Advanced Plus Security Shmu26 Config in 2018

[shmu26]

My rule was not quite right. It was missing the asterisk after automation
But anyways, they say that powershell can launch, even if the dll is blocked. Check out that post over on the other forum. This discussion is a little over my head

 

[Andy Ful]

My rule was not quite right. It was missing the asterisk after automation
But anyways, they say that powershell can launch, even if the dll is blocked. Check out that post over on the other forum. This discussion is a little over my head

Your rule:
*>*System.Management.Automation.dll
was correct to block the System.Management.Automation.dll from loading by any program.
The rule proposed on WildersSecurity forum:
*powershell.exe>*System.Management.Automation*.dll
was correct to block both System.Management.Automation.dll and System.Management.Automation.ni.dll from loading only by powershell.exe.
The correct rule to block both DLLs from loading by any program (like fake powershell) is:
*>*System.Management.Automation*.dll
I repeated the test with all the above rules and still, powershell.exe can be executed on my system.
.
The executable powershell.exe cannot be run on my Windows version (Windows 10 Pro FCU 64-bit) when the DLL in the below location is properly blocked:
c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
You can easily check this by yourself after renaming the above DLL (for example to !!!System.Management.Automation.dll).

 

[Andy Ful]

The test on WildersSecurity forum:
MemProtect - Support & Discussion
has nothing to do with blocking System.Management.Automation.dll .
In fact, only System.Management.Automation.ni.dll was blocked - that can be seen from the log at the end of the post. This DLL is the native image (compiled version) of System.Management.Automation.dll .
.
I am not sure, but it seems that the test on Wilderssecurity forum
could be made on another Windows version - my test was made on Windows 10 FCU 64-bit.
It may be that on some Windows versions it is sufficient to block the System.Management.Automation.ni.dll (native image) to disable powershell.exe . Still, that says nothing about MemProtect ability to block .NET DLLs.
Blocking System.Management.Automation.ni.dll is nothing special, any DLL blocking soft can do it (SRP, SOB, etc.).

 

[shmu26]

The test on WildersSecurity forum:
MemProtect - Support & Discussion
has nothing to do with blocking System.Management.Automation.dll .
In fact, only System.Management.Automation.ni.dll was blocked - that can be seen from the log at the end of the post. This DLL is the native image (compiled version) of System.Management.Automation.dll .
.
I am not sure, but it seems that the test on Wilderssecurity forum
could be made on another Windows version - my test was made on Windows 10 FCU 64-bit.
It may be that on some Windows versions it is sufficient to block the System.Management.Automation.ni.dll (native image) to disable powershell.exe . Still, that says nothing about MemProtect ability to block .NET DLLs.
Blocking System.Management.Automation.ni.dll is nothing special, any DLL blocking soft can do it (SRP, SOB, etc.).

Andy, you need to get on the other forum and talk to those people.

 

[Deletedmessiah]

Memprotect and Pumpernickel/Fides, how long can you use the demo? What limitations is there in demo versions?

 

[Andy Ful]

Andy, you need to get on the other forum and talk to those people.

Maybe you are right, but now I am working on Hard_Configurator and WDDS applications, so have no time for discussions on 2 forums.

 

[shmu26]

Disabled: Windows Defender
Added: Symantec Endpoint Protection Client

 

[illumination]

Disabled: Windows Defender
Added: Symantec Endpoint Protection Client

You should share your thoughts after a bit of time with it. For my family environment, it's perfect.

 

[shmu26]

Memprotect and Pumpernickel/Fides, how long can you use the demo? What limitations is there in demo versions?

Sorry, I don't know why I didn't see your post before.
The demo needs to be reinstalled every year. That means reinstalling the driver, which is no big deal once you know how to do it , but your config file stays the same like before.
The limitation in demo is the number of characters in the config file. You need to write your rules tersely, and there is a limit how much you can squeeze in. But you can do a lot.

 

[Deletedmessiah]

Sorry, I don't know why I didn't see your post before.
The demo needs to be reinstalled every year. That means reinstalling the driver, which is no big deal once you know how to do it , but your config file stays the same like before.
The limitation in demo is the number of characters in the config file. You need to write your rules tersely, and there is a limit how much you can squeeze in. But you can do a lot.

