Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 817793" data-attributes="member: 32260">Hi,You can easily add any executable you want, when using Firewall Hardening tool. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" />Please consider the below remarks:<ol>
<li data-xf-list-type="ol">Dwm and Eventvwr are already included, although Eventvwr with a mistake (Evntvwr), which I will correct.</li>
<li data-xf-list-type="ol">Csrss is a system process, that is specially protected by PPL&nbsp; (Protected Process Light) in Windows 8.1+. This is very strong protection which is also used to protect AV modules (for example in Kaspersky products). On Windows 7 it can be abused, but only with admin rights. I do not know for sure why this file is included in SysHardener. There were malware samples that used the name csrss.exe and were located somewhere else (not into Windows subfolder) but this cannot be blocked by a firewall rule for system native Csrss.exe . Are you sure that blocking this would be necessary?</li>
<li data-xf-list-type="ol">Protecting Bitsadmin.exe by firewall rules is useless because it only triggers svchost, and this is svchost that downloads the files.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 817793, member: 32260"] Hi, You can easily add any executable you want, when using Firewall Hardening tool. :giggle: Please consider the below remarks: [LIST=1] [*]Dwm and Eventvwr are already included, although Eventvwr with a mistake (Evntvwr), which I will correct. [*]Csrss is a system process, that is specially protected by PPL (Protected Process Light) in Windows 8.1+. This is very strong protection which is also used to protect AV modules (for example in Kaspersky products). On Windows 7 it can be abused, but only with admin rights. I do not know for sure why this file is included in SysHardener. There were malware samples that used the name csrss.exe and were located somewhere else (not into Windows subfolder) but this cannot be blocked by a firewall rule for system native Csrss.exe . Are you sure that blocking this would be necessary? [*]Protecting Bitsadmin.exe by firewall rules is useless because it only triggers svchost, and this is svchost that downloads the files. [/LIST] [/QUOTE]

Verification