Serious Discussion WHHLight - simplified application control for Windows Home and Pro.

Hi,

Just giving WHHL a try to see how I get on with it so still on a learning curve.

Under WDAC events I have the following repeated block:

Event Id = 3077
Local Time: 2024/03/09 12:59:39
Attempted Path = C:\Windows\SysWOW64\wbem\WMIC.exe
Parent Process = C:\Program Files (x86)\AOMEI\AOMEI Backupper\7.3.3\ABService.exe
PolicyName = UserSpace Lock
UserWriteable = false

Unsure if/how to whitelist this or prevent repeated blocks ?

Thanks
 
  • Like
  • Wow
Reactions: Berny, simmerskool, Andy Ful and 1 other person
AMD1 said:
Under WDAC events I have the following repeated block:

Event Id = 3077
Local Time: 2024/03/09 12:59:39
Attempted Path = C:\Windows\SysWOW64\wbem\WMIC.exe
Parent Process = C:\Program Files (x86)\AOMEI\AOMEI Backupper\7.3.3\ABService.exe
PolicyName = UserSpace Lock
UserWriteable = false

Unsure if/how to whitelist this or prevent repeated blocks ?

Thanks
Click to expand...

WMIC.exe is blocked by WDAC as recommended by Microsoft. It cannot be whitelisted.
WMIC.exe is/was a popular LOLBin that uses WMI infrastructure to bypass the AV and WDAC protection.
It is possible that AOMEI Backupper can work with blocked WMIC.exe, but I do not recommend using both WDAC and AOMEI.(y)
 
  • +Reputation
  • Like
Reactions: Parkinsond, vtqhtr413, ErzCrz and 1 other person
Screenshot 2024-03-09 114441.png

So I guess the same applies here, I don't see any issues using Sync though. Do you recommend not using WDAC and Sync as well?
 
  • Like
  • +Reputation
Reactions: ErzCrz, Andy Ful and simmerskool
Digmor Crusher said:
View attachment 282023
So I guess the same applies here, I don't see any issues using Sync though. Do you recommend not using WDAC and Sync as well?
Click to expand...

The block is related to the Sync taskbar and not to the synchronization processes. So the block is probably unimportant.
 
  • +Reputation
  • Like
Reactions: vtqhtr413 and simmerskool
Andy Ful said:
WMIC.exe is blocked by WDAC as recommended by Microsoft. It cannot be whitelisted.
WMIC.exe is/was a popular LOLBin that uses WMI infrastructure to bypass the AV and WDAC protection.
It is possible that AOMEI Backupper can work with blocked WMIC.exe, but I do not recommend using both WDAC and AOMEI.(y)
Click to expand...

Thanks Andy
 
  • Like
Reactions: simmerskool and Andy Ful
Still getting to grips with WHHL and recently had the following block triggered when I attempted to fix VSS via my backup program:

Event[0]:
Event Id = 865
Local Time: 2024/03/18 17:49:08
EventRecordID = 62875
Execution ProcessID = '14980' ThreadID='12148'
UserID='S-1-5-21-464157410-1965187014-947272154-1001'
Attempted Path = c:\vssfix.bat
Description: Default Level SRP block
Click to expand...

Need some help to whitelist this process if thats the recommended solution?

Fot the time being I disabled SWH and then re-enabled once I had run the Fix VSS again.

Thanks in advance for any help in this matter.
 
Last edited by a moderator:
  • Like
Reactions: Andy Ful
AMD1 said:
Need some help to whitelist this process if thats the recommended solution?
Click to expand...

You have two methods to whitelist that BAT file:
  1. Whitelist by hash.
  2. Whitelist by path.
1710787542395.png
 
  • Like
Reactions: vtqhtr413
AMD1 said:
If I attempt to browse to c:\vssfix.bat it is not there even after I enable show hidden windows folders and unsure where to browse to whitelist by hash ?
Click to expand...

That .bat is probably somewhere in your backup application.
 
  • Like
Reactions: vtqhtr413
Andy@Ful

Should not SWH WHH have its own frame like CD and H_C on the head site at Github instead of being an item IN H_C. Now they are not seen to people who go to the sight and therefore are unknown to many. Whenever i link people to the site i have to explain what to do on it because these mentioned items are sort of hidden.

That seems to me to be the logical way since they are standalone programs, or are they not!?
 
  • Like
Reactions: vtqhtr413 and Andy Ful
Azazel said:
How can Whhlight (Super Safe Setup) protect from exploits?
Click to expand...

I wrote in the WDAC help that it is robust against exploits. It is not the same as protecting from exploits. I meant that even if something would be exploited, the attack could be stopped anyway. Exploits often use temporary files dropped to the user's Temp folder, and such an attack vector can be blocked in the Super_Safe setup. One of many examples can be abusing OLE objects in MS Office documents.
The default WDAC settings allow executables dropped there, so one can consider using additional anti-exploit protection (for example tools included in the WHHLight package).
 
  • Like
  • +Reputation
  • Thanks
Reactions: vtqhtr413, simmerskool, Gandalf_The_Grey and 1 other person
pxxb1 said:
Ok.
And SWH, why does it not have its own space?
Click to expand...

Because it is logical if one does not care much about popularity.

Edit.
To make it popular, one should create a good website with a forum. But, marketing is not attractive to me.:sleep:
 
Last edited:
  • Like
  • +Reputation
  • Hundred Points
Reactions: Back3, vtqhtr413, ohranovic and 1 other person
Andy Ful said:
Because it is logical if one does not care much about popularity.

Edit.
To make it popular, one should create a good website with a forum. But, marketing is not attractive to me.:sleep:
Click to expand...

With that logic they all might as well be put in 1 frame instead of the 4 that exists now ;).
 
  • Like
Reactions: Andy Ful

You may also like...