It should NOT be possible for a threat actor to social engineer a user, to run quick assist, to execute malicious PowerShell, here’s why.
If you don’t use Quick Assist, this initial access attack path should be 100% avoidable.
How?
By removing and restricting the tools and capabilities the threat actor relies on for this to work.
Here’s what to do:
Uninstall/disable Quick Assist via GPO or Intune
GPO | Computer Configuration > Administrative Templates > Windows Components > App Package Deployment > Remove Default Microsoft Store packages from the system. Enable it and select Quick Assist only. |
|---|---|
Intune | Settings catalog > Administrative Templates > Windows Components > App Package Deployment. Enable Remove Microsoft Store apps with dynamic lis or the older Remove Default Microsoft Store packages from the system setting and set Quick Assist to True. Leave other apps unselected. |
Block Quick Assist via Application Control product, AppLocker, or WDAC (ps, block all other RMMs found in https://LolRMM.io)
Restrict PowerShell to only users/accounts that need it. A majority of end users at most orgs don’t ever need it.
This is such a high value move for defenders.
Every client I’ve recommended this to, who’s acted on this advice, has thanked me later.
You get double and sometimes triple the benefit by restricting PowerShell because it’s used by threat actors to:
Download additional malware and tools
Perform recon
Execute their lateral movement & privilege escalation techniques
This makes my life (as an internal pentester) super miserable and makes attacking your network very difficult.
Simulating real-life threat attacker TTPs is what my team and I do day in and day out. We live and breathe it.
If you’d like my team’s help finding out what could happen if one of your users gets compromised, book a free discovery call and we’ll see if our approach is a fit.
Block RMMs, restrict PowerShell, defend attacks, sleep well at night.
All the best
Spencer
By the way - If you use Applocker, this tool I made, called ApplockerInspector, can help you find dangerous and misconfigured rules. Hope you find it useful.