Here is a new v1.4 (pre-release) (test14):
http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test14.exe
*** Please do not share the download link, we will delete it when we'll release the official v1.4 ***
So far this is what's new compared to the previous pre-release:
+ Block execution of C Sharp compiler (csc.exe) (unchecked by default)
+ Block execution of Visual Basic compiler (vbc.exe) (unchecked by default)
+ Block suspicious processes executed from Rundll32 (unchecked by default)
+ On "Exclusions Helper" GUI do not add the exclusion rule if is already present
+ Added LibreOffice and Kingsoft WPS Office on "Anti-Exploit" tab
+ Block processes executed from C Sharp compiler (csc.exe) (unchecked by default)
+ Block processes executed from Visual Basic compiler (vbc.exe) (unchecked by default)
+ Fixed some false positives
To install this pre-release, first uninstall the old one.
Here is a new video of OSArmor protecting Kingsoft WPS Office:
Block WPS Office Exploit Payloads with OSArmor
@Windows_Security
Your custom rules look good and solid =)
I think you included all needed MS Windows update parent processes, but will need to verify of course.
About the rules for "Block Medium IL (often attacked) system process launch from user folders" they are good, you may get a few FPs within some installers\uninstallers, i.e SlimJet browser (simple to fix via exclusions or disabling protections anyway).
You should include these two MS-related trusted signers in the exclusions:
Microsoft Update
Microsoft Windows Publisher
@Andy Ful
I added that *filepath vars to match the exact file path, however we can discuss if they are useful and in case leave only the process\parentprocess vars.
@Telos
Both reported FPs should be fixed now (test14), please confirm.
@DavidLMO
Will discuss to remove the "Protect" word in "Anti-Exploit" tab checkboxes.
@Prorootect
There is no need to protect (via the Anti-Exploit module) other security software and similar.
We want to only protect web browsers, pdf readers, office suites, and similar apps.
All Firefox versions should be supported by "Protect Mozilla Firefox", but will have to check.
K-Meleon is not digitally signed and I prefer to support only digitally signed apps.
Added SlimJet on test14 build.
@Evjl's Rain
The "Anti-Exploit" module uses different types of rules and additional checks compared to "Custom Block-Rules".
If you want to use "Custom Block-Rules" to block child processes of SlimJet, you can do that like this:
Code:
[%PARENTPROCESS%: C:\Program Files\Slimjet\slimjet.exe]
Then on Exclusions, make sure to allow it to run other programs in Program Files folder (just an example):
Code:
[%PARENTPROCESS%: C:\Program Files\Slimjet\slimjet.exe] [%PROCESS%: C:\Program Files\*]
[%PARENTPROCESS%: C:\Program Files\Slimjet\slimjet.exe] [%PROCESS%: C:\Program Files (x86)\*]
There may be other FPs that may need to be addressed, but can be handled via Exclusions
I will probably make some tutorials soon.
@Stas
Added MPC, KMPlayer, GOMPlayer, LibreOffice, WPS Office, PDF-XChange Editor, and others.
