Serious Discussion WHHLight - simplified application control for Windows Home and Pro.

Hard_Configurator Tools
747 Replies 158,657 Views
Alright, that works :)

Not sure why WU would change it (and it probably didn't - it must be something else on this good old laptop) but thanks a LOT.

... and yes, re-reading help section is a good idea (y) (clearly I didn't remember :unsure:😉)
 
WHHLight vs. Remcos RAT through a Multi-Stage .NET infection chain
Khushal

Malware News Thread 'Seqrite reported a multi-stage .NET malware campaign abusing GST-themed phishing to deliver Remcos RAT, using in-memory loaders targeting Indian users'

Introduction​

Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase infection success rates. The threat actors impersonated legitimate government departments and distributed malicious emails disguised as official notifications related to taxation, refunds, compliance requirements, and regulatory matters. By leveraging recognizable government branding, urgency, and financial incentives, the campaign was designed to persuade recipients to open malicious attachments or interact with embedded content...
Click to expand...
  • Like

Attacks via .NET DLL binaries are interesting because Smart App Control and most WDAC implementations do not block dynamically created .NET DLLs (too many false positives). However, such attacks can be blocked at an earlier infection stage, when the .NET initial executable (EXE, COM, etc.) is executed.

Infection chain:
Malicious email attachment (RAR archive) ---> user opens the attachment (EXE/COM malicious .NET loader) ---> dynamically created/loaded .NET DLLs ---> REMCOS malware executed filelessly ---> PowerShell script dropped for persistence (via the Registry Run key)

It is worth mentioning that Windows can block almost all such attacks via SmartScreen or SAC. The Windows built-in unpacker transfers the MotW of the downloaded attachment to the unpacked content (EXE/COM .Net loader). So the executable can be checked by SmartScreen.
SAC can block the EXE/COM loader even when MotW is lost (the binary from the article is unsigned).
If the user manually bypasses SmartScreen, the COM loader will be blocked by the SWH/SRP default settings. The EXE loader can be blocked when the WDAC option is enabled.
Furthermore, malware persistence will be blocked anyway due to the SWH default restrictions on PowerShell.
 
Hello

Windows Defender without anti-ransomware + WHHLight (without WDAC) + Safing Portmaster (free)... Will this break Windows 11?

Rainmeter_SAhEXLFT7K.png


Home use only...

Is this enough?

I often use a personal NextDNS profile in Portmaster...

And that's more than enough for me...

Since my Windows 11 is experiencing app and process crashes (Pano scrobbler, Spotify, Rainmeter, Calibre, AIDA64, Portmaster, Explorer.exe, LightBulb...), I'm wondering what to install during my next clean install...

Thanks!
 
pytroman86 said:
Hello

Windows Defender without anti-ransomware + WHHLight (without WDAC) + Safing Portmaster (free)... Will this break Windows 11?

View attachment 298909

Home use only...

Is this enough?

I often use a personal NextDNS profile in Portmaster...

And that's more than enough for me...

Since my Windows 11 is experiencing app and process crashes (Pano scrobbler, Spotify, Rainmeter, Calibre, AIDA64, Portmaster, Explorer.exe, LightBulb...), I'm wondering what to install during my next clean install...

Thanks!
Click to expand...
According to your setupt; if you did not manually add extra file types to SRP beyond the default, it will not.

Regarding Portmaster, I did not try before.

Is this yours?

 
pytroman86 said:
Hello

Windows Defender without anti-ransomware + WHHLight (without WDAC) + Safing Portmaster (free)... Will this break Windows 11?
...
I often use a personal NextDNS profile in Portmaster...
And that's more than enough for me...
Click to expand...

This is true also for many users.
Such hardening cannot break Windows 11, however, it can trigger some software incompatibilities.
On the new Windows installation, add hardening gradually. For example:
First month ---> Windows Defender + WHHLight + Browser hardening
Second month ---> add Safing Portmaster
etc.
 
Andy Ful said:
This is true also for many users.
Such hardening cannot break Windows 11, however, it can trigger some software incompatibilities.
On the new Windows installation, add hardening gradually. For example:
First month ---> Windows Defender + WHHLight + Browser hardening
Second month ---> add Safing Portmaster
etc.
Click to expand...
All right, thanks. Well, I don't know what's causing all these crashes on my PC...

Windhawk seems safe...

Portmaster is configured correctly (as far as I can tell)...

WHHLight doesn’t have everything enabled (see screenshot)...

But yes, month by month, keeping track of everything in an app like Notesnook or in a Word document with a timeline showing when each change was made, etc.
 
Andy Ful said:
How often do the problems arise?
Click to expand...
It doesn't happen often, but tools such as “Malekal-Optimisation-Center” make me realize it...

