Serious Discussion WHHLight - simplified application control for Windows Home and Pro.

[Andy Ful]

When I:

• Switch SWH ON
• Set PowerShell Restrictions to 2 (PowerShell.exe)
• Switch SWH OFF
• Switch SWH ON

Then PowerShell Restrictions will be set to 3 (PowerShell.exe + Script files).
WHHL V2.0.0.2

Thanks. Bug confirmed. It will be corrected in the next version.

 

[Tiamati]

@Andy Ful

I have ConfigureDefender_4011 and WindowsHybridHardeningLight_2002 at C:\ProgramData\WindowsHybridHardening_Tools. I created a shortcut for both to my desktop and now EMSISOFT is checking them as malware (only the shortcut). Any idea why?

Virustotal also mark it

example:

VirusTotal

VirusTotal

www.virustotal.com

 

[Parkinsond]

@Andy Ful

I have ConfigureDefender_4011 and WindowsHybridHardeningLight_2002 at C:\ProgramData\WindowsHybridHardening_Tools. I created a shortcut for both to my desktop and now EMSISOFT is checking them as malware (only the shortcut). Any idea why?

Virustotal also mark it

example:

VirusTotal

VirusTotal

www.virustotal.com

Because it uses B signatures, and B is known for FPs.

 

[Andy Ful]

@Andy Ful

I have ConfigureDefender_4011 and WindowsHybridHardeningLight_2002 at C:\ProgramData\WindowsHybridHardening_Tools. I created a shortcut for both to my desktop and now EMSISOFT is checking them as malware (only the shortcut). Any idea why?

Virustotal also mark it

example:

VirusTotal

VirusTotal

www.virustotal.com

Some malware can create shortcuts to payloads dropped in ProgramData.
You probably are not malware, so the shortcut can be whitelisted.

 

[Marana]

I recently installed a new application that seems to put some of its dynamic libraries under writable folders, so WDAC blocks them by default. Whitelisting the folder also fails, because WHHL complains: "WDAC Whitelist. Error. The path is too long (max pathlength = 72). In this case, the required path length would be 91 characters, but maybe some additional reserve would probably not be a bad idea, too...

It would be nice if you could make this modification for the next release (and also include the bug fix for the SWH PowerShell restrictions configuration which I reported in September).

Until then, I have to rely only on SRP restrictions (that are weaker and less configurable in WHHL than what they were in H_C, from which I moved to WHHL when upgrading to Windows 11).

 

[Andy Ful]

I recently installed a new application that seems to put some of its dynamic libraries under writable folders, so WDAC blocks them by default. Whitelisting the folder also fails, because WHHL complains: "WDAC Whitelist. Error. The path is too long (max pathlength = 72). In this case, the required path length would be 91 characters, but maybe some additional reserve would probably not be a bad idea, too...

What was that path?

 

[Marana]

C:\Users\XXXXX\AppData\Local\Temp\.net\YYYYYYY\7b_GqtU4OEUHIiFkHfIeYWN9iLEBkV8=\YYYYYYY.dll

(I have whitelisted only the Admin account's AppData\Local\Temp directory, purposely. This is a SUA)

 

[Andy Ful]

C:\Users\XXXXX\AppData\Local\Temp\.net\YYYYYYY\7b_GqtU4OEUHIiFkHfIeYWN9iLEBkV8=\YYYYYYY.dll

(I have whitelisted only the Admin account's AppData\Local\Temp directory, purposely. This is a SUA)

You can whitelist the path:
C:\Users\XXXXX\AppData\Local\Temp\.net\YYYYYYY\

Edit.
However, if "YYYYYYY" is random, it cannot be whitelisted in WHHLight.
A partial solution is whitelisting: "C:\Users\XXXXX\AppData\Local\Temp\.net"

 

[Andy Ful]

WHHLight ver. 2.0.1.0

https://github.com/AndyFul/Hard_Configurator/raw/refs/heads/master/WindowsHybridHardening/WHHLight_Package_2010.exe

• Added new digital certificate.
• Improved anti-tampering (ConfigureDefender and FirewallHardening).
• Corrected the bugs related to gpupdate.exe on Windows Pro.
• Improved switching on powershell.exe.
  

 

[Andy Ful]

WHHLight vs. DiCaprio Movie torrent attack
https://www.bitdefender.com/en-us/b...dicaprio-movie-torrent-agent-tesla-powershell
https://malwaretips.com/threads/fak...esla-through-layered-powershell-chain.138664/

Key findings​

• The notoriety of Leonardo DiCaprio's new film, One Battle After Another, is being used to deploy malware on the Windows machines of unsuspecting users.
• The Agent Tesla RAT itself is not novel, but the deployment of consecutive attack methods leveraging PowerShell and other LOTL (Living Off the Land) tools is highly interesting.
• According to our insights, this particular type of attack has been used only in this torrent download.
• Payload execution is done entirely in memory.
• The attack demonstrates the use of multi-stage scripting, advanced obfuscation techniques, and fileless execution to evade detection and become persistent.
• The goal is to transform the Windows PC into a zombie agent, ready to be used at any time by attackers in other campaigns or to deploy malware further.
• The attack is directed at novices who don't often download pirated content or understand the dangers of torrents.

