Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 897595" data-attributes="member: 32260">Avast companion.It is another little project on joining Avast with a simple WDAC policy. WDAC is here much simpler because it will protect only non-PE files (Windows Script Host + PowerShell, and MSI files).Here is what Avast companion can do:<ol>
<li data-xf-list-type="ol">WDAC restricts non-PE files on all drives. The restrictions for PowerShell follows from applying the Constrained Language Mode. Similar restrictions are applied for Windows Script Host. So, scripts can be run but advanced functions are disabled.</li>
<li data-xf-list-type="ol">Turning OFF/ON the restrictions do not require to log off the account.</li>
<li data-xf-list-type="ol">Some protection for BAT, JAR, CHM, ... files can be done in a similar way as in SysHardener (no whitelisting).</li>
<li data-xf-list-type="ol">It is probably also possible to block some LOLBins (via WDAC or Image File Execution Options).</li>
<li data-xf-list-type="ol">The EXE files can be protected by Avast Hardened Mode + Cyber Capture.</li>
<li data-xf-list-type="ol">The MSI installations/updates are blocked, but the user can easily switch OFF/ON temporarily the protection to make installations/updates.</li>
</ol>Yes, I like this little project. It is similar (slightly weaker but also simpler) to the H_C Avast_Hardened_Mode_Aggressive setting profile.</blockquote>

[QUOTE="Andy Ful, post: 897595, member: 32260"] [B][SIZE=5]Avast companion.[/SIZE][/B] It is another little project on joining Avast with a simple WDAC policy. WDAC is here much simpler because it will protect only non-PE files (Windows Script Host + PowerShell, and MSI files). Here is what Avast companion can do: [LIST=1] [*]WDAC restricts non-PE files on all drives. The restrictions for PowerShell follows from applying the Constrained Language Mode. Similar restrictions are applied for Windows Script Host. So, scripts can be run but advanced functions are disabled. [*]Turning OFF/ON the restrictions do not require to log off the account. [*]Some protection for BAT, JAR, CHM, ... files can be done in a similar way as in SysHardener (no whitelisting). [*]It is probably also possible to block some LOLBins (via WDAC or Image File Execution Options). [*]The EXE files can be protected by Avast Hardened Mode + Cyber Capture. [*]The MSI installations/updates are blocked, but the user can easily switch OFF/ON temporarily the protection to make installations/updates. [/LIST] Yes, I like this little project. It is similar (slightly weaker but also simpler) to the H_C Avast_Hardened_Mode_Aggressive setting profile. [/QUOTE]

Verification