Behavioral prevention

Behavioral or heuristic protection is often the stuff of EDR or AV platforms. Most platforms of this nature operate on a heuristic basis and utilize key MITRE ATT&CK tactics and techniques leveraged by real-world adversaries in order to prevent the execution of malicious commands, files, or techniques. For the sake of this discussion, we'll focus on command-line style behaviors for the sake of simplicity – things such as calling mshta.exe to open malicious HTA files or calling binaries from SMB shares.

Frequently, a well-built EDR solution is going to be irreplaceable in correctly and properly blocking behavioral-based techniques utilized by adversaries. However, this is not the only methodology available to us at a pinch.

Binary and shell-based blocking

In the Unix world, the proper way to achieve something of this nature is via the use of something like rsh – a restricted shell that allows us to basically "jail" our...