1:37
0

You will have to be careful where you download and store files, but there may be a simple solution.

On your download directory, edit the security settings (right-click, Properties, Security tab, Advanced button) and add a deny entry for execution for Everyone. Do the same for any directory where you would store these files.

Media files are only read, not executed---the player itself is executed, but it executes from its installation directory.

If you download legitimate executable files, you would simply need to move them to another directory where execution is permitted. If you prefer AppLocker, it should be able to restrict execution based on directory paths as well.

A word of warning: Either approach may not work properly or consistently with *.lnk files, as Windows seems to have some weird, undocumented handling for them in some cases. You still need to be careful.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.