Advanced Plus Security security123's Security Config 2020

[ForgottenSeer 85179]

Here looks like that "msbuild.exe" is already included in Firewall-Hardening by @Andy Ful , but probably you haven't added all "LOLBins" ?

View attachment 250750

You're right. But because of problems with that configuration i don't block LOLbins: SECURITY: Complete - security123's Security Config 2020 | MalwareTips Community
So that's the reason why i manually add msbuild

@security123 - just out of curiosity, I wonder if you have a special reason for still blocking untrusted fonts?

(I guess that you must have noticed that MS has dropped untrusted fonts blocking out of its Security Baseline already a few years ago, so I think that you have some special reason...)

Thanks for reminding! Will revert it

Just a little pip from me, I like you having AdGuard installed, I think it is an important part of having a "safe" PC or Ublock-Origin.

I don't use nor need AdGuard extension for security and that's the reason why my AdGuard doesn't block any malware.
In my setup it's only for annoying YouTube ads (using only default AdGuard Anti-Ad list) and Kees' list which is as ABP list more effective then HOSTS like for NextDNS.

 

[Andy Ful]

added msbuild.exe & CVTres.exe to Andy's Firewall tool, thanks to McMcbrad:
Malware analysis - Fileless Tesla Abuses .Net Framework Processes | MalwareTips Community

The already running malware can inject code to any system executable - it can be cvtres.exe or many others, so adding it to FirewallHardening can prevent one malware but not others. Furthermore, It is not necessary because these LOLBins are run via PowerShell scripts (or by command-lines) that are already blocked by H_C (or SWH). Of course, if it does not cause problems then adding it will not hurt, too.
The attack via Windows Sandbox can be easily prevented by adding WSB extension to protected file extensions in SRP.

 

[Andy Ful]

@security123 - just out of curiosity, I wonder if you have a special reason for still blocking untrusted fonts?

(I guess that you must have noticed that MS has dropped untrusted fonts blocking out of its Security Baseline already a few years ago, so I think that you have some special reason...)

There is no need to block Untrusted Fonts in Windows 10. The font rendering is made in AppContainer. For now, this protection was not bypassed.
Dropping the "Untrusted Font Blocking" setting - Microsoft Tech Community

 

[ForgottenSeer 89360]

The already running malware can inject code to any system executable - it can be cvtres.exe or many others, so adding it to FirewallHardening can prevent one malware but not others. Furthermore, It is not necessary because these LOLBins are run via PowerShell scripts (or by command-lines) that are already blocked by H_C (or SWH). Of course, if it does not cause problems then adding it will not hurt, too.
The attack via Windows Sandbox can be easily prevented by adding WSB extension to protected file extensions in SRP.

Better they stay blocked (if system is not hardened), as attackers are copycats. They now saw msbuild.exe and cvtres.exe and I discovered already plenty of maldocs exploiting that. Apparently they've found a new vulnerability. Eventually they will move on or it will be patched, but for now this is the wave and any measures to reduce the risk won't hurt. I don't think that a process converting C++ res files to objects needs to access the network anyway. Unless it has implemented a cloud malware scanner

Building a bypass with MSBuild

By Vanja Svajcer. NEWS SUMMARY * Living-off-the-land binaries (LoLBins) continue to pose a risk to security defenders. * We analyze the usage of the Microsoft Build Engine by attackers and red team personnel. * These threats demonstrate techniques T1127 (Trusted Developer Utilities) and...

blog.talosintelligence.com

 

[ForgottenSeer 85179]

I prepare my config for 2021 and also start from scratch with my new PC.

At first step i re-build the Windows 10 - Maximum Anti-Exploit protection settings for Edge.

 

[ForgottenSeer 85179]

I removed SUMo as all my programs provide a internal update checker. Store Apps even get automatically updated.

One less program, less maintenance, less attack surface