Andy Ful

Level 48
Verified
Trusted
Content Creator
Thanks !
@andy, is the list you use for your firewall hardener the same one as the lolbas list ?
No, I simply used most of SysHardener entries (except a few) and added those LOLBins that may be used for downloading the payloads from remote locations. Some entries used in FirewallHardening tool are added because they were used as a target of malicious code injections.
Generally, blocking by firewall rules is efficient on script interpreters and a few LOLBins. Most LOLBins do not require the Internet connection and should be blocked on execution.
 

notabot

Level 12
No, I simply used most of SysHardener entries (except a few) and added those LOLBins that may be used for downloading the payloads from remote locations. Some entries used in FirewallHardening tool are added because they were used as a target of malicious code injections.
Generally, blocking by firewall rules is efficient on script interpreters and a few LOLBins. Most LOLBins do not require the Internet connection and should be blocked on execution.
If ransomware is not a concern, ultimately the malware will eventually try to phone out, no ?
 

notabot

Level 12
In most cases, the malware will not inject the code to LOLBins (except those I mentioned), but to Explorer or common system processes, or will hide behind svchost.
I see, so if UWP is not bypassed & can prevent injections to existing processes, monitoring parent-child relations is the only way. In old versions of Windows (old like XP) I used to ban explorer from firewall though, then the OS was different, eg users downloaded service packs and run them by hand but perhaps explorer can still be blocked. I used to let only Opera as outgoing , worked wonderful back in the day. Today tho I’d expect the OS To have many hiccups with such a rule for outgoing

In any case svchost is an issue indeed as I’m not aware of a firewall that can filter based on which service is making the request each time

Edit : actually it is possible to set firewall rules based on which service is behind svchost.
 
Last edited:

notabot

Level 12
see


Of course, it is possible. But, the malc0ders can use those services which should not be blocked by firewall rules.(y)
Sure but if you can't safely switch off a service and you also can't block it from firewall, no policy can help

AFAIK the main gain from blocking lolbins at the firewall level is to help prevent the downloading of the payload.
Yes and convenience of config, it's much more convenient than WDAC
 
Last edited:

Andy Ful

Level 48
Verified
Trusted
Content Creator
...
Sure but if you can't safely switch off a service and you also can't block it from firewall, no policy can help
...
Not necessarily. The policies can surely help to prevent malware before it could hide behind svhost. It is easier to prevent malware in Windows OS, than fighting the active one (at least in the home environment). That is why policies were introduced to Windows (also SRP, Applocker, and Application Guard).
The firewall rules can be efficient after exploiting the system, but before the exploit will download something more complex (to disk or to memory). So they are most helpful when applied to LOLBins with downloading abilities.
 
Last edited: