ConfigureDefender utility for Windows 10/11

[ErzCrz]

The two programs are completely different, so it depends on what you're trying to accomplish.

That may suit your needs. You'll have to decide.

Thanks. Just a combination of security and usability I'll just have to experiment some

 

[porkpiehat]

@Andy Ful
I'm running CF with CS settings and UAC disabled..
As I'm running this alongside Defender, would I benefit from running ConfigureDefender at HIGH setting, or would there be some conflict?
Thank you..

 

[Andy Ful]

@Andy Ful
I'm running CF with CS settings and UAC disabled..
As I'm running this alongside Defender, would I benefit from running ConfigureDefender at HIGH setting, or would there be some conflict?
Thank you..

If I correctly recall, CF shows an alert when the executable asks for an elevation, so disabling the Windows UAC prompt is probably OK.
Using ConfigureDefender would be reasonable if you use Microsoft Office, Microsoft Outlook, Adobe Acrobat, etc.

 

[porkpiehat]

I was wondering whether ConfigureDefender would plug any 'holes' in my defence..

 

[oldschool]

I was wondering whether ConfigureDefender would plug any 'holes' in my defence..

What is your current setup? Your security configuration is very old. Please update if applicable.

 

[porkpiehat]

What is your current setup? Your security configuration is very old. Please update if applicable.

Advanced Security - porkpiehat's Security Config 2024

been a while, so a new post.. old one archived. keeping it simple, as I don't go hunting for nasty things..

malwaretips.com

just wondering whether a Defender tweak should be in order...

 

[Andy Ful]

@Andy Ful
As I'm running this alongside Defender, ... would there be some conflict?

ConfigureDefender uses PowerShell code that will be blocked by Comodo's Script Analysis.
To apply ConfigureDefender It is necessary to turn off temporarily the Embedded Code Detection for PowerShell >> use ConfigureDefender >> turn ON the Embedded Code Detection for PowerShell.

 

[porkpiehat]

@Andy Ful
lovely jubbly.. thanks so much..

 

[Jonny Quest]

@Andy Ful
lovely jubbly.. thanks so much..

For those of you who may be like me, I'll save you a Google search

BBC World Service | Learning English | Keep your English Up to Date

Professor David Crystal gives short talks on the origins and usage of new and evolved words and phrases.

www.bbc.co.uk

It's a jocular exclamation. It means excellent, brilliant, great. It's the sort of thing you'd say when you got some good news or had a stroke of luck, 'ah, lovely jubbly'.

Well, would you use it? It depends whether you're influenced by television, I suppose, more than anything else. It's one of the slang phrases that was used by Dell Boy in the television series 'Only Fools and Horses', back in the 1990s. It actually goes back longer than that. These script writers are well aware of some of the earlier usages of phrases like this. In fact, you can take it right back to the 1950s, when there was an ice lolly called a jubbly, and there was an advertising catch phrase, 'lovely jubbly', and the Dell usage, I suppose, has come from that.

 

[rashmi]

ConfigureDefender uses PowerShell code that will be blocked by Comodo's Script Analysis.
To apply ConfigureDefender It is necessary to turn off temporarily the Embedded Code Detection for PowerShell >> use ConfigureDefender >> turn ON the Embedded Code Detection for PowerShell.

View attachment 286941

Wouldn't setting Configure Defender as "ignore" in auto-containment be a more efficient solution? The scripts will appear in the unrecognized files section but shouldn't affect the CD process. You can mark the scripts as trusted later.

 

[ErzCrz]

Wouldn't setting Configure Defender as "ignore" in auto-containment be a more efficient solution? The scripts will appear in the unrecognized files section but shouldn't affect the CD process. You can mark the scripts as trusted later.

CD doesn't run as an active process like DefenderUI does. You use it as and when to change the Microsoft Defender settings and that's it apart from viewing the defender log when you want to. CD is a set and forget so easier to just changed the script analysis embedded shelcode for powershell as @Andy Ful suggested for the initial configuration.

 

[rashmi]

CD doesn't run as an active process like DefenderUI does. You use it as and when to change the Microsoft Defender settings and that's it apart from viewing the defender log when you want to. CD is a set and forget so easier to just changed the script analysis embedded shelcode for powershell as @Andy Ful suggested for the initial configuration.

You need to disable script analysis when applying a Configure Defender configuration and viewing logs. Do you need to reapply a Configure Defender configuration with a new version? Wouldn't it be better to exclude CD in auto-containment as a permanent solution?

 

[Andy Ful]

You need to disable script analysis when applying a Configure Defender configuration and viewing logs. Do you need to reapply a Configure Defender configuration with a new version? Wouldn't it be better to exclude CD in auto-containment as a permanent solution?

CD is a Trusted application, automatically excluded from the containment. However, it uses PowerShell to check and apply settings, and PowerShell is restricted in Script Analysis.
That is how Embedded Code Detection works. It ignores if the application is Trusted, but can restrict the embedded code related to the particular LOLBin.
It is possible to whitelist the blocked PowerShell code, but any combination of ConfigureDefender ASR rules has a different embedded code, so many possible variants exist.

 

[Andy Ful]

CD doesn't run as an active process like DefenderUI does.

Yes, but it does not matter. Embedded Code Detection will block a similar PowerShell Code embedded in DefenderUI or another application.

 

[rashmi]

CD is a Trusted application, automatically excluded from the containment. However, it uses PowerShell to check and apply settings, and PowerShell is restricted in Script Analysis.
That is how Embedded Code Detection works. It ignores if the application is Trusted, but can restrict the embedded code related to the particular LOLBin.
It is possible to whitelist the blocked PowerShell code, but any combination of ConfigureDefender ASR rules has a different embedded code, so many possible variants exist.

As far as I can recall, the 'ignore' status exceeds the 'trusted' status in terms of rights. With ConfigureDefender ignored, I successfully applied the "high" configuration. Refreshed ConfigureDefender and restarted the system. ConfigureDefender retained the "high" configuration. Successfully applied ConfigureDefender's interactive configuration.

 

[Andy Ful]

As far as I can recall, the 'ignore' status exceeds the 'trusted' status in terms of rights. With ConfigureDefender ignored, I successfully applied the "high" configuration. Refreshed ConfigureDefender and restarted the system. ConfigureDefender retained the "high" configuration. Successfully applied ConfigureDefender's interactive configuration.

You cannot choose "ignore" for the ConfigureDfender executable because it is already Trusted. However, you can do it for the blocked content (embedded code). As I already noted, this can only whitelist the content used for a particular action. One such action is applying the "HIGH" Protection Level. There are about 100 possible actions that use different pieces of embedded code. If you would like to fully whitelist the ConfigureDefender actions, you should apply all those possible actions one by one and choose each time to not contain the action.

 

[rashmi]

You cannot choose "ignore" for the ConfigureDfender executable because it is already Trusted. However, you can do it for the blocked content (embedded code). As I already noted, this can only whitelist the content used for a particular action. One such action is applying the "HIGH" Protection Level. There are about 100 possible actions that use different pieces of embedded code. If you would like to fully whitelist the ConfigureDefender actions, you should apply all those possible actions one by one and choose each time to not contain the action.

You have the option to manually "ignore" any executable; however, you can only "trust" Comodo tempscrpt. Listing ConfigureDefender as "ignore" in auto-containment should permit all its actions. You might see Comodo tempscript files related to ConfigureDefender listed as unrecognized; this shouldn't affect ConfigureDefender's functions.

 

[rashmi]

@Andy Ful I tested the "ignore" option in Comodo a little to see how it works. The "ignore" option seems designed for user convenience, enabling the exclusion of all actions from an app, possibly for all modules. This might explain why Comodo marks an app as both trusted and ignored when checking "Trust this app" on the alert.

 

[Andy Ful]

@Andy Ful I tested the "ignore" option in Comodo a little to see how it works. The "ignore" option seems designed for user convenience, enabling the exclusion of all actions from an app, possibly for all modules. This might explain why Comodo marks an app as both trusted and ignored when checking "Trust this app" on the alert.

Yes, the manual "Ignore" under Containment settings works.

 

[Andy Ful]

ConfigureDefender 4.0.1.1 stable version (the same as the latest beta):

https://github.com/AndyFul/ConfigureDefender/raw/refs/heads/master/ConfigureDefender.exe

• Added two new ASR rules.
• Some corrections in the help files.
• Minor GUI changes.

There were no reports about possible issues with the beta version, so it has been promoted to the stable version.