Realistically, do we still need to block
certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only for Windows.
if we worry about Lolbins, does it mean that we are contemplating a scenario where all other lines of defenses have failed, specially those that I mentioned, and the only protection left is a Windows Firewall rule blocking, e.g.
cmd.exe from connecting to the Internet?
if that's the only line of defense left, doesn't that mean whatever got into the system and managed to get past all other security measures, might as well disable that firewall rule blocking
cmd.exe and do its thing?