Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 967231" data-attributes="member: 32260">Hard_Configurator tools - the new version of FirewallHardening added.[URL unfurl=&quot;true&quot;]https://github.com/AndyFul/ConfigureDefender/raw/master/H_C_HardeningTools_2000.zip[/URL]There are some important changes in the FirewallHaredening tool:<ol>
<li data-xf-list-type="ol">The &lt;Blocked Events&gt; can show only the events related to FirewallHardening Blocklist. If the FirewallHardening BlockList is empty then &lt;Blocked Events&gt; does not show any blocked events. </li>
<li data-xf-list-type="ol">From point one, it follows that events related to blocks made by other Windows Firewall settings, Windows privacy settings, etc., will not be included in the &lt;Blocked Events&gt;.</li>
<li data-xf-list-type="ol">New LOLBins are added to the BlockList: 
In ver. 2001 : Csc, Cvtres, CasPol, Finger, ilasm, Jsc, Microsoft.Workflow.Compiler, Mscorsvw, Ngen, Ngentask, Vbc. 
 In ver. 2010: CertOc, CertReq, Dllhost, Findstr.exe, Desktopimgdownldr.exe, ExtExport, Ieexec.exe (new location), Pktmon, Register-cimprovider, Verclsid, Wsl, Wuauclt, Xwizard.</li>
</ol>Until the new version will be pushed (can use Load/Save option), the simplest method to update the rules is using:<ol>
<li data-xf-list-type="ol"> &quot;Recommended H_C&quot; &lt;ADD&gt; button - most important new LOLBins will be added &amp; blocked.</li>
<li data-xf-list-type="ol"> &quot;LOLBins&quot; &lt;ADD&gt; button - all new LOLBins will be added &amp; blocked.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 967231, member: 32260"] [SIZE=5][B]Hard_Configurator tools - the new version of FirewallHardening added.[/B][/SIZE] [SIZE=4][URL unfurl="true"]https://github.com/AndyFul/ConfigureDefender/raw/master/H_C_HardeningTools_2000.zip[/URL] There are some important changes in the FirewallHaredening tool:[/SIZE] [LIST=1] [*][SIZE=4]The <Blocked Events> can show only the events related to FirewallHardening Blocklist. If the FirewallHardening BlockList is empty then <Blocked Events> does not show any blocked events. [/SIZE] [*][SIZE=4]From point one, it follows that events related to blocks made by other Windows Firewall settings, Windows privacy settings, etc., will not be included in the <Blocked Events>.[/SIZE] [*][SIZE=4]New LOLBins are added to the BlockList: In ver. 2001 : Csc, Cvtres, CasPol, Finger, ilasm, Jsc, Microsoft.Workflow.Compiler, Mscorsvw, Ngen, Ngentask, Vbc. In ver. 2010: CertOc, CertReq, Dllhost, Findstr.exe, Desktopimgdownldr.exe, ExtExport, Ieexec.exe (new location), Pktmon, Register-cimprovider, Verclsid, Wsl, Wuauclt, Xwizard.[/SIZE] [/LIST] [SIZE=4]Until the new version will be pushed (can use Load/Save option), the simplest method to update the rules is using:[/SIZE] [LIST=1] [*][SIZE=4] "Recommended H_C" <ADD> button - most important new LOLBins will be added & blocked.[/SIZE] [*][SIZE=4] "LOLBins" <ADD> button - all new LOLBins will be added & blocked.[/SIZE] [/LIST] [/QUOTE]

Verification