Serious Discussion WHHLight - simplified application control for Windows Home and Pro.

[LennyFox]

@Andy Ful I have two questions about Windows Hybrid Hardening

1. When SRP would be depreciated(rumors say with Windows12), would you consider adding hardening in WHHL using AppLocker to deny standard users running scripts?

2.Would you consider adding the option to define allow exceptions based on signature (like the WDAC wizzard offers) in WHHF (WHHFull)?

 

[Andy Ful]

@Andy Ful I have two questions about Windows Hybrid Hardening

1. When SRP would be depreciated(rumors say with Windows12), would you consider adding hardening in WHHL using AppLocker to deny standard users running scripts?

Maybe, anyway not AppLocker but rather WDAC (Administrators will be also restricted). But, we will see - the AppLocker option is also possible.
I am not sure what kind of hardening will be useful on Windows 12.

2.Would you consider adding the option to define allow exceptions based on signature (like the WDAC wizzard offers) in WHHF (WHHFull)?

Probably not. It would be easy to add such an option on Windows Pro (with PowerShell), but too complicated on Windows Home.

 

[Pat MacKnife]

Is there a way to uninstall (delete) WHH (SWH and Wdac)? i would like to use only the Firewall hardening for now.
Edit: deleting WHH in programdata seems the way . . .

 

[Andy Ful]

Is there a way to uninstall (delete) WHH (SWH and Wdac)? i would like to use only the Firewall hardening for now.
Edit: deleting WHH in programdata seems the way . . .

Use the "Restore Windows Defaults" before deleting the WindowsHybridHardeningLight_1011 executable.

 

[shmu26]

Hello everyone,
I installed WHHLight (I am new to this app) on top of Hard_Configurator, and I ended up a little confused: I did not see all the configuration options I was used to seeing in H_C. For instance, the list of blocked Sponsors. So I tried to run H_C, in order to see what is happening with the sponsors, and I got a message that I can run H_C only if I undo the blocking of admin processes. This blocking of admin processes seems to be a change introduced by the installation of WHHLight.
Am I doing something that is not recommended? What's the story with blocking Sponsors in WHHLight, is this feature now obsolete?

 

[Andy Ful]

Hello everyone,
I installed WHHLight (I am new to this app) on top of Hard_Configurator, and I ended up a little confused: I did not see all the configuration options I was used to seeing in H_C. For instance, the list of blocked Sponsors. So I tried to run H_C, in order to see what is happening with the sponsors, and I got a message that I can run H_C only if I undo the blocking of admin processes. This blocking of admin processes seems to be a change introduced by the installation of WHHLight.
Am I doing something that is not recommended? What's the story with blocking Sponsors in WHHLight, is this feature now obsolete?

You have to choose which one to use. WHHLight is half H_C (with predefined settings) and half WDAC (with predefined policy).
If you want to use H_C then :
https://malwaretips.com/threads/whh...-for-windows-home-and-pro.128274/post-1081997
Next, apply H_C settings.

 

[shmu26]

View attachment 282621

You have to choose which one to use. WHHLight is half H_C (with predefined settings) and half WDAC (with predefined policy).
If you want to use H_C then :
https://malwaretips.com/threads/whh...-for-windows-home-and-pro.128274/post-1081997
Next, apply H_C settings.

So if I want to use WHHLight, can I install it on top of H_C, and then H_C/Tools/Uninstall Hard_Configurator ?

 

[Andy Ful]

So if I want to use WHHLight, can I install it on top of H_C, and then H_C/Tools/Uninstall Hard_Configurator ?

WHHLight automatically reverts the H_C settings (but not ConfigurDefender, DocumentsAntiexploit, and FirewallHardening) and applies a setup similar to Windows_10_Basic_Recommended_Settings.
If you want to use WHHLight, you can keep H_C files or uninstall H_C. But, do not use WHHLight and H_C together.

 

[Azazel]

Hi @Andy Ful ,
Do WDAC in Whhlight with the policy you set protect from malicious drivers from being install or execute?

 

[Andy Ful]

Hi @Andy Ful ,
Do WDAC in Whhlight with the policy you set protect from malicious drivers from being install or execute?

No.
I do not think that it is necessary at home. Windows 10+ uses its own policy for that. Furthermore, Microsoft Defender can do it via the ASR rule.

 

[wat0114]

No.
I do not think that it is necessary at home. Windows 10+ uses its own policy for that. Furthermore, Microsoft Defender can do it via the ASR rule.

Sorry to press for more information on this, it's just that it made me curious, but could SRP policy be used to at least restrict in userspace? For example, adding driver file Type SYS:

Menu->SRP File Types->



EDIT

of course I understand a malicious driver will probably *maybe* be installed via some kind of script which SRP protects against already.

 

[Andy Ful]

of course I understand a malicious driver will probably *maybe* be installed via some kind of script which SRP protects against already.

