Hard_Configurator - Windows Hardening Configurator

[shmu26]

New H_C ver. 6.0.0.0 beta 1:

https://github.com/AndyFul/Hard_Configurator/raw/master/H_C_6_beta1.exe

This beta version can be installed over the previous version (5.1.1.2). It has been whitelisted by Microsoft, Avast, Norton, and Bitdefender.

Changelog:

1. Introduced two color-changing buttons. When the restrictions are OFF, the buttons <Switch OFF/ON SRP> and <Switch OFF/ON Restrictions> change the background color from green to blue.
2. Fixed some minor bugs.
3. Added finger.exe to blocked sponsors and also to the H_C Enhanced profiles.
4. Added some EXE files to FirewallHardening LOLBin Blocklist: csc, cvtres, CasPol, finger, ilasm, jsc, Microsoft.Workflow.Compiler, mscorsvw, ngen, ngentask, vbc.
5. Added SLK file extension to the default protected extensions.
6. Added a switch -p to run H_C and SwitchDefaultDeny with SRP enforcement to block all users (including Administrators) - it can be used especially on the older Windows versions to improve post-exploitation protection on default Admin account. This switch should be used only by very experienced users.
7. New version of ConfigureDefender:
   - Added some useful information to the Help and manual.
   - Added "Send All" setting to Automatic Sample Submission.
   - Updated ASR rules (1 new rule added).
   - Added the Warn mode to ASR rules.
   - Added INTERACTIVE Protection Level which uses ASR rules set to Warn.
   - Added the <Info> button next to the Protection Levels buttons. It displays information about which settings are enabled in DEFAULT, HIGH, INTERACTIVE, and MAX Protection Levels.
   - Redesigned slightly the layout of the Exploit Guard section.
8. Added support for Windows 11.

Be safe.

Thanks Andy!
What's the new ASR rule?
What added support was needed for Win11?

 

[ForgottenSeer 85179]

What's the new ASR rule?

Hard_Configurator - Windows Hardening Configurator

Hi Andy, an update on my last post: I rebooted the computer for the firewall rule changes to take effect and now I get a firewall log event like so: Something blocks outbound connections of spoolsv.exe (but not H_C or FirewallHardening). This executable is related to printing. This block can be...

malwaretips.com

What added support was needed for Win11?

Hard_Configurator - Windows Hardening Configurator

In HardeningKitty i found the following Firewall rules, which aren't in your FirewallHardening tool: ID Name Type Rule applies to Protocol Local ports IP addresses Profile Action 2307 HardeningKitty-Block-calc-x64 Custom Rule %SystemRoot%\System32\calc.exe Any Any Any Block All 2308...

malwaretips.com

 

[shmu26]

Hard_Configurator - Windows Hardening Configurator

Hi Andy, an update on my last post: I rebooted the computer for the firewall rule changes to take effect and now I get a firewall log event like so: Something blocks outbound connections of spoolsv.exe (but not H_C or FirewallHardening). This executable is related to printing. This block can be...

malwaretips.com

Hard_Configurator - Windows Hardening Configurator

In HardeningKitty i found the following Firewall rules, which aren't in your FirewallHardening tool: ID Name Type Rule applies to Protocol Local ports IP addresses Profile Action 2307 HardeningKitty-Block-calc-x64 Custom Rule %SystemRoot%\System32\calc.exe Any Any Any Block All 2308...

malwaretips.com

Thanks.
I didn't know about that new ASR rule. Good info.
I did know about that particular Win11 issue, as I reported it. Just wondering whether Andy found others.

 

[Andy Ful]

@shmu26,
ConfigureDefender and FirewallHardening Logs have not been displayed correctly on Windows 11. One of the issues was a bug in Windows 11 while using the wevtutil.exe system tool with /f:text switch to retrieve the text output of the Windows Events Log. I had to change the code and use another way to filter events.

Post edited.

 

[shmu26]

@shmu26,
ConfigureDefender and FirewallHardening Logs have not been displayed correctly on Windows 11. One of the issues was a bug in Windows 11 while using the wevtutil.exe system tool with /text switch to retrieve the text output of the Windows Events Log. I had to change the code and use another way to filter events.

Thanks. I think I experienced that logging bug, but I wasn't sure what happened.

