If an attacker uses software already installed on windows to create a persistent connection, the industry calls this Clientless Malware or Living off the Land. This usually involves using Windows Powershell which is so easy to block using the built-in Defender firewall, i’m surprised it’s not blocked by default.<\/p>\n\n\n\n
I propose a fix for this in the form of a Windows Firewall rule<\/p>\n\n\n\n
Start, Run, mmc<\/p>\n\n\n\n
add Windows Defender<\/p>\n\n\n\n
Create a new rule, <\/p>\n\n\n\n
Rule Type = Program<\/p>\n\n\n\n
Use this progam path for 64bit Windows:<\/p>\n\n\n\n
%SystemRoot%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe<\/p>\n\n\n\n
Block the connection<\/p>\n\n\n\n
check the public box to prevent Powershell from communicating with the public Internet.<\/p>\n\n\n\n
Give your rule a name, i named mine _Powershell_Block_Public so it gets sorted to the very top of the list alphabetically<\/p>\n\n\n\n
for the description i used; Block Powershell connections to public IPs to prevent client-less malware<\/p>\n\n\n\n
Click finish <\/p>\n\n\n\n
Now find the rule you just created, right click it and choose enable.<\/p>\n\n\n\n
I am going to recommend this change for all RdWeb and Gateway servers.<\/p>\n\n\n\n
Unfortuneately Windoze does not allow Exporting\/Importing of a single rule. An export of all rules starts with the below:<\/p>\n\n\n\n
Name Group Profile Enabled Action Override Program Local Address Remote Address Protocol Local Port Remote Port Authorized Computers Authorized Local Principals Local User Owner Application Package
_Powershell_Block_Public Public Yes Block No %SystemRoot%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe Any Any Any Any Any Any Any Any Any <\/p>\n\n\n\n
After some testing I plan to convert this to a Group Policy so i can easily apply it to all workstations. Stay tuned for that HowTo. <\/p>\n","protected":false},"excerpt":{"rendered":"
If an attacker uses software already installed on windows to create a persistent connection, the industry calls this Clientless Malware or Living off the Land. This usually involves using Windows…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2,19,21],"class_list":["post-167","post","type-post","status-publish","format-standard","hentry","category-uncategorised","tag-personal","tag-rdweb","tag-windows"],"_links":{"self":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=167"}],"version-history":[{"count":7,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/167\/revisions"}],"predecessor-version":[{"id":174,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/167\/revisions\/174"}],"wp:attachment":[{"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}