Context​

The infection begins when a user downloads a torrent that appears to contain the One Battle After Another film. Inside the downloaded content, the user will find a shortcut file simply named CD.lnk that indicates it is there to launch the movie.

Clicking on that file, however, triggers a hidden command chain that executes a series of malicious scripts buried inside the subtitle file Part2.subtitles.srt.

The attacker uses several legitimate Windows utilities (CMD, PowerShell, and Task Scheduler) to unpack multiple layers of encrypted data.

Infection chain:
Malicious torrent download (Movie + malicious files LNK, SRT, JPG, M2ts) ---> User opens a shortcut ----> CMDLine extracts and runs PowerShell CmdLines embedded in the SRT subtitle files ---> PowerShell decrypts the malicious code ----> PowerShell drops a few PowerShell scripts ----> Scripts are executed ---> the Payloads are unpacked and decrypted from fake JPG and M2ts files ---> Batch/PS1 script installs Go programming language and makes persistence via scheduled tasks ---> Malicious Loader is compiled ---> Final payload (Agent Tesla) is executed directly in memory

The actions marked in red are blocked by SWH/SRP shortcut/script restrictions.
The actions marked in blue are blocked by the PowerShell Constrained Language Mode forced by SWH/SRP.
Any of those blocked actions makes the whole attack harmless.

 

[Parkinsond]

WHHLight vs. DiCaprio Movie torrent attack
https://www.bitdefender.com/en-us/b...dicaprio-movie-torrent-agent-tesla-powershell
https://malwaretips.com/threads/fak...esla-through-layered-powershell-chain.138664/



Infection chain:
Malicious torrent download (Movie + malicious files LNK, SRT, JPG, M2ts) ---> User opens a shortcut ----> CMDLine extracts and runs PowerShell CmdLines embedded in the SRT subtitle files ---> PowerShell decrypts the malicious code ----> PowerShell drops a few PowerShell scripts ----> Scripts are executed ---> the Payloads are unpacked and decrypted from fake JPG and M2ts files ---> Batch/PS1 script installs Go programming language and makes persistence via scheduled tasks ---> Malicious Loader is compiled ---> Final payload (Agent Tesla) is executed directly in memory

The actions marked in red are blocked by SWH/SRP shortcut/script restrictions.
The actions marked in blue are blocked by the PowerShell Constrained Language Mode forced by SWH/SRP.
Any of those blocked actions makes the whole attack harmless.

Signature and behavioral aside, when comparing WHHL to K app control, I suppose the earlier will block the attack even before it starts, while the later will kick in at the last step of executing the payload.

Signature aside, would not behavioral analysis of MD or the 3rd party AVs stop such an attack; this is a typical malicious behavior!

 

[Andy Ful]

Signature aside, would not behavioral analysis of MD or the 3rd party AVs stop such an attack; this is a typical malicious behavior!

Such attacks are planned/tested to avoid any detection (also behavioral) by the particular AV (or some AVs). That is how the FUD market works.
That is why the infection chain is so complicated in the case of the DiCaprio attack. The behavioral detection is often triggered after several hours.

 

[Andy Ful]

WHHLight vs. Phantom 3.5 attack

Phantom 3.5: Initial Vector Analysis & Forensics - K7 Labs

Phantom, a stealer malware, sends back sensitive data like passwords, browser cookies, credit card information, crypto wallet credentials, victim’s IP […]

labs.k7computing.com

Phantom, a stealer malware, sends back sensitive data like passwords, browser cookies, credit card information, crypto wallet credentials, victim’s IP addresses, etc to the attacker. This can be used in identity theft, account takeovers or even worse the infected machine can be used as a tool to orchestrate bigger malware attacks.

With the increased use and vast amount of files that are available on the internet, most oblivious users fail to differentiate between safe and malicious content they are downloading. In this blog, we will delve into a stealer named Phantom version 3.5 and its initial vector.

As the initial vector, the WSF script is used (the XML-based container for JavaScript obfuscated code).

Infection chain:
Fake Adobe 11.7.7 installer (WSF/XML script container) ---> JScript code downloads/executes PS1 script ---> PowerShell decrypts DLL Payload and injects it into the LOLBin (aspnet_compiler.exe) ---> connection with C2 server is established

(*) - I wrote JScript instead of JavaScript to point up that Windows Script Host runs the code.

The actions marked in red are blocked by default SWH script restrictions.
The actions marked in blue are blocked by the PowerShell Constrained Language Mode forced by SWH/SRP. The execution of aspnet_compiler.exe is also blocked in WHHLight when the WDAC setting is not set to OFF.
The actions marked in violet can be blocked by FirewallHardening (LOLBin BlockList includes aspnet_compiler.exe).

