Setup Idea Double cloud based whitelist protection for FREE

[Max90]

Hi, I decided to give SAC a try on my wife's laptop and combine it with AVAST ONE hardened mode.

I added Hard_Configurator (Beta) to the mix with its new SAC_ON_recommended_settings. which allows MSI, EXE and TMP files, but those executable file formats are checked by Smart Application Control of Windows 11 and AVAST in hardened mode againsgt cloud based whitelists. The only extra setting I enables was blocking all sponsors and disable CMD through registry change (link)

To silence AVAST go to notifications and disable displaying the icon (it shows irritating dots when it has a message), disable ask to scan external USB-disk and select silent mode. It is also wise to deselect offerings and personalisation in data settings/preferences. Enable hardened mode in the shields, choose make automatic decisions and smart mode where you see them to make it a security setup your grandparents can use.

Runs silently and smoothly on a Ryzen4500U laptop with 16GB and 512 SSD. The default protection of Micrsoft Defender and AVAST free often score best in comparative tests (AV-Comparatives, AV-Test, SE-labs, AVLab) and Youtube testers always disable smartscreen before testing, so I have a hard time imagining what could bypass two cloud based whitelists with Hard_Configurator which also blocks all risky file extensions in user folders and all LoLBins for standard users.

 

[Andy Ful]

I made sure to install it locally, because one of the known issues with WDAC is that WDAC blocks alls MSI's directly installed from the internet

It is more complicated. The file reputation lookup in WDAC (Microsoft ISG) works only for PE files (EXE, DLL, etc.). So, most MSI files will be blocked by WDAC (except for whitelisted). It does not matter if MSI files were downloaded from the Internet or not. If I correctly recall, whitelisting MSI files by path did not work - but this issue could be corrected by Microsoft. Furthermore, I had a problem with whitelisting some signed MSI files. Whitelisting by hash worked well.
The MSI files with insufficient reputation downloaded directly from the Internet (with MOTW) will be blocked by SmartScreen for Explorer.

Post edited.

 

[Max90]

It does not matter if MSI files were downloaded from the Internet or not (A) . If I correctly recall, whitelisting MSI files by path did not work 9B)

SignedReputable Google MSI installed, with a more restricted WDAC policy it blocked I have been using WDAC for three years and it seems to work well.
A. It does make a difference, it s explicitely mentioned in the documentation.
B. For MSI allow by filepath you need to disable "Runtime FilePath Rule Protection"

Lets conclude with: when you can use SAC on Windows 11 that is the latest and better solution

 

[Andy Ful]

B. For MSI allow by filepath you need to disable "Runtime FilePath Rule Protection"

There was a bug in WDAC and filepath rules did not work for MSI files and PowerShell scripts. I confirmed that this issue was fixed in October 2022.

Windows 10 build 19044.2130 (KB5018410) outs for 21H2, 21H1, 20H2 - Pureinfotech

KB5018410 for Windows 10 (build 19044.2130) now available for download. Also, versions 21H1, 20H2, and older releases are getting updates.

pureinfotech.com

 

[Andy Ful]

Back to the topic.
Although one can use H_C to block also elevated processes (like SAC), I do not recommend this when blocking LOLBins. Some LOLBins are used when installing/updating applications (for example regsvr32.exe). Most installations/updates are done in %ProgramFiles% so they require high privileges. There will not be any problems when the LOLBins are blocked with standard rights. But, the installation/update can fail if the H_C settings block also elevated processes.
So, Max90 is right when using in his setup the H_C settings to block only processes with standard rights.
One can also consider a setup with SWH settings where EXE files (including LOLBins) are mostly allowed. In such a case it is possible to choose an option that blocks also elevated processes.