Block encrypted archives or those containing .lnk , .chm , or .vbs files.
Ensure Office macros and Windows Script Host are disabled where not strictly necessary.
Creates registry keys or scheduled tasks to remain active after a reboot.
Deploy Endpoint Detection and Response tools to catch PowerShell execution and suspicious network callbacks.
Espionage, intelligence gathering, and policy influence.
Block encrypted archives or those containing .lnk , .chm , or .vbs files.
Ensure Office macros and Windows Script Host are disabled where not strictly necessary.
Creates registry keys or scheduled tasks to remain active after a reboot.
Deploy Endpoint Detection and Response tools to catch PowerShell execution and suspicious network callbacks.
Espionage, intelligence gathering, and policy influence.