Harden Windows Security - Blindez votre Windows sans installer un seul logiciel tiers !

https://fed.brid.gy/r/https://korben.info/harden-windows-security-blindage-windows-officiel.html

Why Security Awareness Training Matters

This demo highlights a critical truth: no matter how strong your security systems are, your users are the last line of defense.
It also exposes ClickFix—a rapidly emerging threat that exploits human trust. And as a sneak peek, you’ll get a glimpse of Glycon, my custom C2 server currently in development.
Stay vigilant. The weakest link isn’t always technology—it’s the human factor.

https://youtu.be/3iokAsq2wRs?si=KnBKl0EX0jXX7sS6

#c2 #Glycon #WDAC

Why Security Awareness Training Matters

YouTube

A new exploit that bypasses Windows Defender Application Control and leverages an advanced Command and Control (C2) method called Loki has been found.

https://www.technadu.com/new-exploit-for-bypassing-windows-defender-application-control-leverages-javascript-c2/581068/

#Electron #JavaScript #WDAC #C2Loki

New Exploit for Bypassing Windows Defender Application Control Leverages JavaScript C2

The novel Loki C2 framework developed entirely in JavaScrip allowed the bypass of WDAC policies and performing post-exploitation activities undetected.

TechNadu

🚀🔒 Validate Your AppLocker & WDAC Script Enforcement with ScriptHostTest.ps1! 🔒🚀

🔹 ✅ Validate AppLocker & WDAC: 🛡️ Test script execution in user & system paths seamlessly.

🔹 📝 Multiple File Types: Supports `.ps1`, `.bat`, `.vbs`, `.js`, `.hta`, and more! 📂✨

Check it out here: https://buff.ly/3UVaJOm

#CyberSecurity 🛡️ #AppLocker 🔒 #WDAC 🔐 #SecurityTools 🛠️ #Defenders 👮‍♂️ #ITSecurity 💻 #ThreatDetection 🕵️‍♀️

notes/utilities/ScriptHostTest at master · MHaggis/notes

Full of public notes and Utilities. Contribute to MHaggis/notes development by creating an account on GitHub.

GitHub

My 3rd post in the series went live as well the very next day.
This one is a little more involved. It is the script that handles compiling of the policy, and packaging it all up so it can be uploaded to Intune.

https://peterdodemont.com/wdac-compile-package.html

#PowerShell #ApplicationControl #Intune #WDAC #InfoSec

Compiling and packaging WDAC policies (WDAC management part 3)

The script that I use for compile WDAC policies and packaging them so they can be used by Intune.

Peter Dodemont

My 2nd post in this series went up over the weekend.
This one is a short one, but the #PowerShell script here is crucial to getting the policy loaded on your devices.

#ApplicationControl #Intune #WDAC #InfoSec

https://peterdodemont.com/wdac-refresh-policy.html

Refreshing the WDAC policy (WDAC management part 2)

The script that can be used to refresh the WDAC policy on a device.

Peter Dodemont

After nearly 2 years of not posting anything on my blog, putting something out last month reminded me of how satisfying it is to share knowledge that other might find useful. I'm hoping I can keep finding time to put more posts up.

My new post is the first post in a series showing how I am currently managing #WDAC through #intune.
I share the #PowerShell script I use to merge new items into the policies for the different groups.

#ApplicationControl #infosec

https://peterdodemont.com/wdac-policy-merge.html

Merging WDAC policy changes (WDAC management part 1)

Script to add items to the a WDAC XML policy.

Peter Dodemont

It's been nearly 2 years since I last published an article on my blog. But that changed today.
The article talks about an issue I encountered recently with WDAC and it's managed installer policy.

https://peterdodemont.com/non-working-wdac-managed-installer.html

#WDAC #ApplicationControl #Infosec

The mystery of the non working managed installer WDAC policy

How I solved the mystery of the WDAC managed installer policy not working on some devices

Peter Dodemont

Windows Defender Application Control (#WDAC) is one of the strongest protections against malicious code. It is to some extent an evolution of AppLocker, which we know from older Windows.

On the other hand, it is also one of the most complicated to deploy and therefore is usually not deployed on regular PCs, but only on specialized devices such as PAWs / SAWs.

Application Control restricts what applications and executables can be run on the device. As a baseline, you can block, for example, all code and software that is not signed. But you can go further and block specific applications or, conversely, block everything except what you explicitly allow.

Do you have App Control configured and deployed?

I just managed to get #WDAC up and running on my laptop without bricking it! This is very based and (hopefully) a good step forward for security for me.