Use GPO to change the default behavior of potentially malicious file extensions.
If you’re like me and don’t have direct control of your own email filtering, or want to go a step beyond, you’re going to want a way to prevent non-PE viruses from running. Software Restriction Policies are good for this if you’re using them in a whitelist capacity, provided that you’ve also added the extension to the Designated File Types. From a blacklist standpoint it’s tougher.
Another way to approach the problem is to change the default program to open a particular file extension, and if nothing else it’s another layer of security. This has come up in response to .js-powered ransomware variants and, most recently, a .hta variant of Locky.
The policy is as follows:
User Configuration -> Preferences -> Control Panel Settings -> Folder Options -> Open With
Action: Replace File Extension: hta Associated Program: %windir%\system32\notepad.exe Set as default: Enabled.
Enabling this policy and setting it to open in Notepad also benefits you because the end-user will still have something unusual (but now harmless) pop-up, a Notepad window that is full of dangerous-looking stuff. With any luck, they’ll notify the helpdesk so they can clean the system up.comments powered by Disqus