HackTool:Win64/Ligolo!MSR

To keep your system safe and sound, you need to watch out for vulnerabilities.

When it comes to files from unfamiliar sources, be cautious and don't open them unless you're sure they're from a legit source.

Another smart move is to run regular scans with Microsoft Defender. It helps spot and deal with any potential threats, making sure your system stays secure.

Guidance for end users

Take these steps to help prevent malware infection on your computer.

Guidance for enterprise administrators

Hacktools more than often attack enterprises than individuals. Following the below mitigation steps can help prevent hacktool attacks (use this for enterprise consumer):

• Keep backups so you can recover data affected by hacktool and destructive attacks. Use controlled folder access to prevent unauthorized applications from modifying protected files.
• Harden internet-facing assets and ensure they have the latest security updates. Use threat and vulnerability management to audit these assets regularly for vulnerabilities, misconfigurations, and suspicious activity.
• Secure Remote Desktop Gateway using solutions like Azure Multi-Factor Authentication (MFA). If you don’t have an MFA gateway, enable network-level authentication (NLA).
• Monitor for brute-force attempts. Check excessive failed authentication attempts (Windows security event ID 4625).
• Turn on cloud-delivered protection and automatic sample submission on Microsoft Defender Antivirus. These capabilities use artificial intelligence and machine learning to quickly identify and stop new and unknown threats.
• Turn on attack surface reduction rules, including rules that block credential theft, hacktool activity, and suspicious use of PsExec and WMI. To address malicious activity initiated through weaponized Office documents, use rules that block advanced macro activity, executable content, process creation, and process injection initiated by Office applications. To assess the impact of these rules, deploy them in audit mode.
• Utilize the Windows Defender Firewall and your network firewall to prevent RPC and SMB communication among endpoints whenever possible. This limits lateral movement as well as other attack activities.
• Turn on tamper protection features to prevent attackers from stopping security services.