 

[Andy Ful]

Some screenshots:

ConfigureDefender:

Hard_Configurator:

 

[Gandalf_The_Grey]

New H_C ver. 6.0.0.0 beta 1:

https://github.com/AndyFul/Hard_Configurator/raw/master/H_C_6_beta1.exe

This beta version can be installed over the previous version (5.1.1.2). It has been whitelisted by Microsoft, Avast, Norton, and Bitdefender.

Changelog:

1. Introduced two color-changing buttons. When the restrictions are OFF, the buttons <Switch OFF/ON SRP> and <Switch OFF/ON Restrictions> change the background color from green to blue.
2. Fixed some minor bugs.
3. Added finger.exe to blocked sponsors and also to the H_C Enhanced profiles.
4. Added some EXE files to FirewallHardening LOLBin Blocklist: csc, cvtres, CasPol, finger, ilasm, jsc, Microsoft.Workflow.Compiler, mscorsvw, ngen, ngentask, vbc.
5. Added SLK file extension to the default protected extensions.
6. Added a switch -p to run H_C and SwitchDefaultDeny with SRP enforcement to block all users (including Administrators) - it can be used especially on the older Windows versions to improve post-exploitation protection on default Admin account. This switch should be used only by very experienced users.
7. New version of ConfigureDefender:
   - Added some useful information to the Help and manual.
   - Added "Send All" setting to Automatic Sample Submission.
   - Updated ASR rules (1 new rule added).
   - Added the Warn mode to ASR rules.
   - Added INTERACTIVE Protection Level which uses ASR rules set to Warn.
   - Added the <Info> button next to the Protection Levels buttons. It displays information about which settings are enabled in DEFAULT, HIGH, INTERACTIVE, and MAX Protection Levels.
   - Redesigned slightly the layout of the Exploit Guard section.
8. Added support for Windows 11.

Be safe.

Great work and thanks for keeping those tools up to date
Will there be a standalone (beta) version of the new ConfigureDefender?

 

[paulderdash]

Installed H_C ver. 6.0.0.0 beta 1 over the top. All good.
Thanks Andy, brilliant improvements!

Similarly, asking whether there be a standalone (beta) version of the new ConfigureDefender?

 

[ForgottenSeer 85179]

So, i upgraded to new beta and everything looks good so far

 

[eonline]

Kaspersky detects it as a virus. It has a false positive.

 

[SeriousHoax]

Kaspersky detects it as a virus. It has a false positive.
View attachment 259779

I have submitted the exe file as false positive. Hopefully, they'll fix it soon.

 

[eonline]

I have submitted the exe file as false positive. Hopefully, they'll fix it soon.
View attachment 259781

I just updated the database and it no longer detects it as a virus. Thank you.

 

[Andy Ful]

...
Will there be a standalone (beta) version of the new ConfigureDefender?

...
Similarly, asking whether there be a standalone (beta) version of the new ConfigureDefender?

Yes, probably in July/August.

 

[Kongo]

Yes, probably in July/August.

Also for SWH and FirewallHardening?

 

[Gandalf_The_Grey]

Posted the news on the other site and got a special thanks for @Andy Ful

Hard_Configurator - GUI to Manage Software Restriction Policies and harden Windows Home OS

Started using this and recommended settings is probably safe to use? I also added recommended H_C in firewall hardening.

www.wilderssecurity.com

Thanks @Gandalf_The_Grey - And special Thanks to AndyFul.

Hard_Configurator - GUI to Manage Software Restriction Policies and harden Windows Home OS

Started using this and recommended settings is probably safe to use? I also added recommended H_C in firewall hardening.

www.wilderssecurity.com

 

[Andy Ful]

Also for SWH and FirewallHardening?

It will be easy for FirewallHardening.
SWH will require some additional code to handle the Logs properly in Windows 11, so I plan to publish the new version in August/September.

 

[SeriousHoax]

I just updated the database and it no longer detects it as a virus. Thank you.

Yeah, they fixed it within 17 minutes. Fast response

 

[silversurfer]

SWH will require some additional code to handle the Logs properly in Windows 11, so I plan to publish the new version in August/September.

Any improvements for SWH or basically just have to be "workable" on Windows 11 ?

 

[Andy Ful]

Any improvements for SWH or basically just have to be "workable" on Windows 11 ?

I am going to keep SWH as simple/problem-free as possible. For now, I will focus to make it workable on Windows 11.

 

[jerzy601]

Thanks to Andy.
This is good information that there is a new version.
Excellent work and thanks for maintaining this tool to work.
Can I install it on an old version?