security123

Level 27
Verified
So here my result:

As Windows Firewall runs without any modification nor i use other Firewalls, the following two entries are listed:

DestAddress: 93.184.221.240
DestAddress: 2606:2800:133:672:1e5f:2264:1854:1189


Both are EdgeCast and ping from command line works without problems. So i ignore that for now and re-activate recommend Firewall rules
 

plat1098

Level 22
Verified
This is an idle observation only. It seems Microsoft can over-ride at least one or some LOLbin block rules via H_C Firewall Hardening. I run Insider builds so it's necessary to enable "optional" telemetry--formerly "full" telemetry. I think I have safeguards in place to stop any malicious process from running w/System privileges but just wanted to mention this.

compattel.png

compatelrunner.PNG
 

Andy Ful

Level 65
Verified
Trusted
Content Creator
This is an idle observation only. It seems Microsoft can over-ride at least one or some LOLbin block rules via H_C Firewall Hardening. I run Insider builds so it's necessary to enable "optional" telemetry--formerly "full" telemetry. I think I have safeguards in place to stop any malicious process from running w/System privileges but just wanted to mention this.


From the fact that this process is running, it does not follow in any way that it can connect to the Internet.:unsure:
 

Andy Ful

Level 65
Verified
Trusted
Content Creator
Interesting. I stopped counting after 25.


H_C at work! And there has been no interference w/receiving updates and new Insider builds. Indeed, no outbound connections apparent.
Ha, ha. :) Although the H_C/FirewallHardening is indirectly responsible for that, the true work is done fully by Windows Firewall (WF). The H_C simply instructed once WF what to do and nothing more. It even does not control what happens next, because it is not active except for the short time when the user runs manually H_C/ConfigureDefender/FirewallHardening. All work/protection comes from Windows built-in features.(y):)
 

Andy Ful

Level 65
Verified
Trusted
Content Creator
What additional protection can apply the H_C Basic_Recommended_Settings over the WD + ConfigureDefender MAX preset?

First, one can use any ConfigureDefender settings with H_C. So, all other H_C settings cover additional vectors of attack:
  1. Scripting.
  2. LOLBins executed via shortcuts.
  3. Non-executable files with active content.
The above vectors often end with EXE payload which will be blocked by WD with ConfigureDefender MAX and usually the infection will be neutralized after reboot. This observation follows from tests on Malware Hub. But, in the fileless attacks, the situation is slightly worse because the WD ASR rules can stop only the popular methods. This is still very good protection, as we can see from MRG Effitas tests (Exploit/Fileless samples), for example (360 Assessment & Certification – Q2 2020):

1603919716446.png


Yet, there are several less popular methods that can bypass ASR rules but would be blocked by the H_C Basic_Recommended_Settings and FirewallHardening. Some rare examples can be found on Malware Hub and in the articles about bypassing ASR rules. I made two ransomware scripts that could bypass WD with ConfigureDefender MAX preset (including Controlled Folder Access). These settings and SmartScreen can be also bypassed by DLL hijacking.
Anyway, WD + ConfigureDefender MAX preset will be very strong protection even for demanding users.
 
Last edited:

SeriousHoax

Level 32
Verified
Yesterday I was unable to login to Epic Games Launcher and turned out it needed "lsaa.exe" to connect outbound for some reason. So deleted it from FirewallHardening, restarted the system and then I could log in. This is/was only required for logging in. Once you are in it's not needed anymore. Few months ago I saw WiseVector was also trying to connect via this exe on the very first run after installation. I don't know why it's required but sharing this here in case someone face similar issue.
1.PNG
 

RoboMan

Level 32
Verified
Content Creator
Malware Tester
Yesterday I was unable to login to Epic Games Launcher and turned out it needed "lsaa.exe" to connect outbound for some reason. So deleted it from FirewallHardening, restarted the system and then I could log in. This is/was only required for logging in. Once you are in it's not needed anymore. Few months ago I saw WiseVector was also trying to connect via this exe on the very first run after installation. I don't know why it's required but sharing this here in case someone face similar issue.
View attachment 248224
Meanwhile in RoboMan's house...

1604071501749.png


Thank you, this helped. I lost like 8 hours thinking it was on Epic's side.
 

Andy Ful

Level 65
Verified
Trusted
Content Creator
Yesterday I was unable to login to Epic Games Launcher and turned out it needed "lsaa.exe" to connect outbound for some reason. So deleted it from FirewallHardening, restarted the system and then I could log in. This is/was only required for logging in. Once you are in it's not needed anymore. Few months ago I saw WiseVector was also trying to connect via this exe on the very first run after installation. I don't know why it's required but sharing this here in case someone face similar issue.
View attachment 248224
That is why I added the Log of blocked entries to FirewallHardening. Without the Log, it would be very hard to find the source of the issue. :)
 

Andy Ful

Level 65
Verified
Trusted
Content Creator
Blocking LOLBins in Firewall block Windows Store:
View attachment 248249

It's because of:
Application: C:\windows\system32\lsass.exe

For now i disable the LOLBins rules as my system is secure enough. Blocking LOLBins isn't recommend anway.
Blocking all LOLBins in FirewallHardening can be a challenge for most users. It is possible to use such a setup but only when controlling the blocked events. I would rather recommend using the "Recommended H_C" option, especially with the H_C Basic_Recommended_Settings.
 

Andy Ful

Level 65
Verified
Trusted
Content Creator
Andy, related to your latest awesome post: How the hell WD works on Windows Home & Pro?

did we get these logs by default in your customised FullEventLogView from Hard_Configurator under Tools -> Blocked Events / Security Logs ?

I ask because below their is a "Turn ON Advanced SRP Logging" button and your post makes me wonder about that :D

The events related to WD detections, ASR rules, and CFA are included in <Tools><Blocked Events / Security Logs>. These events can be seen also in the ConfigureDefender Log.
The events related to blocked Internet connections cannot be included in the H_C Log because it uses the FullEventLogView (NirSoft tool). It is a nice and convenient tool, but it cannot filter out the blocked inbound connections to leave only blocked outbound connections. Such filtering is necessary because there are several hundreds of blocked inbound connections a day.

Post edited because I initially misunderstood the question posted by @security123.
 
Last edited:

Andy Ful

Level 65
Verified
Trusted
Content Creator
@security123,
Please read my previous post again, because it was edited. According to the <Turn ON Advanced SRP Logging> feature, it is sometimes useful as extended info about what has been blocked. One has to run the application with Admin rights to see what processes will be run by this application. The example is included in the manual in the Troubleshooting section.
 
Top