Q&A Which lolbins can be blocked at the firewall level without disrupting the OS
- Thread starter notabot
- Start date
I use windows firewall hardener. It can be found in Andy Ful's Hard Configurator, or you can get it separately at Github under Hard Configurator. No problems of any kind with it, hard configurator, or configure defender. Excellent program.
Not that I know of, but I live under a rock with not much on my machine!
No, I simply used most of SysHardener entries (except a few) and added those LOLBins that may be used for downloading the payloads from remote locations. Some entries used in FirewallHardening tool are added because they were used as a target of malicious code injections.
Generally, blocking by firewall rules is efficient on script interpreters and a few LOLBins. Most LOLBins do not require the Internet connection and should be blocked on execution.
If ransomware is not a concern, ultimately the malware will eventually try to phone out, no ?
In most cases, the malware will not inject the code to LOLBins (except those I mentioned), but to Explorer or common system processes, or will hide behind svchost.
I see, so if UWP is not bypassed & can prevent injections to existing processes, monitoring parent-child relations is the only way. In old versions of Windows (old like XP) I used to ban explorer from firewall though, then the OS was different, eg users downloaded service packs and run them by hand but perhaps explorer can still be blocked. I used to let only Opera as outgoing , worked wonderful back in the day. Today tho I’d expect the OS To have many hiccups with such a rule for outgoing
In any case svchost is an issue indeed as I’m not aware of a firewall that can filter based on which service is making the request each time
Edit : actually it is possible to set firewall rules based on which service is behind svchost.
Last edited:
Of course, it is possible. But, the malc0ders can use those services which should not be blocked by firewall rules.
see
What's a Universal Windows Platform (UWP) app? - UWP applications
Learn about Universal Windows Platform (UWP) apps that can run across a wide variety of devices that run Windows 10.
docs.microsoft.com
Sure but if you can't safely switch off a service and you also can't block it from firewall, no policy can helpOf course, it is possible. But, the malc0ders can use those services which should not be blocked by firewall rules.
Yes and convenience of config, it's much more convenient than WDAC
Last edited:
Not necessarily. The policies can surely help to prevent malware before it could hide behind svhost. It is easier to prevent malware in Windows OS, than fighting the active one (at least in the home environment). That is why policies were introduced to Windows (also SRP, Applocker, and Application Guard).
The firewall rules can be efficient after exploiting the system, but before the exploit will download something more complex (to disk or to memory). So they are most helpful when applied to LOLBins with downloading abilities.
Last edited:
