Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 817810" data-attributes="member: 32260">Although the idea is interesting for some other files (like notepad.exe), the bitsadmin.exe would be probably the last to block. The logic is simple. Bitsadmin.exe is commonly used by malc0ders to download payloads . So, it is usually monitored by administrators as the very suspicious process. Why someone would want to hide something under a known suspicious process? There are so many innocent processes (like notepad, OneDrive, web browsers, etc.). But, you are probably right that blocking it will not hurt<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />You can use Firewall Hardening tool or SysHardener to check that blocking bitsadmin.exe does not prevent downloading files. Just use the below command line:[CODE]bitsadmin.exe /transfer &#039;JobName&#039; https://kcsoftwares.com/files/sumo_lite.exe C:\Users\Admin\Downloads\sumo_lite.exe&quot;[/CODE]It will download the legal (and good) SUMo update application from the developer site.Anyway, if my arguments do not convince someone, Firewall Hardening tool allows creating the firewall block rule for any program.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" />I can add some other programs to the predefined list, but FH tool is already paranoid on max settings.</blockquote>

[QUOTE="Andy Ful, post: 817810, member: 32260"] Although the idea is interesting for some other files (like notepad.exe), the bitsadmin.exe would be probably the last to block. The logic is simple. Bitsadmin.exe is commonly used by malc0ders to download payloads . So, it is usually monitored by administrators as the very suspicious process. Why someone would want to hide something under a known suspicious process? There are so many innocent processes (like notepad, OneDrive, web browsers, etc.). But, you are probably right that blocking it will not hurt:emoji_thinking: You can use Firewall Hardening tool or SysHardener to check that blocking bitsadmin.exe does not prevent downloading files. Just use the below command line: [CODE]bitsadmin.exe /transfer 'JobName' https://kcsoftwares.com/files/sumo_lite.exe C:\Users\Admin\Downloads\sumo_lite.exe"[/CODE] It will download the legal (and good) SUMo update application from the developer site. Anyway, if my arguments do not convince someone, Firewall Hardening tool allows creating the firewall block rule for any program.:giggle: I can add some other programs to the predefined list, but FH tool is already paranoid on max settings. [/QUOTE]

Verification