Use GPO to change the default behavior of potentially malicious file extensions.
If you’re like me and don’t have direct control of your own email filtering, or want to go a step beyond, you’re going to want a way to prevent non-PE viruses from running. Software Restriction Policies are good for this if you’re using them in a whitelist capacity, provided that you’ve also added the extension to the Designated File Types. From a blacklist standpoint it’s tougher.
Another way to approach the problem is to change the default program to open a particular file extension, and if nothing else it’s another layer of security. This has come up in response to .js-powered ransomware variants and, most recently, a .hta variant of Locky.
User Configuration -> Preferences -> Control Panel Settings -> Folder Options -> Open With
File Extension: hta
Associated Program: %windir%\system32\notepad.exe
Set as default: Enabled.
Enabling this policy and setting it to open in Notepad also benefits you because the end-user will still have something unusual (but now harmless) pop-up, a Notepad window that is full of dangerous-looking stuff. With any luck, they’ll notify the helpdesk so they can clean the system up.
[…] [Added 5/12/2016] For some non-program (WinPE) viruses, you can change the default behavior of some extensions to open in Notepad rather than the original vulnerable target. A guide is here. […]
[…] have involved driving to work rather than taking the train, hence a lack of writing. I did put up a post over on bluesoul.me that might give a little clue as to what I’ve been up […]
[…] morning getting the stuff I would’ve gotten at some point anyway. I also wrote up a piece on using GPOs to neuter some malware. So it got me a little […]
Found your site through your pmastarterkit.
This is clever nice post
This is awesome! Thanks!
Nice post, useful tips for sysdmins. The same way can configure file extension: .JS or Office documents which includes macro’s.
Can anyone confirm if this works on Windows 10? My understanding is it would not, as you can no longer change file associations without an XML file. (And sadly, that functionality is hopelessly broken on 1607.)
unfortunately it does not work on Windows 10, but does on older windows devices..