3 ms·

>Typically this 3rd party software disables Defender I run Glasswire [1] which started as a detailed bandwidth monitor but now has a firewall feature that sits

>Typically this 3rd party software disables Defender I run Glasswire [1] which started as a detailed bandwidth monitor but now has a firewall feature that sits on top of Defender and works with the rules list so not trying to replace anything. Its simple and adds the biggest win in this article's list of recommendations imho which is Block on Fist Sight. In addition to asking, Glasswire also checks every new or updated network service requestor's VirusTotal score. No Group Policy or PowerShell magic required. [1] www.glasswire.com

h0ek 5y ago
Never heard about Glasswire, looks interesting. I definitely need to take a look. Thank you for the comment!
elesiuta 5y ago
I think GlassWire's bandwidth monitor is great, but don't think their firewall feature is equivalent to "Block on First Sight." Taking a quick look MAPS block at first sight, it appears to look at both the executable file and non-portable executable files such as JS, VBS, or macros, then stop execution, however it isn't clear if this also includes things such as dll files or the python script being executed by python.exe. The firewall feature of GlassWire, or any application level firewall will only block traffic for your typical, well behaved programs, to save some bandwidth, and possibly block some telemetry if the program isn't too mischievous. This is because GlassWire doesn't stop the program, and can't tell if you're the one running the executable or another application is running it programmatically, so if EvilApp.exe notices it can't connect to the internet, it could just use something innocent you've allowed such as Firefox or python to send/receive data on its behalf (or just do that from the start). This is why it's still important to check the bandwidth of programs you trust for abnormalities, even if you've only allowed trusted programs and block everything else, and why it's so important to keep programs up to date and only run stuff you don't fully trust in a sandbox (since I doubt MAPS block on first sight is perfect either).
- jimmySixDOF 5y ago
  Thanks for that clarification & I agree the best solution is always going to be keeping a close eye on your top talkers and understanding what the normal baseline should look like.

h0ek 5y ago

Never heard about Glasswire, looks interesting. I definitely need to take a look. Thank you for the comment!

elesiuta 5y ago

I think GlassWire's bandwidth monitor is great, but don't think their firewall feature is equivalent to "Block on First Sight." Taking a quick look MAPS block at first sight, it appears to look at both the executable file and non-portable executable files such as JS, VBS, or macros, then stop execution, however it isn't clear if this also includes things such as dll files or the python script being executed by python.exe. The firewall feature of GlassWire, or any application level firewall will only block traffic for your typical, well behaved programs, to save some bandwidth, and possibly block some telemetry if the program isn't too mischievous. This is because GlassWire doesn't stop the program, and can't tell if you're the one running the executable or another application is running it programmatically, so if EvilApp.exe notices it can't connect to the internet, it could just use something innocent you've allowed such as Firefox or python to send/receive data on its behalf (or just do that from the start). This is why it's still important to check the bandwidth of programs you trust for abnormalities, even if you've only allowed trusted programs and block everything else, and why it's so important to keep programs up to date and only run stuff you don't fully trust in a sandbox (since I doubt MAPS block on first sight is perfect either).

jimmySixDOF 5y ago
Thanks for that clarification & I agree the best solution is always going to be keeping a close eye on your top talkers and understanding what the normal baseline should look like.