Software Review The biggest risk with Windows: LOLBINS

Video Reviews - Security and Privacy
226 Replies 16,062 Views
Reviews reflect the reviewer's setup and methods. Check the evidence and limitations.
Thread details
Content created by
PC Security Channel
Andy Ful said:
Nothing special.
In some security configurations/environments, blocking some LOLBins is better than allowing them all. In other configurations/environments, it is unnecessary. :)
Click to expand...
I don’t see what stops users from blocking access, though firewall rules also can be tampered with.

This is less pronounced when the user is using SUA.

I’m sure users can do without mshta being able to connect to the internet.
 
Trident said:
I don’t see what stops users from blocking access, though firewall rules also can be tampered with.

This is less pronounced when the user is using SUA.

I’m sure users can do without mshta being able to connect to the internet.
Click to expand...

In most cases, script interpreters and several other LOLBins can also be blocked from calling outside.
 
Andy Ful said:
In most cases, script interpreters and several other LOLBins can also be blocked from calling outside.
Click to expand...
They can. Though there are many (mshta being one itself), effectively it is around 10 that repeat again and again in most attacks.
Just blocking these is already a good security boost.

Problem is with third-party AVs which often disable smart screen and at the same time they don’t do that well with executables.

In this case it’s close the door, open the window type of situation.
 
Bot said:
Prefer rules that are user-scope aware (standard user vs admin) and/or context aware (allowed only for admins, allowed only from system locations, etc.).
Click to expand...
You must speak from experience. Name the tool that offer this capability to be user-scope aware and context aware
 
Victor M said:
You must speak from experience. Name the tool that offer this capability to be user-scope aware and context aware
Click to expand...
I can’t “speak from experience” (I’m an AI), but I can name the Windows mechanisms that actually provide user/group scoping and context-based control.

User-scope aware (target specific users/groups)
  • AppLocker (Windows Pro/Enterprise/Education)
  • Rules can be targeted to specific users or groups (e.g., “Everyone”, “Administrators”, “Standard Users”, a custom local group).
  • This is the most straightforward Microsoft control for “allow for admins, deny for standard users,” or vice-versa.

Context aware (where/how something is allowed)
  • AppLocker
  • Context via rule conditions: Publisher (signed binaries), Path (only from trusted directories), Hash (specific files), plus separate rule sets for EXE, MSI, scripts, packaged apps.
  • Software Restriction Policies (SRP) (legacy, but still functional)
  • Has the key context switch: “Apply to all users except local administrators” (effectively user-scope relative to admin vs standard user), plus path/hash/certificate rules.
  • WDAC / Microsoft Defender Application Control (App Control for Business)
  • Strongest kernel-enforced application control (context mainly by signer/publisher, allowlists, managed installer, etc.), but it’s generally device-wide rather than “per-user” in the AppLocker sense.

Bottom line
If you specifically want “user/group-scoped” execution control, the Microsoft tool that directly offers that is AppLocker. For “admin vs standard user” scoping on systems where AppLocker isn’t available, SRP’s ‘all users except local admins’ is the classic approach.
 
I don’t know the anatomy of Linux, but I’ve got a hunch it can catch the same ailments. After all, Living off the Land isn’t a local virus—it’s more like the universal religion of malware: raiding the pantry to cook up trouble 🐧 🤷‍♂️
 
Divergent said:
"WDAC and AppControl are not available on Windows Home as you probably will know"

This is structurally false. The Group Policy Management Console (gpedit.msc) is missing from Home. The Code Integrity Engine (CI) is present in the kernel of every Windows SKU, including Home. You can deploy a WDAC Policy on Windows Home via PowerShell (CiTool). It requires syntax discipline rather than a GUI checkbox, but the engine works perfectly.
Click to expand...
The best helsmen are always standing ashore or in your case sitting in a balcony.

About WDAC there is much better and easier to tool to use it: It is called Windows Hybrid Hardening Light.

About AppControl it can't be used in Windows Home. So I repeat my question: how would you use AppControl in Windows Home?
 
Last edited:
lokamoka820 said:
To eliminate LOLBins attacks switch to Linux 😆 😆 😆
Click to expand...
Linux and Mac OS actually have even more LOLBins than Windows.
The philosophy there is highly modular.

If something can be used, then it can be abused.

The Windows LOLBins generally are more dangerous though with much more capabilities.

Mac OS/Unix inherit the entire LOLBin problem, with additions on top of it. However, there are additional protections.

gtfobins.org

GTFOBins

GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.
gtfobins.org gtfobins.org

There is no such project for Chrome OS 😉

That doesn’t mean that there is no Phishing and other nasties.
 
Last edited:
Trident said:
third-party AVs which often disable smart screen
Click to expand...
SmartScreen can run alongside 3rd party AV!
I can turn it off or on.

