Reply to thread

Message

<blockquote data-quote="ScandinavianFish" data-source="post: 1045019" data-attributes="member: 93786">A couple things about FirewallHardening1. You should have the ability to select multiplie executables at once (Assuming it&#039;s something that actually can be implemented?)2. When scrolling trough any.run and JOESandbox, I noticed that the LOLbin&#039;s that FirewallHardening block does not cover all the LOLbin&#039;s in the .NET Framework folders that are abused by malware, which I had to manually add, one by one, which happens to be exactly why I asked about the ability to add several files at once. Similarly, something to note is that I see some cryptominers use Console Window Host (aka conhost.exe) to evade detection <a href="https://forums.malwarebytes.com/search/?q=conhost.exe&amp;quick=1&amp;type=forums_topic&amp;nodes=7&amp;updated_after=any&amp;sortby=newest" target="_blank">(Refrence)</a>, and blocking it does not seem to cause any issues (atleast on my end), so it&#039;s something that should be added to the blocked LOLbin&#039;s.</blockquote>

[QUOTE="ScandinavianFish, post: 1045019, member: 93786"] A couple things about FirewallHardening 1. You should have the ability to select multiplie executables at once[I] (Assuming it's something that actually can be implemented?)[/I] 2. When scrolling trough any.run and JOESandbox, I noticed that the LOLbin's that FirewallHardening block does not cover all the LOLbin's in the .NET Framework folders that are abused by malware, which I had to manually add, one by one, which happens to be exactly why I asked about the ability to add several files at once. Similarly, something to note is that I see some cryptominers use Console Window Hos[I]t (aka conhost.exe) [/I]to evade detection [URL='https://forums.malwarebytes.com/search/?q=conhost.exe&quick=1&type=forums_topic&nodes=7&updated_after=any&sortby=newest'](Refrence)[/URL], and blocking it does not seem to cause any issues (atleast on my end), so it's something that should be added to the blocked LOLbin's. [/QUOTE]

Verification