Resource icon

Hawk Eye Defender Hardening Console + Deep Firewall Control

Trident

From Hawk Eye
Thread author
Verified
Top Poster
Developer
Well-known
Feb 7, 2023
4,327
28,025
5,289
hea-p.com
Trident submitted a new resource:

Hawk Eye Defender Hardening Console + Deep Firewall Control - Harden your built in defenses. Easy.

Harden your built in defenses with ease, with Defender Hardening Console + Deep Firewall Control.
  • Remove Persistent Malware
  • Improve your security posture
  • Block untrusted binaries from connecting to the internet

All from an easy-to-use console.

Enjoy organised and straight-forward interface


View attachment 294095

Manage Microsoft Defender...

Read more about this resource...
 
1767120426447.png
 
Kaspersky did not let me install this. Paused Kaspersky and installed it. Did the first scan, and Helios flagged Kaspersky, Microsoft Edge Updater, Google Chrome, Google Updater, Macrium, Microsoft Defender, NordVPN, Realtek Audio, Everything Search and few more as threats. :oops:
 
Kaspersky did not let me install this. Paused Kaspersky and installed it. Did the first scan, and Helios flagged Kaspersky, Microsoft Edge Updater, Google Chrome, Google Updater, Macrium, Microsoft Defender, NordVPN, Realtek Audio, Everything Search and few more as threats. :oops:
This sounds like permission/connection problem. I’ll have a look after New Year.
 
And the installer is now ready as well.

1769732345756.png


The installer also works as a weekly silent updater and uninstaller (a very clean one) removing the product, the one single registry entry that it writes, all related files and firewall rules.

The installation process creates a desktop shortcut, checks the system for the necessary components and deploys them if missing and downloads the newest application files.

Note: Under the new architecture the only web view module that the application loads must be Microsoft-signed.
This eliminates the opportunity for dll hijacking.

https://deploy.hea-p.com/executable/DHCInstaller.exe
 
What's the system resource impact?
Hey, I am glad to see you interested.

At the moment the software is transforming to real-time protection software.

I take the values from Task Manager (it is a standard to use Microsoft-official utilities, rather than third-party).

Main service memory varies between 4 and 11 MB. CPU Usage for the main service does not exceed 2%.
The UI is using around 150 MB.

Alerts appear with animations in around 150 milliseconds average.

Disk is used to write caches and logging. Disk usage doesn't increase 0.1%.

The total software size at the moment is less than 10 MB.

I suggest you wait for HEAT.
 
Is this product recommended to enhance Microsoft Defender and add rules to its firewall? Cost? Download? Trial? Do you recommend this for Home use? Thanks
The software is free and a free version will always exist.

Yes, the purpose of Defender Hardening Console is to help boost the native Windows Security. This includes Defender and Firewall settings.
 

. Microsoft Defender + Hawkeye Hardening Console — 9.5/10

You’ve turned Defender into a near‑enterprise‑grade AV:

  • ASR rules
  • SmartScreen
  • Controlled Folder Access
  • Network protection
  • Cloud heuristics
  • Attack surface lockdown
This is the correct way to run Defender: hardened, not default. This is what Microsoft chat claims
 
Forgive me if this has been posted... Helios — The Transformation

Some of their statements made on their website are very revealing, and sound like game changers:

From Reactive to Proactive
The old Helios hardened your system and hoped for the best. That era is over. The new Helios hunts threats before they land, kills exfiltration before it starts, and undoes damage before you notice it.

The security industry reacts. We prevent.

The Firewall
That Thinks
Not a port blocker. Not a rule list. A decision engine that understands trust at a molecular level. Every process gets interrogated. Every connection gets judged. Nothing leaves your machine without earning the right.

600

600 indicators.​

The firewall analyses each process across 600 distinct trust indicators — file provenance, signature chains, behavioural patterns, parent lineage, reputation signals — organised into 27 compound heuristic groups. It doesn't just look at what a process is. It understands what a process means.

600trust indicators per process
Wait — What Are Heuristics?
In plain English: heuristics are educated guesses backed by evidence. Instead of matching a known threat from a list (which only catches yesterday's attacks), heuristic analysis looks at how something behaves and scores it. Think of it like a border agent who doesn't just check passports — they read body language, notice inconsistencies, and flag suspicious patterns. That's what our 27 heuristic groups do to every process on your machine.

Connection reputation.​

Every outbound connection is scored using our own proprietary heuristics plus intelligence feeds from the big dogs. Unknown server in a suspicious ASN trying to phone home? Blocked. Signed Microsoft binary reaching its known update endpoint? Cleared instantly. The result? Exfiltration doesn't happen.
The result? Potential for data exfiltration — eliminated.
Three Engines.

Zero Mercy.
Cloud reputation is powerful but it's not enough. We're deploying three local antivirus engines — each with a different philosophy, each deadly on its own. Together with Nano Power and the cloud engine? Nothing survives.


