1

https://lolbas-project.github.io/

Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only for Windows.

There are Attack Surface Reduction rules, Advanced Windows Defender features, Arbitary Code Guard, Exploit Protection, VBS and many more advanced features.

if we worry about Lolbins, does it mean that we are contemplating a scenario where all other lines of defenses have failed, specially those that I mentioned, and the only protection left is a Windows Firewall rule blocking, e.g. cmd.exe from connecting to the Internet?

if that's the only line of defense left, doesn't that mean whatever got into the system and managed to get past all other security measures, might as well disable that firewall rule blocking cmd.exe and do its thing?

1 Answer 1

0

This is certainly a defense in depth strategy, it is much better that malicious actors are not able to run code in cmd.exe, but it is still valid. These types of attacks often can only execute a small amount of shell code and will try to connect outwards to get the rest of the malware. If the snippet does not know what to do about a firewall rule the attack would be mitigated.

Is the handoff between usability and security worth it for you to block the "LOLBINS"? Personally, I do not know anyone who uses such firewall rules, but I could imagine them in a hardened environment like a server.

You must log in to answer this question.