ConfigureDefender utility for Windows 10/11

[Deleted member 178]

@Andy Ful if Lsass.exe protection is enabled, Windows Backup will fail.
(which is supposed to be expected, HMPA seems to do the same)

 

[Andy Ful]

@Andy Ful if Lsass.exe protection is enabled, Windows Backup will fail.
(which is supposed to be expected, HMPA seems to do the same)

Thanks.
It is sad. So, one Windows feature is probably not compatible with another.:notworthy:

 

[shmu26]

Lsass.exe is the one ASR rule that I leave disabled, because it conflicts with lots of software.

 

[Deleted member 178]

Thanks.
It is sad. So, one Windows feature is probably not compatible with another.:notworthy:

Welcome to Windows , where one development department doesn't consult with the others LOL

 

[Deleted member 178]

Lsass.exe is the one ASR rule that I leave disabled, because it conflicts with lots of software.

sadly it is the most important because advanced malware always try to abuse it. (EternalBlue/DoublePulsar)

 

[shmu26]

sadly it is the most important because advanced malware always try to abuse it. (EternalBlue/DoublePulsar)

And what about the lsass protection in AppGuard? How much will it help against advanced malware?

 

[Deleted member 178]

And what about the lsass protection in AppGuard? How much will it help against advanced malware?

in AG, lsass.exe is Memprotected. other process can't read/write in it.

 

[LDogg]

Lsass.exe is the one ASR rule that I leave disabled, because it conflicts with lots of software.

Just installed it. Also disabled this option too! Really good idea to read through a thread sometimes!

~LDogg

 

[bribon77]

Excuse me, but what is it, ASR?

 

[shmu26]

Excuse me, but what is it, ASR?

Attack surface reduction.
This is what Microsoft calls a collection of advanced Windows Defender features, which can be controlled and managed by Configure_Defender.
Some of them used to be in incorporated in EMET.

 

[bribon77]

Attack surface reduction.
This is what Microsoft calls a collection of advanced Windows Defender features, which can be controlled and managed by Configure_Defender.
Some of them used to be in incorporated in EMET.

OK, Thanks @shmu26.

 

[oldschool]

... Really good idea to read through a thread sometimes!

~LDogg

Ya think?

 

[LDogg]

Ya think?

Yep. You learn some information you may not have thought of or known about.

~LDogg

 

[Andy Ful]

Andy, would ConfigureDefender at max settings block the ransomware attack used on this video?

Video - Windows Defender vs GandCrab Ransomware: video review

After the first update update of Windows 10 ver. 1809 (I just did it yesterday), the trick with executing PowerShell from VBScript (JScript) is now blocked. The trick was for fooling one of the ASR rules which blocked the execution when VBScript (JScript) malware downloaded the payload and next executed it, by using only one script engine.
So now, the GandCrab Ransomware from the video would be blocked by the ASR rule "Block JavaScript or VBScript from launching downloaded executable content" (or the old name used in Configuredefender "Impede JavaScript and VBScript to launch executables"). But, this malware technique will be surely enhanced in the next versions to bypass WD protection.
Generally the ASR rules are evolving and are stronger than before.

 

[RoboMan]

So now, the GandCrab Ransomware from the video would be blocked by the ASR rule "Block JavaScript or VBScript from launching downloaded executable content"

Is this a default option on WD or only if you enable ConfigureDefender? The very same scenario of this video with latest Windows update should block it?

 

[509322]

After the first update update of Windows 10 ver. 1809 (I just did it yesterday), the trick with executing PowerShell from VBScript (JScript) is now blocked. The trick was for fooling one of the ASR rules which blocked the execution when VBScript (JScript) malware downloaded the payload and next executed it, by using only one script engine.
So now, the GandCrab Ransomware from the video would be blocked by the ASR rule "Block JavaScript or VBScript from launching downloaded executable content" (or the old name used in Configuredefender "Impede JavaScript and VBScript to launch executables"). But, this malware technique will be surely enhanced in the next versions to bypass WD protection.
Generally the ASR rules are evolving and are stronger than before.

It is just craziness. An overly complicated mousetrap that sometimes catches mice and other times does nothing or, perhaps, smashes the trap setter's fingers. Users looking at ASR and asking "Wut ?... Will it protect against this ?" And then the user not realizing that the ASR rules must be present (Microsoft has to create them - and they are always playing catch-up) and enabled. If not, they have to figure it out and then do it.

It's fine for us that want to tinker and figure stuff out, but for others who just want to protect their systems this Microsoft spaghetti protection is insane. Not to mention it is just a matter of time that the malc0ders bypass the fixed bypass. It's cuck-cah !

SRP can be crafted such that there is no wondering about "Will this protect against this ?" The only real protection to be had is at the process level - either allowing or denying the process. The fine-grained rules blocking specific behaviors is a pipe-dream fallacy - because new malicious behaviors that bypass current rules are implemented. Merely disable wscript and the rest of unwanted stepchild processes. This is not difficult. This is really easy. It is almost "push button" protection.

 

[Andy Ful]

Is this a default option on WD or only if you enable ConfigureDefender? The very same scenario of this video with latest Windows update should block it?

ASR rules are deactivated in WD default settings. They can be activated via PowerShell cmdlets or via policies on Windows 10 Home (policies would require editing the Registry). ConfigureDefender is a GUI that uses PowerShell to activate ASR. I checked the "two script engines" trick some time ago and it could fool ASR, so the malware was probably successful. I did not test this trick again until today, after the first update of Windows 10 ver. 1809. I do not know if the same is true for other Windows 10 versions.

 

[Andy Ful]

...
The fine-grained rules blocking specific behaviors is a pipe-dream fallacy - because new malicious behaviors that bypass current rules are implemented. Merely disable wscript and the rest of unwanted stepchild processes. This is not difficult. This is really easy. It is almost "push button" protection.

This is recommended and most efficient for home users. Those users who cannot do it, for some reason, can consider activating WD ASR rules.

 

[509322]

This is recommended and most efficient for home users. Those users who cannot do it, for some reason, can consider activating WD ASR rules.

LOL... it is a whole lot easier to disable wscript than to enable WD ASR. Some people just like being difficult. :X3:

 

[Eddie Morra]

LOL... it is a whole lot easier to disable wscript than to enable WD ASR. Some people just like being difficult. :X3:

What home user is going to genuinely need features like VBScript or local JScript? I cannot think of a single one. I think it is simpler for it to just be disabled and be done with it than relying on ASR which is going to be a risky game of hit'n'miss each time.