39.6 Defence Stack – Practical Controls
Layered bachav (ek tool nahi):
| Layer | What | Why |
|---|---|---|
| Email filtering + attachment sandbox | Stop initial phish macros/links | Most SME malware still starts in inbox |
| Patch OS + browsers + Office | Close worm/drive-by holes | WannaCry-class lessons |
| AV / EDR | Signature + behaviour | Fileless needs behaviour |
| Application allowlisting | Only approved binaries | Cracked tools / random EXE fail |
| Least privilege | Users not local admin | Ransomware blast radius shrinks |
| Macro / script control | Block internet macros; log PowerShell | Emotet-class paths |
| Backup + restore drills | Offline / immutable | Last line after encrypt |
| User awareness | Report phish fast | Humans = sensor |
Linux lab tip (Amazon Linux style awareness host):
# Example: install ClamAV on a lab Amazon Linux / CentOS-class box YOU own
sudo yum install -y clamav clamd
sudo freshclam
sudo service clamd start
clamscan -r /home
Ubuntu/Kali notes: sudo apt install clamav OK on those distros; still isolate.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Disables Defender / adds exclusion after admin theft | Tamper protection; alert on exclusion changes; dual EDR where budget |
| Lives off land (powershell, wmic, bitsadmin) | ASR rules / attack surface reduction; script logging; allowlisting |
| Encrypts with user rights across wide ACL shares | Least privilege on file ACLs; separate admin; network share monitoring |
Ravindra Bagale's Tip
"Free AV off, game boost" – students ani kabhi kabhi shop floor PCs. Tamper protection + central EDR policy. Interview: list 5 controls without saying only "install antivirus." Allowlisting + least privilege + backups = senior answer.
Lab
Lab Win10 VM: Windows Security → confirm Real-time protection ON, Tamper protection ON, Controlled folder access experiment on C:\lab_docs. Linux lab VM: clamscan on a folder with EICAR. Document before/after. Shared folder to host Disable during malware labs.