the windows firewall is TRASH (not really tho)

Keypoints :

• The local Windows firewall provides granular control over network traffic for individual devices.
• Blocking outbound connections can help prevent lateral movement by cyber threats within an organization.
• The experiment focuses on using the firewall to restrict known living-off-the-land binaries that could be exploited by attackers.
• A thorough understanding of which applications need internet access is crucial before blocking traffic.
• The LoLBAS (Living Off the Land Binaries, Scripts, and Libraries) catalog aids in identifying potential risk programs on Windows systems.
• PowerShell scripts can be used to automate the process of blocking these binaries.
• While experimenting with firewall rules, it’s important to monitor system functionality to ensure critical services remain operational.
• Employing the firewall effectively can enhance an organization’s security posture by limiting attack vectors.
• Educational tools like Drop Zone AI’s Coach can empower analysts by providing context to security alerts.
• The experiment is presented with a playful tone, emphasizing the importance of proper coding practices in scripting.