Reply to thread

Message

<blockquote data-quote="ForgottenSeer 98186" data-source="post: 1026382">Block LOLBins by adding to Exploit Guard:NOTE 1: DLLs cannot be added to Exploit Guard; only .exe can be added.NOTE 2: This method will block Office macros from launching or abusing the processes the user adds to Exploit Guard &gt; Block Win32k system calls.NOTE 3: The procedure below can be accomplished for a list of processes using PowerShell. If you want a script then I&#039;ll produce one.[CODE]# Basic cmdlet and syntax to add a process to Exploit Guard with Win32k system calls disabled.# Run cmdlet within an Administrative PowerShell session.Set-ProcessMitigation -Name &quot;pwsh.exe&quot; -Enable DisableWin32kSystemCalls[/CODE]Procedure:1. Open Windows Security Center2. Select in left menu &gt; App &amp; browser control3. Select beneath App &amp; browser control (top of main window) &gt; Exploit protection &gt; Exploit protection settings4. Select beneath Exploit protection (top of main window) &gt; Program settings (tab)5. Select beneath Program Settings (main window) &gt; (+) Add program to customize (left-click on +)6. Select &gt; Add by program name (a program-add wizard window will open7. Enter the program name (e.g. notepad.exe -- just for testing purposes)8. Select Add9. A Program Settings: process_name.exe window will open10. Scroll down to &quot;Disable Win32k system calls&quot;11. Tick &gt; Override system settings12. Click on radio button to set value to &quot;ON&quot;13. Select &gt; ApplyTest:14. WIN key + R15. Enter &quot;notepad.exe&quot;16. Exploit Guard &quot;Disable Win32k system&quot; policy should block process (in this case, notepad.exe) and produce the following notification:[ATTACH]273164[/ATTACH]Source of executables (LOLBins; crowdsourced) to be added to Exploit Guard:[URL unfurl=&quot;true&quot;]https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules[/URL][URL unfurl=&quot;true&quot;]https://lolbas-project.github.io/[/URL]Configure Windows 10/11 to permit install of only Microsoft Store apps:1. Open Settings app2. Select &gt; Apps in left menu3. Select &gt; Advanced app settings4. Select &gt; Choose where to get apps &gt; Drop-down menu &gt; The Microsoft Store only (Recommended)[ATTACH]273165[/ATTACH]</blockquote>

[QUOTE="ForgottenSeer 98186, post: 1026382"] [B][U]Block LOLBins by adding to Exploit Guard:[/U][/B] NOTE 1: DLLs cannot be added to Exploit Guard; only .exe can be added. NOTE 2: This method will block Office macros from launching or abusing the processes the user adds to Exploit Guard > Block Win32k system calls. NOTE 3: The procedure below can be accomplished for a list of processes using PowerShell. If you want a script then I'll produce one. [CODE]# Basic cmdlet and syntax to add a process to Exploit Guard with Win32k system calls disabled. # Run cmdlet within an Administrative PowerShell session. Set-ProcessMitigation -Name "pwsh.exe" -Enable DisableWin32kSystemCalls[/CODE] [B][U]Procedure:[/U][/B] 1. Open Windows Security Center 2. Select in left menu > App & browser control 3. Select beneath App & browser control (top of main window) > Exploit protection > Exploit protection settings 4. Select beneath Exploit protection (top of main window) > Program settings (tab) 5. Select beneath Program Settings (main window) > (+) Add program to customize (left-click on +) 6. Select > Add by program name (a program-add wizard window will open 7. Enter the program name (e.g. notepad.exe -- just for testing purposes) 8. Select Add 9. A Program Settings: process_name.exe window will open 10. Scroll down to "Disable Win32k system calls" 11. Tick > Override system settings 12. Click on radio button to set value to "ON" 13. Select > Apply [B][U]Test:[/U][/B] 14. WIN key + R 15. Enter "notepad.exe" 16. Exploit Guard "Disable Win32k system" policy should block process (in this case, notepad.exe) and produce the following notification: [ATTACH alt="2023-02-26 02_39_03-Flashback Express.png"]273164[/ATTACH] Source of executables (LOLBins; crowdsourced) to be added to Exploit Guard: [URL unfurl="true"]https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules[/URL] [URL unfurl="true"]https://lolbas-project.github.io/[/URL] [B][U]Configure Windows 10/11 to permit install of only Microsoft Store apps:[/U][/B] 1. Open Settings app 2. Select > Apps in left menu 3. Select > Advanced app settings 4. Select > Choose where to get apps > Drop-down menu > The Microsoft Store only (Recommended) [ATTACH alt="2023-02-26 02_49_53-Flashback Express.png"]273165[/ATTACH] [/QUOTE]

Verification