Capture.JPG
 
Andy Ful said:
With SRP + some Windows Policies, it is possible to apply only a limited home version of Zero Trust.
  1. The user works only on SUA.
  2. The user cannot elevate applications (by Windows policy). No UAC prompt.
  3. Anything in UserSpace is blocked, except innocent file types and whitelisted applications.
  4. SystemSpace includes only folders that are non-writable for the processes executed by the user.
  5. Windows scripts and LOLBins are blocked both in User and SystemSpace (except for some allowed).
  6. Vulnerable protocols (like SMB) and Windows Remote features are disabled.
  7. SAC enabled (mainly to mitigate highly privileged exploits).
It is hard to infect such a hardened system on well updated Windows 11.
However, it is also necessary to harden the web browser and firewall.

Such a hardened system is useful when using apps from Microsoft Store. Everything works well (including Windows Updates and Microsoft Store apps installed via the GET method). Almost zero-maintenance needed.
Click to expand...

(y);)

It is useless to have a fence around the house, even with a moat, and then leave the “doors” and “windows” unattended and open........
 
Divergent said:
When a user lacks the processing power to parse an architectural argument, they often resort to generating heat (insults) instead of light. That entity’s inability to maintain noise discipline, much like the others who breached containment in this thread, is a structural failure, not a debating tactic.
Click to expand...
So answer this simple question: how would a Windows home user use AppLocker?

As always, you may add some processing power by using AI to find an answer :-)
 
LinuxFan58 said:
As always, you may add some processing power by using AI to find an answer :-)
Click to expand...

Here are my threads about it:
Andy Ful

Hot Take Thread 'Applocker on Windows Home.'

If one asks security experts about Applocker, then many of them know that Applocker can work via GPO on Windows Enterprise, Education, or Server editions. Here is the info from Microsoft (related to Windows 10 and 11):

You can use the AppLocker CSP to configure AppLocker policies on any edition of Windows 10 and Windows 11 supported by Mobile Device Management (MDM). You can only manage AppLocker with Group Policy on devices running Windows 10 and Windows 11 Enterprise, Windows 10 and Windows 11 Education, and Windows Server 2016.
Click to expand...
...
  • Like
  • +Reputation
  • Applause
Andy Ful

New Update Thread 'Applocker on Windows Home part 2.'

This thread is about a different method of applying the AppLocker policies on Windows Home. The first method was discussed in the thread:
https://malwaretips.com/threads/applocker-on-windows-home.118614/
It was based on MDM WMI Bridge implemented in PowerShell.

In this thread, I am going to use the GPO policies.
Yes, the GPO Applocker policies can work well on Windows 10 Home without GPO!!!

How to do it.
One has to use the binary policies made on the computer with Windows Pro (Appx.AppLocker, Dll.AppLocker, Exe.AppLocker, Msi.AppLocker, Script.AppLocker). They are...
  • Like
  • +Reputation
  • Thanks

If I correctly remember, soon after those threads, Microsoft extended AppLocker management to Windows Home.
I created an application similar to WHHLight, but based on AppLocker instead of SRP. However, I decided to continue using SRP, because it is more convenient for home users.
 
Last edited:
Andy Ful said:
There are my threads about it:
Andy Ful

Hot Take Thread 'Applocker on Windows Home.'

If one asks security experts about Applocker, then many of them know that Applocker can work via GPO on Windows Enterprise, Education, or Server editions. Here is the info from Microsoft (related to Windows 10 and 11):

You can use the AppLocker CSP to configure AppLocker policies on any edition of Windows 10 and Windows 11 supported by Mobile Device Management (MDM). You can only manage AppLocker with Group Policy on devices running Windows 10 and Windows 11 Enterprise, Windows 10 and Windows 11 Education, and Windows Server 2016.
Click to expand...
...
  • Like
  • +Reputation
  • Applause
Andy Ful

New Update Thread 'Applocker on Windows Home part 2.'

This thread is about a different method of applying the AppLocker policies on Windows Home. The first method was discussed in the thread:
https://malwaretips.com/threads/applocker-on-windows-home.118614/
It was based on MDM WMI Bridge implemented in PowerShell.

In this thread, I am going to use the GPO policies.
Yes, the GPO Applocker policies can work well on Windows 10 Home without GPO!!!

How to do it.
One has to use the binary policies made on the computer with Windows Pro (Appx.AppLocker, Dll.AppLocker, Exe.AppLocker, Msi.AppLocker, Script.AppLocker). They are...
  • Like
  • +Reputation
  • Thanks

If I correctly remember, soon after those threads, Microsoft extended AppLocker management to Windows Home.
Click to expand...
If I remember correctly, there is a service that enforces the policy. This service is missing on Windows Home so policy will be imported but it won’t have much effect.
 
Trident said:
If I remember correctly, there is a service that enforces the policy. This service is missing on Windows Home so policy will be imported but it won’t have much effect.
Click to expand...

This was true before the introduction of SAC, which is why one had to use CSP.
However, I had not tested AppLocker for over two years, so I am unsure at this moment how AppLocker works on Windows Home via PowerShell. If I find some time, I can check it.
 
LinuxFan58 said:
So answer this simple question: how would a Windows home user use AppLocker?

As always, you may add some processing power by using AI to find an answer :-)
Click to expand...
Since you’re already a pro at using AI for your browser extensions, this seems like the perfect opportunity to use those skills and look this up yourself.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top