Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1086722" data-attributes="member: 32260">Is FirewallHardening needed?Let&#039;s ask another question. Can the WHHLight protection be bypassed?There is no perfect protection, so the answer is Yes. WHHLight can be bypassed, but the chances for that are very, very small.Here is an example where the malware could almost compromise WHHLight (but it did not):The malware was propagated via Google Ads, and threat actors were impersonating Calendy and Rufus applications. As the article explains, the EXE/MSI files signed with an EV certificate have more chances to bypass the AV+SmartScreen. If SmartScreen is bypassed then &lt;WDAC&gt; with SmartScreen backend can often be bypassed in WHHLight. Furthermore, the malware uses high privileges to drop/run a script in the %ProgramFiles% folder which is whitelisted.Fortunately, malware Loaders usually use scripting in UserSpace and download some important files from the web. To be stealthy, the download is usually done by LOLBins.Attack flow:Google Ad&nbsp; ----&gt;&nbsp; downloaded EV-signed EXE&nbsp; -----&gt;&nbsp; user executes the file and accepts the UAC&nbsp;&nbsp; ----&gt;&nbsp; SmartScreen accepts the EV-signed file&nbsp;&nbsp; ----&gt;&nbsp; two bach scripts dropped/executed&nbsp; ----&gt;&nbsp; first script uses LOLBin (Curl) to download the URL of a malicious server, the second script runs the payload downloaded from that server&nbsp;&nbsp; ----&gt; ....In this example, the first script was dropped in the UserSpace (user Temp folder) so it could be blocked by &lt;SWH&gt;. The possible connection to a malicious server was disrupted (payloads could not be downloaded).The second script was dropped in SystemSpace (%ProgramFiles% folder) so it was allowed to run. But, there was no payload to run.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />If the first script was also dropped to SystemSpace, the connection to the malicious server could be disrupted by FirewallHardening (H_C Recommended settings), because the Curl LOLBin is on the blockList.</blockquote>

[QUOTE="Andy Ful, post: 1086722, member: 32260"] [B][SIZE=5]Is FirewallHardening needed?[/SIZE][/B] Let's ask another question. Can the WHHLight protection be bypassed? There is no perfect protection, so the answer is Yes. WHHLight can be bypassed, but the chances for that are very, very small. Here is an example where the malware could almost compromise WHHLight (but it did not): The malware was propagated via Google Ads, and threat actors were impersonating Calendy and Rufus applications. As the article explains, the EXE/MSI files signed with an EV certificate have more chances to bypass the AV+SmartScreen. If SmartScreen is bypassed then <WDAC> with SmartScreen backend can often be bypassed in WHHLight. Furthermore, the malware uses high privileges to drop/run a script in the %ProgramFiles% folder which is whitelisted. [B][COLOR=rgb(0, 168, 133)]Fortunately, malware Loaders usually use scripting in UserSpace and download some important files from the web. To be stealthy, the download is usually done by LOLBins.[/COLOR] Attack flow:[/B] Google Ad ----> downloaded EV-signed EXE -----> user executes the file and accepts the UAC ----> SmartScreen accepts the EV-signed file ----> two bach scripts dropped/[B][COLOR=rgb(184, 49, 47)]executed[/COLOR] ----> [COLOR=rgb(184, 49, 47)]first script uses LOLBin (Curl) to download the URL of a malicious server,[/COLOR] [/B]the second script runs the payload downloaded from that server ----> .... In this example, the first script was dropped in the UserSpace (user Temp folder) so it could be blocked by <SWH>. [B]The possible connection to a malicious server was disrupted (payloads could not be downloaded)[/B]. The second script was dropped in SystemSpace (%ProgramFiles% folder) so it was allowed to run. But, there was no payload to run.:) If the first script was also dropped to SystemSpace, the connection to the malicious server could be disrupted by FirewallHardening (H_C Recommended settings), because the Curl LOLBin is on the blockList. [/QUOTE]

Verification