ConfigureDefender utility for Windows 10/11

[Digmor Crusher]

you misunderstood something

Oldschool wondered/questioned why DefederUI was running in memory while every Defender setting can be set via registry or powershell (as Configure Defender does).

I meant that DefenderUI Pro is more like a Cyberlock lite, most here know that both DefenderUI and Configure Defender adjust Defenders settings.

 

[Andy Ful]

Guys, I hope than you do not post much about ConfigureDefender in the DefenderUI thread.

 

[Digmor Crusher]

Guys, I hope than you do not post much about ConfigureDefender in the DefenderUI thread.

And vice versa.

 

[LinuxFan58]

I meant that DefenderUI Pro is more like a Cyberlock lite, most here know that both DefenderUI and Configure Defender adjust Defenders settings.

Again misundestanding

Oldschool posted that for Defender settings tweaks everything could be set without needing a program running in the background.

I mentioned PRO, because it offers other protections and the free and pro sharing code is probably the reason it runs in memory.

As you stated

 

[rashmi]

I mentioned PRO, because it offers other protections and the free and pro sharing code is probably the reason it runs in memory.

Running in real-time allows DefenderUI and the Pro version to generate alerts and configure changes without a system restart, among other functions.

Please avoid cluttering this thread; instead, post questions or information in the DefenderUI thread.

 

[Parkinsond]

Can the ASR rule of "Block use of copied or impersonated system tools" stop this step?

The installer then started a fake svchost.exe (PID 9964) to begin stealing my data

 

[Andy Ful]

Can the ASR rule of "Block use of copied or impersonated system tools" stop this step?

"The installer then started a fake svchost.exe (PID 9964) to begin stealing my data"

Yes.

 

[Parkinsond]

What can the rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" add more than WHHL WDAC for evaluating an exe file?
Are not both using the same backend?

 

[Andy Ful]

What can the rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" add more than WHHL WDAC for evaluating an exe file?

Not much. However, the ASR rule is more dependent on the file prevalence, and WDAC on file reputation.

Are not both using the same backend?

Yes, but in a slightly different way.

 

[ForgottenSeer 114717]

CD is still 5A1. Thx @Andy Ful . Much appreciated. Better than Intune/Entra ID - at least for non-enterprise/government Windows.

 

[Parkinsond]

Not much. However, the ASR rule is more dependent on the file prevalence, and WDAC on file reputation.



Yes, but in a slightly different way.

I think using such ASR rule with WDAC/SAC is redundant to some extent; the ASR rule represents a relatively good substitue for WDAC, when WDAC could not be applied.

 

[Andy Ful]

CD is still 5A1. Thx @Andy Ful . Much appreciated. Better than Intune/Entra ID - at least for non-enterprise/government Windows.

You're welcome.

 

[Parkinsond]

The ASR rule is a kind of HIPS based on the file prevalence, age. or trust. After a few days, the blocked file can be allowed if more people will run it without problems.

How can more people run it, if it is already blocked for all people (the age of the installer released today is the same for all people, unless they live in a parallel universe with a different dating).

 

[Andy Ful]

How can more people run it, if it is already blocked for all people ....

It is not blocked for all people.
Currently, the 0-day-old file is also unblocked after one day.

 

[LinuxFan58]

I think using such ASR rule with WDAC/SAC is redundant to some extent; the ASR rule represents a relatively good substitue for WDAC, when WDAC could not be applied.

Well in the past, a signed Dutch program with few users was always blocked by that ASR rule and allowed by WDAC (before we bought new laptops, we were bith using WHHL). The stupid thing about that program was that one could not decline updates. So I ended up disabling that ASR rule on het former laptop.

The logic behind that ASR rule is illlustrated with a saying "to survice a lion attack you don't have to run fater than the lion, just run faster than another in the herd" So when 1000 people are using that program without being infected it has a high likelyhood of being benign.

 

[Parkinsond]

Well in the past, a signed Dutch program with few users was always blocked by that ASR rule and allowed by WDAC (before we bought new laptops, we were bith using WHHL). The stupid thing about that program was that one could not decline updates. So I ended up disabling that ASR rule on het former laptop.

The logic behind that ASR rule is illlustrated with a saying "to survice a lion attack you don't have to run fater than the lion, just run faster than another in the herd" So when 1000 people are using that program without being infected it has a high likelyhood of being benign.

So WDAC/SAC is carrying out ASR rules job, but is more refined.

 

[Parkinsond]

It is not blocked for all people.

If the ASR rule relies on age, then when the installer is 0-day old, it should be blocked for all users.
Most of time, ASR rules blockage coincides with WDAC/SAC one.

 

[Andy Ful]

If the ASR rule relies on age, then when the installer is 0-day old, it should be blocked for all users.

Are you sure? How could Microsoft force all users to apply ASR?
The telemetry works with no ASR, too.

 

[Parkinsond]

Are you sure? How could Microsoft force all users to apply ASR?
The telemetry works with no ASR, too.

Yes, I have forgotten the reckless users who skip ASR rules

 

[LinuxFan58]

So WDAC/SAC is carrying out ASR rules job, but is more refined.

Although the WDAC/SAC dcumentation says it also takes prevalence into account, it is different. The beauty of that ASR rule (using 1000 installations as a hard criteria) is that it really lowers infection risk. @Andy Ful has often posted, that the easiest and most effective protection against zero days is delaying installations of new programs with a day. That is IMO the logic behind that ASR rule.

That ASR rule can be compared by blocking new domains (less than 30 days registered) and newly seen domains. It also causes FP's but since most phishing and malicious websites are short lived, it will protect you against most of them (possibly 95% or higher).