Anti-ransomware protection in Fall Creators Update

TairikuOkami · 25 Nov 2017

When you want anti-ransomware protection, deny access to Users and SYSTEM to any backup folder. Tested on wannacry.
Users, obviously and SYSTEM, because ransomware usually gains system rights, not admin, so it is very easy to avoid.
Windows method works by denying access to every software except allowed, it is better to just deny access to all.

lx07 · 25 Nov 2017

TairikuOkami said:

When you want anti-ransomware protection, deny access to Users and SYSTEM to any backup folder.

Probably you should deny Trusted Installer as well. Any Administrator process can do what it wants though so if you run as part of Administrator group there is no point restricting anything really.

TairikuOkami · 25 Nov 2017

Trusted Installer and Administrators, are very unlikely to be used by ransomware. Ransomware uses SeTcbPrivilege, which gives it SYSTEM rights, that is more elevated than admins, so when blocked, admins can have access, but SYSTEM not.

lx07 · 25 Nov 2017

Oh come on you (or any malware) can use this Launch processes with TrustedInstaller privilege

If you don't run under a standard account you only have yourself to blame.

TairikuOkami · 25 Nov 2017

lx07 said:

Oh come on you (or any malware) can use this Launch processes with TrustedInstaller privilege

Hackers might, but malware is generally dumb.
Petya, Wannacry, Badrabbit, all use SeTcbPrivilege.