Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 962096" data-attributes="member: 32260">The purpose of SWH and H_C_HardeningTools is to support the AV, assuming that AV provides general real-time protection, especially for *.exe and *.msi files.<ol>
<li data-xf-list-type="ol">SWH - the AV support against fileless attacks.</li>
<li data-xf-list-type="ol">ConfigureDefender - the Defender support for Network protection, MS Office, Outlook, Adobe Reader, anti-ransomware, USB disks, non-prevalent executables, and advanced threat protection.</li>
<li data-xf-list-type="ol">FirewallHardening - the AV support in the case when *.exe or *.msi malware uses LOLBins (directly or via code injections) to download payloads.</li>
<li data-xf-list-type="ol">DocumentsAntiExploit (not SWH setting) - the AV support for MS Office and Adobe Reader.</li>
<li data-xf-list-type="ol">RunBySmartscreen - on-demand support for AV and Windows SmartScreen (files without MOTW, DLL hijacking).</li>
</ol>Some AVs do not need the support of all tools. For example, Norton 360 covers all these tools except SWH.The tools: SWH, ConfigureDefender, FirewallHardening, DocumentsAntiExploit, RunBySmartscreen, are only configurators of Windows built-in features. These tools do not run as real-time security processes. So, the additional real-time protection is provided by already existent Windows features that have been enabled/configured by these tools.</blockquote>

[QUOTE="Andy Ful, post: 962096, member: 32260"] The purpose of [COLOR=rgb(0, 168, 133)]SWH and H_C_HardeningTools[/COLOR] is to support the AV, assuming that AV provides general real-time protection, especially for *.exe and *.msi files. [LIST=1] [*]SWH - the AV support against fileless attacks. [*]ConfigureDefender - the Defender support for Network protection, MS Office, Outlook, Adobe Reader, anti-ransomware, USB disks, non-prevalent executables, and advanced threat protection. [*]FirewallHardening - the AV support in the case when *.exe or *.msi malware uses LOLBins (directly or via code injections) to download payloads. [*]DocumentsAntiExploit (not SWH setting) - the AV support for MS Office and Adobe Reader. [*]RunBySmartscreen - on-demand support for AV and Windows SmartScreen (files without MOTW, DLL hijacking). [/LIST] Some AVs do not need the support of all [COLOR=rgb(0, 168, 133)][B]tools[/B][/COLOR]. For example, Norton 360 covers all these [B][COLOR=rgb(0, 168, 133)]tools[/COLOR][/B] except SWH. The [COLOR=rgb(0, 168, 133)][B]tools[/B][/COLOR]: SWH, ConfigureDefender, FirewallHardening, DocumentsAntiExploit, RunBySmartscreen, are only configurators of Windows built-in features. These[COLOR=rgb(0, 168, 133)][B] tools[/B][/COLOR] do not run as real-time security processes. So, the additional real-time protection is provided by already existent Windows features that have been enabled/configured by these [B][COLOR=rgb(0, 168, 133)]tools[/COLOR][/B]. [/QUOTE]

Verification