Serious Discussion WHHLight - simplified application control for Windows Home and Pro.

[dronefox1166]

And when I lock MinimalFirewall, why this error ? SRP Policy Scope, High or Standard, the same...

 

[dronefox1166]

For UniGetUI :
even if I have disbaled or desactivated all powershell lines (4) HC_Recommanded in FirewallHardening.

 

[dronefox1166]

after that I stop intervening for personal reasons, awareness...

 

[Andy Ful]

Spoiler: FileFix attack

View attachment 289251

Ha. Ha.
Osprey thinks that blocking animated .gif from the researcher's article (warns how this attack may look like), can save people against attacks in the wild.
Does it also block the .gif examples of ClickFix attacks?

 

[Andy Ful]

For UniGetUI :
even if I have disbaled or desactivated all powershell lines (4) HC_Recommanded in FirewallHardening.


View attachment 289253

Interesting. Is it present when you update UniGetUI or when you update one of the applications?
I never saw this strange error. Does it happen after switching OFF WHHLight (WDAC = OFF, SWH = OFF) and removing FirewallHardening restrictions (Windows restart required)?

 

[Andy Ful]

View attachment 289252 And when I lock MinimalFirewall, why this error ? SRP Policy Scope, High or Standard, the same...

You must look into the SWH Logs (and WDAC logs if WDAC = ON).
I am lost with the tools you use. What is a MinimalFirewall?

 

[Andy Ful]

dronefox1166,

I have a proposition. Disable all my applications and experiment with other tools until you establish the right config. Use it for a month to see that it works without issues (also issues related to software updates). Next, apply WHHLight (but no ConfigureDefender and FirewallHardening) and use/adjust the settings for a month. If everything will work flawlessly, we will think about applying additional security layers.
Currently, your setup is too complex, and I am not sure what is happening. Complex config requires analysis of Log events.

 

[piquiteco]

Ha. Ha.
Does it also block the .gif examples of ClickFix attacks?

Of course not. Osprey only blocks URLs through the browser. I accessed the URL you posted with the .gif as an example just out of curiosity, knowing it was a demonstration of how a ClickFix attack works. What I found funny was that when you click on the URL and the browser loads the page, Osprey doesn't block the gif immediately; there's a delay, and you can still see the gif running when the researcher clicks on the blue button to open the file in Explorer, and that's when Osprey blocks the gif URL. Obviously, it's just a coincidence. Your tools block these ClickFix attacks because they open PowerShell. At least on my computer and laptop, PowerShell is blocked by the Windows Hybrid Hardening Light tool.

 

[Andy Ful]

Post updated.

WHHLight package + UniGetUI

1. UniGetUI is set to use only WinGet. Chocolatey and others are disabled (may use PowerShell scripts).
   
   
   
2. WHHLight, ConfigureDefender, and FirewallHardening set to max settings.

UniGetUI works well and can update without any issues. Most applications update well, except for the following:

• applications that use Windows scripts (can be blocked by SWH restrictions or FirewallHardening ),
• applications that use LOLBins from the Microsoft Recommended BlockList (Wmic, Mshta, etc. are blocked by WDAC),
• not so popular applications (can be blocked by Defender ASR rule or WDAC ISG).

Most blocks can be avoided when releasing WDAC restrictions (by using the default WDAC Whitelist).

For example, from my 18 applications, UniGetUI successfully updated 17. One update failed (WinSCP) due to WDAC ISG - in max settings, the WDAC Whitelist is empty. This block could be avoided when using the default WDAC Whitelist.

******** WDAC blocked events for EXE and DLL files ********
***********************************************************

Event[0]:
Event Id = 3077
Local Time: 2025/06/26 15:47:42
Attempted Path = %UserProfile%\AppData\Local\Temp\UniGetUI\ElevatedWinGetTemp\WinGet\WinSCP.WinSCP.6.5.2\download.exe
Parent Process = C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.26.400.0_x64__8wekyb3d8bbwe\winget.exe
PolicyName = UserSpace Lock
UserWriteable = true

***********************************************************
***********************************************************

 

[piquiteco]

WHHLight package vs. FileFix attack
Similarly to ClickFix method, this attack can be mainly prevented by FirewallHardening.

@Andy Ful, check out the GIF I recorded for you to see.

Spoiler: FileFix attack

 

[Andy Ful]

Be aware of other possible variants of the FileFix attack:

In the above picture, I used the original example with modified text.
I found out that the attacker can use a well-known keyboard shortcut (Windows Key + E) to open File Explorer (no need to abuse the Web browser upload functionality).

Edit
Unfortunately, Windows has implemented a few other shortcuts that can be abused (like "Windows Key + x" and next "i").
Sadly, many users are vulnerable to such trivial attacks.

 

[Parkinsond]

The latest version on Softpedia

https://www.softpedia.com/get/Security/Security-Related/Windows-Hybrid-Hardening-Light.shtml

 

[Andy Ful]

WHHLight vs. Rainbow Hyena attacks (Polygot Files)

Scams & Phishing News - Hackers Use Polyglot Files to Bypass Email Filters to Deliver Malicious Emails

Hidden behind familiar subject lines and legitimate sender addresses, the messages contained archives that looked like ordinary ZIP files yet behaved like executable libraries. This hybrid format—known as a polyglot—slipped past most secure mail gateways, allowing attackers to plant malware...

malwaretips.com

Hackers Use Polyglot Files to Bypass Email Filters to Deliver Malicious Emails

In the final week of June 2025 security teams across Russia’s healthcare and technology sectors began receiving an unusual flood of “routine” logistics and contract e-mails. Hidden behind familiar subject lines and legitimate sender addresses, the messages contained archives that looked like...

cybersecuritynews.com

Once the victim double-clicked the attachment, Windows treated it as a compressed folder exposing a single shortcut.

