Basic Hardened AppGuard Policy XML (continued)

[meltcheesedec]

Basic Hardened AppGuard Policy XML

your only lead is to use the Bouncer's vulnerable process list on Wilders.
Obviously you would add interpreters like cmd, powershell, etc.. to User Sapce - Yes (then remove them from Guarded Apps)

@Umbra and @Lockdown :

Might you be able to go into more detail for those of us still who are:
- still learning AppGuard
- wanting to tiptoe into Lockdown mode, and
- have no access to the hardened .xml since it was taken off mega, as discussed in Basic Hardened AppGuard Policy XML (FYI, I am unable to post a reply on that thread, so I created this new thread in order to continue that discussion)

 

[509322]

Basic Hardened AppGuard Policy XML


@Umbra and @Lockdown :

Might you be able to go into more detail for those of us still who are:
- still learning AppGuard
- wanting to tiptoe into Lockdown mode, and
- have no access to the hardened .xml since it was taken off mega, as discussed in Basic Hardened AppGuard Policy XML (FYI, I am unable to post a reply on that thread, so I created this new thread in order to continue that discussion)

The vulnerable processes list as published by Florian Rheinhardt of Excubits: https://excubits.com/content/files/blacklist.txt

 

[Deleted member 178]

Basic Hardened AppGuard Policy XML


@Umbra and @Lockdown :

Might you be able to go into more detail for those of us still who are:
- still learning AppGuard
- wanting to tiptoe into Lockdown mode, and
- have no access to the hardened .xml since it was taken off mega, as discussed in Basic Hardened AppGuard Policy XML (FYI, I am unable to post a reply on that thread, so I created this new thread in order to continue that discussion)

and i wont share one, (and i can tell @Lockdown too) because it is quite disastrous on the hands of beginners; we prefer you learn how to implement yourself, step by step.
When you will achieve the necessary skills to do it, you won't need the xml file anymore.

 

[Duotone]

The vulnerable processes list as published by Florian Rheinhardt of Excubits: https://excubits.com/content/files/blacklist.txt

Don't remember having this many in the previous Hardened.xml, can I just copy that list to AppGuard?! LAZY mode...

Basic Hardened AppGuard Policy XML


@Umbra and @Lockdown :

Might you be able to go into more detail for those of us still who are:
- still learning AppGuard
- wanting to tiptoe into Lockdown mode, and
- have no access to the hardened .xml since it was taken off mega, as discussed in Basic Hardened AppGuard Policy XML (FYI, I am unable to post a reply on that thread, so I created this new thread in order to continue that discussion)

Stick with the basic at least when your all too familiar with it, the hardened.xml break a lot of things some you need to turn off.

 

[509322]

Don't remember having this many in the previous Hardened.xml, can I just copy that list to AppGuard?! LAZY mode...

You will have to compare the new list with the old one and identify the new ones to be added. Florian's list grows and recedes and grows again over time.

 

[Deleted member 178]

Don't remember having this many in the previous Hardened.xml, can I just copy that list to AppGuard?! LAZY mode...

You can't for all , AG is limited to 128 rules.

 

[meltcheesedec]

The vulnerable processes list as published by Florian Rheinhardt of Excubits: https://excubits.com/content/files/blacklist.txt

You can't for all , AG is limited to 128 rules.

@Lockdown : just to be perfectly clear for AppGuard newbies who may be reading this: what are AppGuard configuration options that can leverage this vulnerable processes list? E.g., add a user-selected list of 128 vulnerable processes as Guarded Apps?

 

[509322]

@Lockdown : just to be perfectly clear for AppGuard newbies who may be reading this: what are AppGuard configuration options that can leverage this vulnerable processes list? E.g., add a user-selected list of 128 vulnerable processes as Guarded Apps?

I would add wscript.exe, cscript.exe and powershell_ise.exe to the Guarded Apps list. At this time that is all I recommend.

 

[Deleted member 178]

I am more radical than @Lockdown , all the vulnerable Processes i am aware of are in "User-Space - Yes" (blocked to run unless explicitly allowed by myself )
But i wont recommend to do that, unless you know what is using them, what is blocked by them and why they are blocked.

 

[509322]

I am more radical than @Lockdown , all the vulnerable Processes i am aware of are in "User-Space - Yes" (blocked to run unless explicitly allowed by myself )
But i wont recommend to do that, unless you know what is using them, what is blocked by them and why they are blocked.

I just want him to learn the basics. Once he gets comfortable with the basics then he can move on to more advanced configuration. That is all that I am recommending.

 

[Deleted member 178]

I just want him to learn the basics. Once he gets comfortable with the basics then he can move on to more advanced configuration. That is all that I am recommending.

Yes i know. and it is what i would recommend too. Classic AG users don't need an anti-NSA setup

 

[509322]

Yes i know. and it is what i would recommend too. Classic AG users don't need an anti-NSA setup

Make a post on Wilders AppGuard requesting an increase in the User Space list from 128 to 156. Please.

 

[Deleted member 178]

@Lockdown Done

 

[509322]

Users new to AppGuard are advised to learn the product first before proceeding to create advanced policies. This recommendation applies to any other software restriction policy software.

 

[SearchLight]

Version 4.4.6.1 is supposedly the last version that Blue Ridge allowed to be lifetime licensed.
Subsequent versions, they are moving to yearly subscriptions, I have read.

Anyway to purchase this lifetime version?

Or would it possible to make this version available as a "freeware" with the understanding that there will absolutely no updates, upgrades, or technical support?

 

[509322]

Version 4.4.6.1 is supposedly the last version that Blue Ridge allowed to be lifetime licensed.
Subsequent versions, they are moving to yearly subscriptions, I have read.

Anyway to purchase this lifetime version?

Or would it possible to make this version available as a "freeware" with the understanding that there will absolutely no updates, upgrades, or technical support?

Until we discover a reliable method to convert lead to gold, it is very unlikely that there will be a free version of AppGuard. The company faces the same economic realities as any other company.

 

[SearchLight]

Until we discover a reliable method to convert lead to gold, it is very unlikely that there will be a free version of AppGuard. The company faces the same economic realities as any other company.

I was thinking in terms of a basic version with limited features like VS which could be used as an incentive to buy the full version. I am not familiar enough with AppGuard to know if this is even possible. I also understand the economics, too.

 

[509322]

I was thinking in terms of a basic version with limited features like VS which could be used as an incentive to buy the full version. I am not familiar enough with AppGuard to know if this is even possible. I also understand the economics, too.

We looked into that, but after a careful evaluation decided it just isn't in any user's best security interests to provide a hobbled freeware version. A freeware limited functionality SRP product is not something you want. Using a freeware version as an installation-based marketing gimmick to induce people to purchase has not been our way of doing things. Freeware versions are the prevailing practice insofar that security software sales is a numbers game; the greater the number of freeware installs the greater the sales. The typical AppGuard purchaser tends to be determined to secure their systems and knows exactly how they want to achieve that objective.

It is possible that things could change in the future, but as I don't work in marketing & sales I cannot state anything definitive.

The current sales model provides a 30-day money back policy for unsatisfied purchasers.