What can you do to proactively protect against DLL injection on your organization's Exchange server?

The correct answer is A. Take away Full Control over important files from the Everyone group and monitor changes to. To prevent DLL injection need to ensure no untrusted process gets Administrator access or runs as the same user account as your application. Without this access, code injection into the application is not possible; and once such a process gets that access, it can cause all…

Malware Analysis & Advanced Persistent Threats

Question

Options

ATake away Full Control over important files from the Everyone group and monitor changes to
BScript a comparison of the Is and echo commands and take cryptographic checksums of
CLimit Debug rights and take cryptographic checksums of important files
DLimit Debug rights to the Administrators' group and monitor changes to files in Event Viewer

How the community answered

(33 responses)

A
79% (26)
B
3% (1)
C
12% (4)
D
6% (2)

Explanation

To prevent DLL injection need to ensure no untrusted process gets Administrator access or runs as the same user account as your application. Without this access, code injection into the application is not possible; and once such a process gets that access, it can cause all kinds of unauthorized activities without needing to inject itself into another process 鈥" the injection just makes it easier to hide.

Topics

#DLL injection#file permissions#defense hardening#Windows security

Community Discussion

No community discussion yet for this question.

Full GCIH Practice