 

[Andy Ful]

WHHLight vs. Cache Smuggling attacks

This attack vector combines the ClickFix method with the exploitation of the web browser cache. Such attacks were reported this year.
According to Microsoft:

ClickFix was the most common initial access method that Microsoft Defender Experts observed in Defender Expert notifications in the last year,accounting for 47% of attacks. ClickFix has been used by both cybercriminal and nation-state actors to deliver malware, including infostealers, remote access trojans (RATs), and worms. Successful campaigns have led to credential theft, malware staging, and persistent access using just a few keystrokes from the user.

https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1

Web browsers often cache images from websites in specific paths. This can be abused by using the ClickFix method:

1. The user is directed to the malicious website, which hosts the encrypted payload camouflaged as a JPG file.
2. The web browser caches the JPG to the disk.
3. The user is fooled into applying ClickFix actions that trigger PowerShell code.
4. PowerShell code searches for the JPG payload in the web browser's cache.
5. PowerShell decrypts the JPG payload.
6. Malicious code is executed.

This method cannot be stopped by FirewallHardening, because the payload is not downloaded by PowerShell (or another LOLBin), but directly via a web browser. However, it can be mitigated by PowerShell Constrained Language Mode forced by default SWH/SRP restrictions.

 

[LinuxFan58]

@Andy Ful

Apologize for this off topic question.

My wife only runs Office 2024 and a photo editor installed from Windows store.

She is running as standard user with SAC on and Hard Configurator only blocking scripts and LolBins (for standard user) with Defender on Max (and also your other hardening tools for office and firewall enabled).Additionally I have disabled Wscript, CMD and Cscript and put Powershell in constrained mode.

Would their be any benefit to move to your latest tool WHHLight (using Hard Configurator with SAC now)?

She has to do security wareness courses every year for work,so she is a careful with mail and internet.

After initial installation I ran some debloat programs wihich also removed some HP programs as spyware and I removed all preinstalled (trial) programs.

All updates are installed through Windows update using Windows installed drivers only.

This configuration runs without any problems (only in the beginning a HP program would not update but that one was removed because it was categorized as a spyware).

 

[Andy Ful]

@Andy Ful

My wife only runs Office 2024 and a photo editor installed from Windows store.

She is running as standard user with SAC on and Hard Configurator only blocking scripts and LolBins (for standard user) with Defender on Max (and also your other hardening tools for office and firewall enabled).Additionally I have disabled Wscript, CMD and Cscript and put Powershell in constrained mode.

Could you post the screenshots of the H_C main Window and of the DocumentsAntiExploit window?
The posted setup looks OK. I am unsure about script settings. Did you block CMD via registry tweak?
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
DisableCMD = 1 (DWORD (32-bit)

 

[LinuxFan58]

Yes I disabled command shell and old scriptors through registry settings.

I am currently on holiday and have no access to the PC. So not able to post screenshots. When I remember correctly I used the Avast profile as starting point.

Thanks for your reply.

 

[ProblematicPions]

Beginning to understand it much better - both about exe reputation and when they may run but also that even with this tight grip I don't have to disable everything to install well-known software (I always let the setups stay in a folder for a few days and AV scan daily) or to use fx. Hibit Uninstaller to remove stuff. And the whitelisting parts also makes better sense for my use - in other words, it just works even through the tight grip is ON

Thanks for all @Andy Ful

 

[Parkinsond]

This is far better protection compared to SAC

and more flexible.

ConfigureDefender MAX settings protect all locations (with a few exclusions). WDAC ISG automatically allows Non-writable locations and WDAC whitelisted locations.

So if the installer was blocked by both ASR rule and WDAC, turning off temporarly for installing will bypass WDAC (the installed app will launch as it is located in non-writable space) but not ASR rule (as this space is not excluded by default as in the case with WDAC)?

JScript download payloads (via Bitsadmin LOLBin)

Also this step could be blocked by "Block JavaScript or VBScript from launching downloaded executable content" ASR rule.

WMIC.exe is blocked by WDAC as recommended by Microsoft

Currently deprecated of W 11.

user opens the archive and runs the script

You mean the user double click the script or right click and run as admin, or just opening (or extracting) the archive will launch the script without user interaction with the script?

WHHLight blocks it via the default SWH settings (running VBE scripts is disabled).

or by "Block JavaScript or VBScript from launching downloaded executable content" ASR rule.

 

[Jonny Quest]

@Mods, thank you for combining (merging) @Parkinsond posts, I was going to say something about the 4-5 singular posts in a row. Same with yesterday and about 4-5 separate links posted one after the other that were merged. I'm not attacking you Parkinsond, but it would be nice if at times you waited 15- 30 minutes to "let the paint dry" on some of your thoughts, LOL, before posting one sentence replies and used multi-quote more often?