Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1062644" data-attributes="member: 32260">It is already as strong as the strongest free setups, like for example tweaked H_C or tweaked Comodo Firewall. It is also stronger than SAC.The advantage is, that the user can choose between usable and Super_Safe setup by simply signing into the proper user account.Blocking many LOLBins would be only a little of little bit safer. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />The attacks via LOLBins can hardly do any harm. Even if something can be exploited, the LOLBins can be used to download/drop the payload (EXE, DLL, script, etc.) and execute it. But, the execution will mostly fail due to SWH / WDAC restrictions. The dangerous LOLBins are those that could bypass WDAC, but these LOLBins are already blocked in WHHLight.I could add the &lt; Block LOLBins &gt; option similar to that from H_C. I could even block LOLBins only on the account chosen by the user and only with standard rights (it is easy). It would be perfect from the security viewpoint, but many users could use this option to create overkill without sufficient reason.Anyway, the threat landscape is evolving, so I do not exclude such a possibility in the future.</blockquote>

[QUOTE="Andy Ful, post: 1062644, member: 32260"] It is already as strong as the strongest free setups, like for example tweaked H_C or tweaked Comodo Firewall. It is also stronger than SAC. The advantage is, that the user can choose between usable and Super_Safe setup by simply signing into the proper user account. Blocking many LOLBins would be only a little of little bit safer. :) The attacks via LOLBins can hardly do any harm. Even if something can be exploited, the LOLBins can be used to download/drop the payload (EXE, DLL, script, etc.) and execute it. But, the execution will mostly fail due to SWH / WDAC restrictions. The dangerous LOLBins are those that could bypass WDAC, but these LOLBins are already blocked in WHHLight. I could add the < Block LOLBins > option similar to that from H_C. I could even block LOLBins only on the account chosen by the user and only with standard rights (it is easy). It would be perfect from the security viewpoint, but many users could use this option to create overkill without sufficient reason. Anyway, the threat landscape is evolving, so I do not exclude such a possibility in the future. [/QUOTE]

Verification