The shortcut’s icon mimicked a contract update, but its target invoked PowerShell with hidden-window parameters, searching the disk for the parent polyglot and launching it through rundll32.exe.

A benign spreadsheet was simultaneously extracted to %TEMP% and opened, masking the compromise with an authentic-looking document.

Infection chain:
Email with Polygot attachment ---> invisible DLL + Shortcut with PowerShell CmdLine ----> LOLBin runs invisible malicious DLL

I am always surprised how often the new attack methods are easily prevented by 20-year-old simple hardening methods.
WHHLight blocks Shortcuts (SWH restrictions) in UserSpace and fully prevents infection.

 

[rashmi]

@Andy Ful, Could you integrate ConfigureDefender and FirewallHardening into the WHHLight interface for convenient access, similar to H_C?

 

[Andy Ful]

@Andy Ful, Could you integrate ConfigureDefender and FirewallHardening into the WHHLight interface for convenient access, similar to H_C?

I could. However, objectively speaking, this would not be more convenient.
Currently, you have one shortcut on the Desktop that gives direct access to ConfigureDefender and FirewallHardening (without running WHHLight) via a folder opened in File Explorer. Why would you want to choose a longer path and run WHHLight first, and then ConfigureDefender or FirewallHardening?
The H_C installation folder contains many files, so finding ConfigureDefender or FirewallHardening in the opened folder would be rather inconvenient.

 

[rashmi]

I could. However, objectively speaking, this would not be more convenient.
Currently, you have one shortcut on the Desktop that gives direct access to ConfigureDefender and FirewallHardening (without running WHHLight) via a folder opened in File Explorer. Why would you want to choose a longer path and run WHHLight first, and then ConfigureDefender or FirewallHardening?
The H_C installation folder contains many files, so finding ConfigureDefender or FirewallHardening in the opened folder would be rather inconvenient.

I always start with WHHLight first, as it would block the most or more than others, right? It would then be more convenient to access other tools from the WHHLight interface. I can simply create a WHHLight link in Biniware Run rather than minimizing windows and reaching the desktop.

Can you safely pin WHHLight or H_C icons to the taskbar?

Does WHHLight apply less hardening than H_C, as WHHLight includes WDAC?

 

[Andy Ful]

I always start with WHHLight first, as it would block the most or more than others, right? It would then be more convenient to access other tools from the WHHLight interface. I can simply create a WHHLight link in Biniware Run rather than minimizing windows and reaching the desktop.

The solution would be adding ConfigureDefender and FirewallHardening to Biniware Run.

Can you safely pin WHHLight or H_C icons to the taskbar?

Yes. You can use the right-click Explorer context menu to pin any executable to the taskbar (Properties >> Show more options >> Pin to taskbar) or create the shortcut on the Desktop.

Does WHHLight apply less hardening than H_C, as WHHLight includes WDAC?

Less SRP hardening for EXE and MSI files (covered by WDAC).

Edit.
For now, I like the idea of WHHLight package of a few independent tools, instead of the WHHLight application with integrated tools. This has some pros and cons.
I do not exclude the possibility of integration in the future.

 

[rashmi]

The solution would be adding ConfigureDefender and FirewallHardening to Biniware Run.

Then, it would be the same—reaching the desktop vs. reaching the Biniware Run icon—to access "each" WHHLight tool.

Yes. You can use the right-click Explorer context menu to pin any executable to the taskbar (Properties >> Show more options >> Pin to taskbar) or create the shortcut on the Desktop.

WHHLight shows another instance/icon on the taskbar when you access the pinned one. Could you explain why?

Less SRP hardening for EXE and MSI files (covered by WDAC).

So the SRP blocking/hardening experience would be more or less the same with both WHHLight and H_C except for EXE and MSI files. Correct? WHHLight has a slight advantage in the sense that you get additional cloud reputation with WDAC.

For now, I like the idea of WHHLight package of a few independent tools, instead of the WHHLight application with integrated tools. This has some pros and cons.

I agree both integrated and individual ways have pros and cons.

I do not exclude the possibility of integration in the future.

"We'll be getting back to you soon enough!"

I believe H_C/WHHLight suites, paired with their recommended tools, offer better protection than ComodoFW, Comodo's proactive configuration, disabled HIPS, and containment.

 

[Andy Ful]

WHHLight shows another instance/icon on the taskbar when you access the pinned one.

The pinned EXE contains both 32 and 64 bit executables. The second icon is related to one of them that is actually executed.

So the SRP blocking/hardening experience would be more or less the same with both WHHLight and H_C except for EXE and MSI files.

Not exactly. In H_C, additional SRP restrictions can be applied (like blocking LOLBins). It is also possible to use a less restrictive setup based on the default_allow policy.

WHHLight has a slight advantage in the sense that you get additional cloud reputation with WDAC.

In H_C, you have Forced SmartScreen, which is as effective as WDAC with the default whitelist. The WDAC advantage is visible after applying a more restricted whitelist (SUPER_SAFE, TWO_ACCOUNTS, or INSTALL_APP_CONTROL setups).

 

[Andy Ful]

I believe H_C/WHHLight suites, paired with their recommended tools, offer better protection than ComodoFW, Comodo's proactive configuration, disabled HIPS, and containment.

There is no way to prove which of those solutions can offer better protection.
Both can be configured for strong protection at home.