(like "UserDiag" but more comprehensive)

What happens is that my PC sometimes restarts without a blue screen...

The rest are silent crashes; I don't really notice them...

Note: I'm not advertising Malekal.

I just find this tool really interesting...
 
Last edited by a moderator:
I'm planning a clean install for January 2027, if all goes well...

Because right now, the PC is still pretty unstable...

In the past, I've run some Privacy.sexy scripts that I generated myself, but they seemed safe...

That's it...

---

I won't be using those kinds of tools anymore... (Privacy.sexy)...

Just WHHLight and Portmaster (as security tools)...

And one by one, note the differences....
 
Last edited by a moderator:
pytroman86 said:
It doesn't happen often, but tools such as “Malekal-Optimisation-Center” make me realize it...

(like "UserDiag" but more comprehensive)

What happens is that my PC sometimes restarts without a blue screen...


The rest are silent crashes; I don't really notice them...
Click to expand...

Most of the silent process crashes are normal and caused by the system settings.
The Windows restarts can suggest some problems related to drivers or services (too many disabled, wrong configurations, etc.).
Windows can also restart when the "Active hours" setting is not configured properly for Windows Updates.
 
Andy Ful said:
Most of the silent process crashes are normal and caused by the system settings.
The Windows restarts can suggest some problems related to drivers or services (too many disabled, wrong configurations, etc.).
Windows can also restart when the "Active hours" setting is not configured properly for Windows Updates.
Click to expand...
It often restarts at the lock screen...

And WU can force a restart, but the event is logged when that happens...

Let's just say it's strange, but there must be one or more reasons for it...
 
pytroman86 said:
Let's just say it's strange, but there must be one or more reasons for it...
Click to expand...

Yes, using privacy tools and debloaters can often end with the wrong system configurations.
Another reason may be related to outdated drivers. I had serious issues with the TPLink modem on Windows 11. After identifying the cause of the silent Windows restart (one minute after sign-in), I had to restore Windows 10 and refuse to update it.

Edit.
I do not recommend using Windows 10 with blocked updates. I configured only one such machine, but with paranoid system/firewall/browser hardening:
Andy Ful

Thread 'Paranoid Banking Computer.'

Paranoid Banking Computer.

This is the craziest idea I tried to realize so far. I post this experimental setup here to show that it is possible (with some effort) if one does not like the other options.

My friend asked me to turn the old laptop with Windows 10 into a one-purpose machine. The purpose was to use it only for banking. She has a second laptop with Windows 11, which serves as a home computer.
I thought about Linux or ChromeOS Flex, but I had a bad experience with both on old laptops (display and Wi-Fi problems). Furthermore, my security experience is related to...
  • Like
  • Applause
  • +Reputation
 
To compare how restrictive is ASR "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" to WDAC, it tried each separately on both the latest installer of MPC-HC and the app after installation.

WDAC is less restrictive than ASR rule, it blocked only the installer, but allowed the app to launch.
ASR rule blocked both.
 
Parkinsond said:
To compare how restrictive is ASR "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" to WDAC, it tried each separately on both the latest installer of MPC-HC and the app after installation.

WDAC is less restrictive than ASR rule, it blocked only the installer, but allowed the app to launch.
ASR rule blocked both.
Click to expand...

This is more complex. WDAC has two different ways of blocking.
The first depends on the file MotW and SmartScreen (less restrictive). During installation, the SmartScreen positive reputation is transferred to installed executables. The installer and installed executables are flagged in WDAC as OK. In fact, you tested this for your installer.
The second is triggered for files and installations without checking SmartScreen. The reputation is checked via the cloud AI. This way is similar to the way used by the ASR rule. This more restrictive approach is used for application auto-updates (the downloaded installer via auto-update has no MotW).

In the full test, you should find a new installer (not used on your computer) and remove the MotW before running the installer. Finally, this installer should be tested to compare the ASR rule with WDAC ISG cloud AI. The test should be repeated after 24 hours (ASR rule should allow initially blocked file).

In real life, WDAC is less restrictive for installers downloaded via a web browser (the file has MotW). However, for the autoupdates, the ASR rule is less restrictive after 24 hours than WDAC ISG cloud AI (the block can persist for days).

In the WHHLight Trouble-Free setup, the expected blocks for auto-updates are avoided by whitelisting the user AppData folder.
 
Last edited:
Andy Ful said:
For files with MotW, the SmartScreen alert is triggered only in the case of low reputation. You did not see the alert, so the file passed SmartScreen.
Click to expand...
But was blocked one time by WDAC and another time by ASR rule.

I think of disabling ASR rule of file prevalence and keep only WDAC; they both consult the cloud regardless of motw and WDAC has a wider spectrum including dll files.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Continue exploring the conversation.

Back
Top