If your users can download or install software, then they can get infected with malware.
This report by Microsoft (Counterfeit installers to system compromise: Tracking a deceptive software download campaign) is a great example of why Application Control can be such a strong defensive control.
In the report, threat actors created counterfeit software-download websites in order to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software like Microsoft Edge.
The thing I want to stress is this is completely defendable, with the right controls.
What should you use to defend against this?
If you use Microsoft Defender, use this ASR Rule:
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
Prevalence in this rule means, has this executable ever been seen before on any of your endpoints where MDE is installed.
This has blocked me from running my “malicious” tools many times during internal pentests.
Of course, I also recommend not relying on EDR alone.
Invest in a solid Application Control product that’s purpose built for this.
I am personally fond of MagicSword (not sponsored but they are friends and their threat-driven approach is really neat) and ThreatLocker.
Of course it takes time to implement these and there’s a right way and a wrong way to do this. But that’s a topic for another newsletter.
What can you do today?
Search the last 30 days for executables & MSIs launched from Downloads, Temp, and user profile paths
Identify unknown installers and programs
Validate if those installers and programs are legitimate and required
If they are required add exceptions in your application control software (if you have one). If they are not needed or are found to be suspicious, block them and investigate as needed
Unmanaged software and lack of application control is a big risk to organizations.
And with AI agents now in the mix it’s only going to get harder.
And that’s just one of a dozen endpoint risks we commonly see during internal pentests.
It’s also why we start our internals pentests on your endpoint, with a standard user account. So we can find out what an attacker could actually do once they get in.
If you’d like to see if the way we do internal pentests is a fit for you, fill out this form and we will be in touch to schedule a free discovery call.
If you can stop unmanaged software from running on your endpoints, you can stop a majority of malware infections.
All the best
Spencer
PS - I’ve seen Application Control projects completely bomb. Start small, test small, have a super easy exception workflow and communicate with your users as much as possible.