Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1026687" data-attributes="member: 32260">This is probably a good idea at home. It is worth mentioning that applying Constrained Language Mode by a registry tweak can be bypassed with standard rights. But this probably will not happen in attacks on home users.For a half year, I worked on similar protection which would simulate some SRP capabilities without using SRP.[ATTACH=full]273249[/ATTACH][ATTACH=full]273250[/ATTACH][ATTACH=full]273252[/ATTACH]CMD and PowerShell can be blocked by Exploit Protection, and Windows Script Host by Windows policy.Furthermore, the user can block several file types similarly to SRP. I used the Windows built-in mechanism for choosing the default application to open files, so the files from the BlockList are opened by default via RunBySmartscreen tool (unpublished version so far). This also allows whitelisting scripts and a few other file types when they are located in the %WindDir% or %ProgramFiles% folders.Such protection can be easily switched ON/OFF (current settings are remembered) from the application main Window. Furthermore, the user can open any blocked file via the &#039;Open with&#039; option from the Explorer context menu (instead of whitelisting).By adding AppLocker (via WMI MDM Bridge) one could get protection similar to SAC (but more flexible).It is a nice tool, but If the SRP will work on Windows 11, I would prefer SimpleWindowsHardening (SWH) which is based on classic SRP.</blockquote>

[QUOTE="Andy Ful, post: 1026687, member: 32260"] This is probably a good idea at home. It is worth mentioning that applying Constrained Language Mode by a registry tweak can be bypassed with standard rights. But this probably will not happen in attacks on home users. For a half year, I worked on similar protection which would simulate some SRP capabilities without using SRP. [ATTACH type="full" alt="1677580291024.png"]273249[/ATTACH] [ATTACH type="full" alt="1677580341845.png"]273250[/ATTACH] [ATTACH type="full" alt="1677580435589.png"]273252[/ATTACH] CMD and PowerShell can be blocked by Exploit Protection, and Windows Script Host by Windows policy. Furthermore, the user can block several file types similarly to SRP. I used the Windows built-in mechanism for choosing the default application to open files, so the files from the BlockList are opened by default via RunBySmartscreen tool (unpublished version so far). This also allows whitelisting scripts and a few other file types when they are located in the %WindDir% or %ProgramFiles% folders. Such protection can be easily switched ON/OFF (current settings are remembered) from the application main Window. Furthermore, the user can open any blocked file via the 'Open with' option from the Explorer context menu (instead of whitelisting). By adding AppLocker (via WMI MDM Bridge) one could get protection similar to SAC (but more flexible). It is a nice tool, but If the SRP will work on Windows 11, I would prefer SimpleWindowsHardening (SWH) which is based on classic SRP. [/QUOTE]

Verification