App Review Beginning test of WHH at max settings per Andy Ful + OSArmor + SysHardener + Sysmon in DMZ

[Andy Ful]

Hi Andy,

167 items in FirewallHardening

I forgot to turn on Logging for Firewall Control, I only tried to log Defender firewall, and the log was gone.

OK. Turn it ON. We will see if something is blocked.

 

[Andy Ful]

It looks like you tried to install some tools. Did you turn off some WHHLight settings during the test?
Did you look into the OSArmor Log?

 

[Victor M]

After I put the test machine onlime at 12:14am, I went on my main laptop. I did not do anything in addition after it was online.

 

[Victor M]

OK. Turn it ON. We will see if something is blocked.

Do you want me to turn the frewallhardning logging on and then put the test machine online?

I took it offline to examine the machine for intrusion. If there is anything else you want me to do while offline please tell me now. Or else the attacker can come back and really make sure he erased all traces.

 

[Andy Ful]

Do you want me to turn the frewallhardning logging on and then put the test machine online?

Yes. Check if all WHHLight tools and Sysmon work as intended before connecting to the network. Do nothing during the test for one hour (fewer events to inspect). Disconnect from the network and make similar Logs (SWH, WDAC, FirewallHardening, Sysmon). I will look at them.

 

[Victor M]

Hi @Andy Ful , Round 2 results sent via PM.

 

[bazang]

I know that there are sometimes hackers at cafes.

They don't typically attempt to hack into your computer, send malicious emails, or try to get malware onto a victim's system. Direct attacks on Guest network connected devices are not very productive. Therefore, not the attack of choice. A direct attack is on the tinfoil hat fringe section of the attack bell curve.

The threat actors hack into the Guest network (typically targeting the router) and configure themselves as Man-in-the-Middle. They might scan for open ports and look for weaknesses, but what they are after are credentials that they can use, especially in replay attacks.

Although there is a small incidence of direct attacks. I suppose if one is paranoid about them then they harden their systems. I get it. However, it calls into question "Why do people take their mobile devices and do stuff online with valuable infos at Starbucks and use its network in the first place?"

Easy enough to resolve, use your mobile phone as a cellular network hotspot. If you have to purchase more data then is the peace-of-mind it provides worth it? Or just risk gamble and use fully unsecured and insecure public Wifi?

Plus, 5 to 15 Euro for various Starbucks drinks should be adequate to deter people from going there, but it is astonishing that there are soooo many people that have a 600 and higher Euro per month Starbucks habit. Those people, are not rich. Not even well off. Just a few are.

 

[Andy Ful]

@Victor M
So far, there are no suspicious entries in the Logs.
Can you use regedit.exe?

 

[Victor M]

Summary. I will try to answer all the previous unanswered questions.


All the setup and configuration was done with the computer offline, in the order of presentation in the OP. I made sure that the MS Baseline IS a baseline by applying it first, followed by the Cloud Protectiion modification.

OSArmor has lots of restrictions applied, but they are mostly GUI based. This stops GUI based RATs hopefully. After realizing that the setup missed hardening, I re-did the whole configuration, added SysHardener as the second step, following the MS Baseline & Cloud Protection setup.'' SysHardener has all settings checkmarked except the uninstallation items. ( I think it can not re-install them )

Then I followed Andy's screenshots and also setup ConfigureDefender and FirewallHardening as directed.

Then I setup OSArmor and turned on all protections.

Then I setup Sysmon using this xml. It should delete any newly created executables.

<Sysmon schemaversion="4.90">
<!-- Capture all hashes -->
<HashAlgorithms>MD5,SHA256</HashAlgorithms>
<EventFiltering>
<!-- Block executable file creations -->
<FileBlockExecutable onmatch="include">
<TargetFilename condition="begin with">C:</TargetFilename>
</FileBlockExecutable>
</EventFiltering>
</Sysmon>



Andy was right, the test is equivalent to having 100 experienced hackers in the cafe. Not careful thinking on my part.

@oldschool, I have already tried Spynetgirl's hardening and WDAC programs. I will be doing further tests and will proabably use those.

The network environment was simple. I placed the test laptop directly connected to the modem+router via ethernet and set the DMZ to point to it.

network device exploits, abusing opened ports, DNS poisoning, MITM attacks, firewall exploits, abusing vulnerable protocols or system processes, etc

Andy has these nailed. The attack highly likely involved some of those. And the test machine was ill prepared. But then, these all have to do with the landing. The machine idealy should be able to defend itself after the landing took place. However, the setup was not prepared for the Evasion stage of the attack ( see Mitre Att&ck) where the attacker would be able to assess and find out what defenses are onboard and then work his way around them or deactivate them one after the other.

