Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 899965" data-attributes="member: 32260">The FirewallHardening Blocklist is very customizable, so such simple solution does not apply.The ADD and&nbsp; REMOVE buttons simply save time, but usually do not create the final Blocklist.The user can remove the particular entries from the Blocklist or deactivate some other blocked entries on the Blocklist. There are 2^n possibilities to remove some LOLBins from the Blocklist with &quot;n&quot; entries. So for example, only for the &quot;Recommended H_C&quot; entries, the number of theoretical possibilities is enormous (2^45 &gt; 30 000 000 000 000). Furthermore, all entries included in &quot;Recommended H_C&quot; are also present in &quot;LOLBins&quot;.There is no need to remember how you created the final Blocklist. The most important thing follows from the FirewallHardening Log (&lt;Blocled Events&gt;). If the executable is both on the Blocklist and in the Log, then you have a problem to solve. If not, then everything is OK (nothing to remember).The Log shows all outbound connections blocked by Windows Firewall, so some events can be caused not by FirewallHardening but another security (AV, etc.).</blockquote>

[QUOTE="Andy Ful, post: 899965, member: 32260"] The FirewallHardening Blocklist is very customizable, so such simple solution does not apply. The [COLOR=rgb(0, 168, 133)][B]ADD[/B][/COLOR] and [COLOR=rgb(0, 168, 133)][B]REMOVE[/B][/COLOR] buttons simply save time, but usually do not create the final Blocklist. The user can remove the particular entries from the Blocklist or deactivate some other blocked entries on the Blocklist. There are 2^n possibilities to remove some LOLBins from the Blocklist with "n" entries. So for example, only for the "Recommended H_C" entries, the number of theoretical possibilities is enormous (2^45 > 30 000 000 000 000). Furthermore, all entries included in "Recommended H_C" are also present in "LOLBins". There is no need to remember how you created the final Blocklist. The most important thing follows from the FirewallHardening Log (<Blocled Events>). If the executable is[B][COLOR=rgb(184, 49, 47)] both[/COLOR] on the Blocklist and in the Log[/B], then you have a problem to solve. If not, then everything is OK (nothing to remember). [B]The Log shows all outbound connections blocked by Windows Firewall[/B], so some events can be caused not by FirewallHardening but another security (AV, etc.). [/QUOTE]

Verification