SRP cannot effectively prevent the methods used in the wild to install drivers.

 

[Azazel]

I plan to add the new WDAC setting (in addition to ON and OFF settings):

View attachment 282483

View attachment 282484

When can we expect this update?

 

[Andy Ful]

When can we expect this update?

It is a plan. The NOS setting is very restrictive, so it currently blocks the WHHLight updates. I must decide between a few possibilities:

1. Whitelist my digital certificate in WHHLight.
2. Cooperate with Microsoft to allow whitelisting of the installer in ISG.
3. Add the Update option.
4. Skip the NOS setting in WHHLight.
5. Add a similar setting in the WHH full version.

 

[LennyFox]

Question @Andy Ful
When I remove the MOTW and run an executable normally in user folders, would that have the same effect as running WDAC-ISG in NOS mode?

 

[Andy Ful]

Question @Andy Ful
When I remove the MOTW and run an executable normally in user folders, would that have the same effect as running WDAC-ISG in NOS mode?

Yes.

 

[shmu26]

Is there a way to allow Windows Subsystem for Linux (WSL) when WDAP is enabled?

 

[Andy Ful]

Is there a way to allow Windows Subsystem for Linux (WSL) when WDAP is enabled?

No. Microsoft's recommended rules for WDAC block this LOLBin.

 

[Andy Ful]

WHHLight vs. VenomRAT campaign (delivered via SVG attachment)

Scams & Phishing News - Attackers Using Obfuscation Tools to Deliver Multi-Stage Malware via Invoice Phishing

Cybersecurity researchers have discovered an intricate multi-stage attack that leverages invoice-themed phishing decoys to deliver a wide range of malware such as Venom RAT, Remcos RAT, XWorm, NanoCore RAT, and a stealer that targets crypto wallets. The email messages come with Scalable Vector...

malwaretips.com

Attackers Using Obfuscation Tools to Deliver Multi-Stage Malware via Invoice Phishing

Cybersecurity experts uncover a sophisticated multi-stage attack! 🛡️ Malware including Venom RAT, Remcos RAT, and more deployed via invoice-themed ph

thehackernews.com

Attack flow (initial phase):
Phishing email with SVG attachment -------> user opens the SVG attachment -------> ZIP archive downloaded with embedded Batch script (BatCloak) -------> user opens the archive and runs the script -------> another Batch script is created and executed (ScrubCrypt) --------> two EXE payloads are decoded/dropped/executed -------> UAC bypass + VenomRat ------> .....

The default SWH settings block the attack (Batch scripts are blocked).
The attack could be also blocked at the later infection stage because the malware uses PowerShell method invocations and types blocked by Constrained Language Mode :[Text.encoding]::UTF8.getstring()
[System.Security.Cryptography.Aes]::Create()
[System.Reflection.Assembly]::Load()
New-Object System.IO.MemoryStream
New-Object System.IO.Compression.GzipStream


The full attack includes additional malicious plugins (NanoCore, XWorm, Remcos, Stealer):

 

[Practical Response]

WHHLight vs. VenomRAT campaign (delivered via SVG attachment)

Scams & Phishing News - Attackers Using Obfuscation Tools to Deliver Multi-Stage Malware via Invoice Phishing

Cybersecurity researchers have discovered an intricate multi-stage attack that leverages invoice-themed phishing decoys to deliver a wide range of malware such as Venom RAT, Remcos RAT, XWorm, NanoCore RAT, and a stealer that targets crypto wallets. The email messages come with Scalable Vector...

malwaretips.com

Attackers Using Obfuscation Tools to Deliver Multi-Stage Malware via Invoice Phishing

Cybersecurity experts uncover a sophisticated multi-stage attack! 🛡️ Malware including Venom RAT, Remcos RAT, and more deployed via invoice-themed ph

thehackernews.com

Attack flow (initial phase):
Phishing email with SVG attachment -------> user opens the SVG attachment -------> ZIP archive downloaded with embedded Batch script (BatCloak) -------> user opens the archive and runs the script -------> another Batch script is created and executed (ScrubCrypt) --------> two EXE payloads are decoded/dropped/executed -------> UAC bypass + VenomRat ------> .....

The default SWH settings block the attack (Batch scripts are blocked).
The attack could be also blocked at the later infection stage because the malware uses PowerShell method invocations and types blocked by Constrained Language Mode :[Text.encoding]::UTF8.getstring()
[System.Security.Cryptography.Aes]::Create()
[System.Reflection.Assembly]::Load()
New-Object System.IO.MemoryStream
New-Object System.IO.Compression.GzipStream


The full attack includes additional malicious plugins (NanoCore, XWorm, Remcos, Stealer):

View attachment 282702

Phishing email with SVG attachment -------> users says "Nope"

User deletes email with SVG attachment

End of attack chain.