Defense in depth — the Microsoft way (part 94): SAFER (SRPv1 and AppLocker alias SRPv2) bypass for dummies  – Full Disclosure

Posted by Stefan Kanthak via Fulldisclosure on Dec 22

Hi @ll,

since 30 years Microsoft ships Windows with “Windows Script Host”,
an empty registry key and the following registry entries:

[HKEY_CURRENT_USERSoftwareMicrosoftWindows Script HostSettings]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Script HostSettings]
“ActiveDebugging”=”1”
“DisplayLogo”=”1”
“SilentTerminate”=”0”
“UseWINSAFER”=”1”

The…
 – Read More  – Full Disclosure