Main protection is ON
(LOLBins are also blocked)
Nlock Specific Location
This is crucial, maybe AppData is also should be blocked.
- Block executionof unsigned processes on root folder
- Block execution of processes on Public Folder
- Block Execution of processes on All User Folder
- Block processes executed from Shared folder
- Block processes executed from Network Drive
- Block processes executed from USB
- Block unknown processes from Windows folder
- Block execution of unsigned processes on Downloads folder
- Block execution of unsigned processes on Windows Temp
- Block execution of unsigned processes on Temp Folder
Potentially unwanted processes
very important one, I don't use any remote management software, so I block everything here
- Block execution of any processes related to Teamviewer
- Block execution of any processes related to RealVNC
- Block execution of any processes related to UltraVNC
- Block execution of any processes related to NirSoft
- Block execution of any processes related toLogMeIn
- Block execution of any processes related to Security/Xploded
- Block execution of any processes related to Radmin
- Blck execution of PsTools Suite from Systernals
- Block processes named like "keygen" or "crack"
Restrict Windows Programs
- Block Execution of Internet Explorer
- Block execution of Cortana
- Block Execution of Windows Registry Editor
- Bloc execution of UAC control Settings
Smart Powershell & CMD Rules
Maybe I should block more powershell commands. I'm not sure because I'm not familiar with powershell.
- Block "ExecutionPolicy Bypass" on command-line (powershell)
Block Script Execution
- Block execution of .ps1 (Powershell) scripts
- Block ecxecution of .jar scripts
- Block execution of .msc outside System Folder
- Block execution of .cpl pplets outside System Folder
Other Useful Block Rules
- Block any processes executed from mstsc (Remote Dektop)
- Block any processes executed from runtimebroker.exe
- Block any processes executed from java.exe
- Block any processes executed from javaw.exe
- Block execution of javaw\java.exe
- Block regedit.exe from silently loading .reg scripts
- Block reg.exe fro hijacking Registry startup entries
UAC bypass Mitigation Rules
- Block reg.exe from disabling UAC
- Block known and possible UAC.bypass attempts
- Block "tricks" used to run UAC-bypass system processes
