Advanced Plus Security Victor M Win11 DMZ PWN box configuration

[Victor M]

Here is my windows pwn box which sits in the DMZ. Designed for browsing and Office use. Lots of hardening, but expect it to not last 1 week.

 

[Bot]

Here is my windows pwn box which sits in the DMZ. Designed for browsing and Office use. Lots of hardening, but expect it to not last 1 week.

Here is my windows pwn box which sits in the DMZ. Designed for browsing and Office use. Lots of hardening, but expect it to not last 1 week.

Hey Victor M,

Sounds like an interesting setup! A "pwn box" in the DMZ for browsing and Office tasks with heavy hardening—I'm curious about the specifics. What kind of hardening measures have you implemented? Things like AppLocker, Windows Defender tweaks, network isolation, or third-party tools?

If it's expected to get compromised in under a week, that could be a great learning opportunity for the community. Feel free to share more details, screenshots, or logs if you're comfortable. We can brainstorm ways to make it last longer or discuss common attack vectors.

Stay safe out there!

Posted on 2025-09-28 at 14:30

 

[Victor M]

@Bot Everything is given in Real time security and Custom security. I mainly use WDAC default deny whitelist, plus LoLBin blacklist.

 

[Bot]

@Bot Everything is given in Real time security and Custom security. I mainly use WDAC default deny whitelist, plus LoLBin blacklist.

@Victor_M

Thanks for the details! WDAC in default deny mode with whitelisting is a solid choice for application control—it's one of the more robust ways to lock down executables on Windows. Pairing it with a LoLBin blacklist (I assume you're blocking common Living off the Land Binaries like rundll32, certutil, etc.) adds another layer against script-based attacks and lateral movement.

Have you run into any compatibility issues with Office apps or browsers under this setup? For example, does it play nice with macros or browser extensions? Also, what's your approach to updating the whitelist—manual auditing or some automation?

If you're open to it, sharing your WDAC policy XML or the LoLBin list could spark some great discussions here. Always good to see real-world hardening in action, especially in a DMZ-exposed box.

Looking forward to hearing how it holds up!

Posted on 2025-09-28 at 14:55

 

[Victor M]

@Bot LoLBin blacklist does have some unwanted side effects, like for some of the applets in old Control Panel. But nothing major. If there is a need for one of those, I unplug Ethernet, login to admin account and disable each individual blacklist temporarily, But how often does one need old Control Panel ?

Some people think that every single Windows feature must be working or else it is not 'good' security. But consider how much old legacy stuff that Windows 11 includes by default, do you really really need all features of Windows XP to work in Win 11?

 

[Victor M]

Changed default deny whitelist from WDAC to CyberLock
Added Hard_Configurator; a bit of overlapped hardening. But H_C has gui toggle switches

 

[Sampei.Nihira]

Now that I'm recovering, I spend part of my time on the PC disabling, switching from automatic to manual, and putting services and processes into efficiency mode.

It's a shame that there are no more Black Viper's Lists to follow.
They were really useful, and you could resume your work even in the following days.

P.S. It seems to me that you didn't include the browser you used.

 

[Victor M]

Black Viper

Those were the days.
I mainly use firefox.