Codename
Graphite
The softcore engine. Light, fast, low friction. Catches the obvious and the near-obvious with surgical precision. Minimal false positives.


Codename
Diamond
The balanced powerhouse. Harder than Graphite. Cuts deeper. The most precious engine — where precision meets aggression. The sweet spot.


Codename
Obsidian
Maximum aggression. Zero tolerance. Obsidian digs deeper than anything else in the stack — every heuristic cranked to the edge, every threshold lowered, every suspicion acted on. It doesn't assume guilt. It just doesn't give the benefit of the doubt. When the situation calls for scorched earth — this is it.

Behavioral monitoring, tracking, and correlation. Not just watching — understanding. And when something crosses the line, we don't just stop it. We roll it back.

Behavioral correlation.​

If a process behaves suspiciously — memory injection, privilege escalation, unusual file access patterns — Helios correlates the behavior chain and undoes most of its actions. Dropped files? Gone. Registry changes? Reversed. Connections? Severed.

Connection-aware blocking.​

If we don't like the connections that cuteKitty.exe makes — every file, it dropped gets blocked. Every process it spawned gets terminated. The entire chain of compromise, dissolved.
 
Thanks for reposting, indeed, the firewall thinks but now it is more than 600 indicators and they are across 47 vectors.
This is the proprietary intelligence, in addition to that the software is integrated within a security provider’s network so domains and IPs are looked up. I am currently in talks with Bitdefender as well but we’ll see what will come out of that. I am only interested in cloud-based solutions.

So the way it works is, as soon as a process is not to HEAT liking, behavioural monitor starts. The data is recorded in a database (as well as in memory).

When connections appear malicious, the behavioural monitor performs rollback.

When 3 threats are detected in rapid succession and they appear to be related (for example one is in Desktop\1, the other one is in Desktop\2), the software launches Emergency Response for a deep and aggressive cleanup (taking into account the time of the 1st and last incident).

The software is integrated with Helios Web Marshall as well. When you open a suspicious site that is not on the curated list, the software amongst other things launches backup. If your backup is on a removable drive, you are advised to connect and disconnect after. There will be cloud backup at a later stage.

For the backup, Active Sense detects crucial directories, but you can also manually manage directories as well as set schedule per directory. For example I (because I have been using HEAT for the past 3 months already), like my source code dirs backed up 4 times a day. Probably hardly a surprise 😁

When you download remote support tools, you are advised of remote support scam, when you download an optimiser or other PUA-like software, there is clear guidance what you can expect (and what you shouldn’t) from this type of software.

This is amongst other protections and automated Defender settings management as well.

I’ve also recently finished building a platform that allows me to write intelligence for the software easily. The intelligence is distributed as Platform Overlay Modules, updated by POMCareAgent.exe. There are currently 15 Platform Overlay Modules.
 
Last edited:
And needless to say is that the following will never make its way into any of my software:
-Ads
-Exaggerated claims: it is clearly mentioned in the tuneup module that Active Tune (which terminates rubbish includimg OEM bloatware) is the only one likely to provide noticeable benefits. Users are advised that disk cleanup will not speed their system up unless they are low on disk space
-Needless popups
-Features that are unlikely to benefit anyone, added just because someone else has them.
 
Thanks for reposting, indeed, the firewall thinks but now it is more than 600 indicators and they are across 47 vectors.
This is the proprietary intelligence, in addition to that the software is integrated within a security provider’s network so domains and IPs are looked up. I am currently in talks with Bitdefender as well but we’ll see what will come out of that. I am only interested in cloud-based solutions.

So the way it works is, as soon as a process is not to HEAT liking, behavioural monitor starts. The data is recorded in a database (as well as in memory).

When connections appear malicious, the behavioural monitor performs rollback.

When 3 threats are detected in rapid succession and they appear to be related (for example one is in Desktop\1, the other one is in Desktop\2), the software launches Emergency Response for a deep and aggressive cleanup (taking into account the time of the 1st and last incident).

The software is integrated with Helios Web Marshall as well. When you open a suspicious site that is not on the curated list, the software amongst other things launches backup. If your backup is on a removable drive, you are advised to connect and disconnect after. There will be cloud backup at a later stage.

For the backup, Active Sense detects crucial directories, but you can also manually manage directories as well as set schedule per directory. For example I (because I have been using HEAT for the past 3 months already), like my source code dirs backed up 4 times a day. Probably hardly a surprise 😁

When you download remote support tools, you are advised of remote support scam, when you download an optimiser or other PUA-like software, there is clear guidance what you can expect (and what you shouldn’t) from this type of software.

This is amongst other protections and automated Defender settings management as well.

I’ve also recently finished building a platform that allows me to write intelligence for the software easily. The intelligence is distributed as Platform Overlay Modules, updated by POMCareAgent.exe. There are currently 15 Platform Overlay Modules.
And don't forget it's OK to get paid for your labor, just like Macrium.