Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 964041" data-attributes="member: 32260">I am working on some improvements in FirewallHardening.[ATTACH=full]261815[/ATTACH]<ol>
<li data-xf-list-type="ol">Added bitsadmin.exe to the BlockList. Its standard job cannot be blocked by Windows Firewall (uses BITS service). Windows Firewall can block Bitsadmin connections if it is abused by code injection and malicious code calls home by using other methods (non-BITS).&nbsp; But, I have never seen/heard about such malware - all use the standard Bitsadmin job to download malware. 
FirewallHardening will prevent the execution of bitsadmin.exe by using Exploit Protection, so both standard and abused Bitsadmin will not work.</li>
<li data-xf-list-type="ol">Added &lt;Load&gt; and &lt;Save&gt; buttons. They can be used to save, load, update the BlockList.</li>
</ol>The events related to bitsadmin.exe can be visible in FirewallHardening Log:[ATTACH=full]261817[/ATTACH]</blockquote>

[QUOTE="Andy Ful, post: 964041, member: 32260"] I am working on some improvements in FirewallHardening. [ATTACH type="full" alt="1636370782364.png"]261815[/ATTACH] [LIST=1] [*]Added bitsadmin.exe to the BlockList. Its standard job cannot be blocked by Windows Firewall (uses BITS service). Windows Firewall can block Bitsadmin connections if it is abused by code injection and malicious code calls home by using other methods (non-BITS). But, I have never seen/heard about such malware - all use the standard Bitsadmin job to download malware. [B]FirewallHardening[/B] [B]will prevent the execution of bitsadmin.exe by using Exploit Protection, so both standard and abused Bitsadmin will not work.[/B] [*]Added <Load> and <Save> buttons. They can be used to save, load, update the BlockList. [/LIST] The events related to bitsadmin.exe can be visible in FirewallHardening Log: [ATTACH type="full" alt="1636371300732.png"]261817[/ATTACH] [/QUOTE]

Verification