I am still set on my path to figure out what free tools can remedy the situation best. My fortifiedubuntu.org setup PDF has around 17 technical layers, plus some administrative ones, but that is not an accurate way to measure things accross different OS's. But, some of them can be migrated over to Windows. My lazy side is screaming that Windows is a for-pay environment and you have to pay your way to good security. We'll see, we'll see.

 

[piquiteco]

Hello, @Andy Ful it's all good? I don't want to go off topic, I'll even ask @Victor M for permission without invading his post. How do I report a problem related to Hard_Configurator to you?

 

[Andy Ful]

Hello, @Andy Ful it's all good? I don't want to go off topic, I'll even ask @Victor M for permission without invading his post. How do I report a problem related to Hard_Configurator to you?

You can post in the H_C thread:

Hard_Configurator - Windows Hardening Configurator

Post updated in January 2025. The current version can be downloaded from GitHub: https://github.com/AndyFul/Hard_Configurator/raw/master/Hard_Configurator_setup_7.0.0.1.exe The previous version can be downloaded from Softpedia...

malwaretips.com

 

[Andy Ful]

Summary. I will try to answer all the previous unanswered questions.


All the setup and configuration was done with the computer offline, in the order of presentation in the OP. I made sure that the MS Baseline IS a baseline by applying it first, followed by the Cloud Protectiion modification.

OSArmor has lots of restrictions applied, but they are mostly GUI based. This stops GUI based RATs hopefully. After realizing that the setup missed hardening, I re-did the whole configuration, added SysHardener as the second step, following the MS Baseline & Cloud Protection setup.'' SysHardener has all settings checkmarked except the uninstallation items. ( I think it can not re-install them )

Then I followed Andy's screenshots and also setup ConfigureDefender and FirewallHardening as directed.

Then I setup OSArmor and turned on all protections.

Then I setup Sysmon using this xml. It should delete any newly created executables.

Yes, the setup must be done in a specific order to avoid conflicts and misconfiguration.

1. MS Baseline + some policies must be reset to Not Configured to avoid conflict with WHHLight
2. WHHLight + tools
3. OSARmor
4. Sysmon

Syshardener can be skipped because it is mainly covered by other tools.
Some more work must be done to avoid conflicts. For example:

• In some cases, OSARmor blocks viewing the Logs from WHHLight tools (notepad blocked due to high privileges),
• Sysmon can block WHHLight tools,
• Sysmon will block OSARmor and WHHLight updates.

 

[bazang]

Yes, the setup must be done in a specific order to avoid conflicts and misconfiguration.

1. MS Baseline + some policies must be reset to Not Configured to avoid conflict with WHHLight
2. WHHLight + tools
3. OSARmor
4. Sysmon

Syshardener can be skipped because it is mainly covered by other tools.
Some more work must be done to avoid conflicts. For example:

• In some cases, OSARmor blocks viewing the Logs from WHHLight tools (notepad blocked due to high privileges),
• Sysmon can block WHHLight tools,
• Sysmon will block OSARmor and WHHLight updates.

The user needs an implementation procedure documented otherwise they cannot determine what is conflicting with what by using a reverse procedure to make the determination.

Often I see this sort of over-lapping & potentially conflicting security configuration result in the system having to clean install Windows and then rebuilt it.

 

[Victor M]

• In some cases, OSARmor blocks viewing the Logs from WHHLight tools (notepad blocked due to high privileges),
• Sysmon can block WHHLight tools,
• Sysmon will block OSARmor and WHHLight updates.

I understand all that already.
There are specific steps I follow in sequence in order to disable protection when I do investigation or other things.
I am following defense in depth and overlaps in protection is by choice.

 

[Victor M]

One thing that I informed Andy about but did not post in this thread is that VCRuntime140_1.dll has a popup by an app announcing that it is missing at reboot. This can have serious concequences as security programs can break. Hackers are resourceful and will find weaknesses t to exploit where you least expect it.

 

[Andy Ful]

@Victor M
Do you have some opened ports in your testing environment?

 

[Victor M]

The firewall was at default settings, I did not modify anything.( I trust Microsoft knows best !!?? ) I didn't configure the firewall because I only know how to toggle swtiches in apps.