Advice Request Which lolbins can be blocked at the firewall level without disrupting the OS

Please provide comments and solutions that are helpful to the author of this topic.

notabot

Level 15
Thread author
Verified
Oct 31, 2018
703
I use windows firewall hardener. It can be found in Andy Ful's Hard Configurator, or you can get it separately at Github under Hard Configurator. No problems of any kind with it, hard configurator, or configure defender. Excellent program.

Thanks !
@andy, is the list you use for your firewall hardener the same one as the lolbas list ?
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
Thanks !
@andy, is the list you use for your firewall hardener the same one as the lolbas list ?
No, I simply used most of SysHardener entries (except a few) and added those LOLBins that may be used for downloading the payloads from remote locations. Some entries used in FirewallHardening tool are added because they were used as a target of malicious code injections.
Generally, blocking by firewall rules is efficient on script interpreters and a few LOLBins. Most LOLBins do not require the Internet connection and should be blocked on execution.
 

notabot

Level 15
Thread author
Verified
Oct 31, 2018
703
No, I simply used most of SysHardener entries (except a few) and added those LOLBins that may be used for downloading the payloads from remote locations. Some entries used in FirewallHardening tool are added because they were used as a target of malicious code injections.
Generally, blocking by firewall rules is efficient on script interpreters and a few LOLBins. Most LOLBins do not require the Internet connection and should be blocked on execution.

If ransomware is not a concern, ultimately the malware will eventually try to phone out, no ?
 

notabot

Level 15
Thread author
Verified
Oct 31, 2018
703
In most cases, the malware will not inject the code to LOLBins (except those I mentioned), but to Explorer or common system processes, or will hide behind svchost.

I see, so if UWP is not bypassed & can prevent injections to existing processes, monitoring parent-child relations is the only way. In old versions of Windows (old like XP) I used to ban explorer from firewall though, then the OS was different, eg users downloaded service packs and run them by hand but perhaps explorer can still be blocked. I used to let only Opera as outgoing , worked wonderful back in the day. Today tho I’d expect the OS To have many hiccups with such a rule for outgoing

In any case svchost is an issue indeed as I’m not aware of a firewall that can filter based on which service is making the request each time

Edit : actually it is possible to set firewall rules based on which service is behind svchost.
 
Last edited:

notabot

Level 15
Thread author
Verified
Oct 31, 2018
703

see


Of course, it is possible. But, the malc0ders can use those services which should not be blocked by firewall rules.(y)

Sure but if you can't safely switch off a service and you also can't block it from firewall, no policy can help

AFAIK the main gain from blocking lolbins at the firewall level is to help prevent the downloading of the payload.

Yes and convenience of config, it's much more convenient than WDAC
 
Last edited:

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
...
Sure but if you can't safely switch off a service and you also can't block it from firewall, no policy can help
...
Not necessarily. The policies can surely help to prevent malware before it could hide behind svhost. It is easier to prevent malware in Windows OS, than fighting the active one (at least in the home environment). That is why policies were introduced to Windows (also SRP, Applocker, and Application Guard).
The firewall rules can be efficient after exploiting the system, but before the exploit will download something more complex (to disk or to memory). So they are most helpful when applied to LOLBins with downloading abilities.
 
Last edited:

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top