Thanks! And you answered all of it two days ago on Windows Security's config

 

[509322]

Your rule:
*>*System.Management.Automation.dll
was correct to block the System.Management.Automation.dll from loading by any program.
The rule proposed on WildersSecurity forum:
*powershell.exe>*System.Management.Automation*.dll
was correct to block both System.Management.Automation.dll and System.Management.Automation.ni.dll from loading only by powershell.exe.
The correct rule to block both DLLs from loading by any program (like fake powershell) is:
*>*System.Management.Automation*.dll
I repeated the test with all the above rules and still, powershell.exe can be executed on my system.
.
The executable powershell.exe cannot be run on my Windows version (Windows 10 Pro FCU 64-bit) when the DLL in the below location is properly blocked:
c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
You can easily check this by yourself after renaming the above DLL (for example to !!!System.Management.Automation.dll).

The test on WildersSecurity forum:
MemProtect - Support & Discussion
has nothing to do with blocking System.Management.Automation.dll .
In fact, only System.Management.Automation.ni.dll was blocked - that can be seen from the log at the end of the post. This DLL is the native image (compiled version) of System.Management.Automation.dll .
.
I am not sure, but it seems that the test on Wilderssecurity forum
could be made on another Windows version - my test was made on Windows 10 FCU 64-bit.
It may be that on some Windows versions it is sufficient to block the System.Management.Automation.ni.dll (native image) to disable powershell.exe . Still, that says nothing about MemProtect ability to block .NET DLLs.
Blocking System.Management.Automation.ni.dll is nothing special, any DLL blocking soft can do it (SRP, SOB, etc.).

It is best to use block rule: *System.Management.Automation*

to avoid any unintentionally missed loading - especially given the fact that Microsoft is continually changing PowerShell and never tells anyone about the changes until it is way too little, way too late = 2 years later and there has been a major comprise due to Microsoft's undocumented this-or-that in PowerShell made 2 years prior and that it negligently didn't notify anyone about.

Microsoft is a menace to Windows security.

 

[ForgottenSeer 72227]

Disabled: Windows Defender
Added: Symantec Endpoint Protection Client

I too would like to hear what you think of it. When I tried it not long ago, I really liked it! If I didn't have a free licence for SHP I would have most probably purchased SPEC.

 

[shmu26]

I too would like to hear what you think of it. When I tried it not long ago, I really liked it! If I didn't have a free licence for SHP, I wold have most probably purchased SPEC.

I can say that it runs super light, it's a real pleasure. And it is quite configurable to various levels of protection. As for how well it actually protects, for that we need to ask the testers.
I am running it together with Software Restriction Policy (managed by Andy Ful's Hard_Configurator).

 

[illumination]

I can say that it runs super light, it's a real pleasure. And it is quite configurable to various levels of protection. As for how well it actually protects, for that we need to ask the testers.
I am running it together with Software Restriction Policy (managed by Andy Ful's Hard_Configurator).

If you're disabling vulnerable processes with SRP combined with SEPC, you're good.

It is super light and bloat free.

 

[Sunshine-boy]

It is super light and bloat free.

also free.

 

[shmu26]

I updated to Win 10 1809, played around with a few AVs.
Settled on Windows Defender -- it runs very light on 1809.
Current security config:
Windows Defender with Attack surface reduction (ConfigureDefender)
Software Restriction Policy (Hard_Configurator)
Standard user account

 

[509322]

I updated to Win 10 1809, played around with a few AVs.
Settled on Windows Defender -- it runs very light on 1809.
Current security config:
Windows Defender with Attack surface reduction (ConfigureDefender)
Software Restriction Policy (Hard_Configurator)
Standard user account

Make a backup with Windows Backup or Macrium so you don't have to mess with configuring it again. Configuring a SUA is a pain (and the reason a lot of people won't do it, and therefore, won't even bother to create a SUA - if they even know that SUA exists).

The above is the exact config I am using on my personal laptop. Exactly. With SRP one simply does not need the overhead of AV\IS.

 

[Windows_Security]

Make a backup with Windows Backup or Macrium so you don't have to mess with configuring it again. Configuring a SUA is a pain (and the reason a lot of people won't do it, and therefore, won't even bother to create a SUA - if they even know that SUA exists).

The above is the exact config I am using on my personal laptop. Exactly. With SRP one simply does not need the overhead of AV\IS.

??? So no AppGuard

 

[509322]

??? So no AppGuard

I have 5 PCs, an unknown number of VMs, and multiple swap-out drives (clone-switch system). I have everything imaginable...

but in this case I wanted to try a SUA. Already it is causing problems with softs and is likely "NFL" = Not For Long.

 

[shmu26]

I have realized that many if not most of the PC issues that I struggle with are related directly or indirectly to my security solutions. Getting tired of that.
I am on a health-food diet: vanilla Windows Defender.