{"id":348,"title":"Windows 11 G\u00fcvenlik Duvar\u0131 LOLBin Engelleme Script'i","content":"<p>Bu PowerShell script'i, Windows 11 sistemlerinde&nbsp;<strong>Living Off the Land Binaries (LOLBins)<\/strong> olarak bilinen ve sald\u0131rganlar taraf\u0131ndan s\u0131k&ccedil;a k&ouml;t&uuml;ye kullan\u0131lan Windows sistem dosyalar\u0131n\u0131n giden trafi\u011fini engelleyerek g&uuml;venli\u011fi art\u0131rmay\u0131 hedeflemektedir.<\/p>\r\n<h2><iframe src=\"https:\/\/www.youtube.com\/embed\/U5yfnlpgm9U\" width=\"560\" height=\"314\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/h2>\r\n<h2>LOLBin Nedir?<\/h2>\r\n<p>LOLBin (Living Off the Land Binary), Windows i\u015fletim sisteminde varsay\u0131lan olarak bulunan ve k&ouml;t&uuml; ama&ccedil;l\u0131 faaliyetler i&ccedil;in kullan\u0131labilen me\u015fru programlard\u0131r. Sald\u0131rganlar bu ara&ccedil;lar\u0131 kullanarak:<\/p>\r\n<ul>\r\n<li>Antivir&uuml;s tespitinden ka&ccedil;\u0131nabilir<\/li>\r\n<li>AppLocker kontrollerini atlayabilir<\/li>\r\n<li>Command &amp; Control (C2) ileti\u015fimi kurabilir<\/li>\r\n<li>Veri s\u0131zd\u0131rabilir<\/li>\r\n<\/ul>\r\n<h2>Script'in Temel &Ouml;zellikleri<\/h2>\r\n<h3>1. <strong>G&uuml;venlik Duvar\u0131 Profil Sertle\u015ftirme<\/strong><\/h3>\r\n<pre><code class=\"language-powershell\"># T&uuml;m profiller i&ccedil;in varsay\u0131lan engelleme\r\nSet-NetFirewallProfile -Profile Domain,Private,Public `\r\n    -Enabled True `\r\n    -DefaultInboundAction Block `\r\n    -DefaultOutboundAction Allow\r\n<\/code><\/pre>\r\n<h3>2. <strong>Kritik Port Engellemeleri<\/strong><\/h3>\r\n<ul>\r\n<li><strong>SMB (445, 139)<\/strong>: Lateral movement engellemesi<\/li>\r\n<li><strong>RDP (3389)<\/strong>: Uzaktan eri\u015fim g&uuml;venli\u011fi<\/li>\r\n<li><strong>WinRM (5985\/5986)<\/strong>: PowerShell remoting korumas\u0131<\/li>\r\n<li><strong>RPC (135)<\/strong>: WMI\/DCOM sald\u0131r\u0131 vekt&ouml;r&uuml; engelleme<\/li>\r\n<\/ul>\r\n<h3>3. <strong>LOLBin Engellemeleri<\/strong><\/h3>\r\n<h2>&nbsp;Engellenen LOLBin Listesi ve Riskleri<\/h2>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th><strong>LOLBin<\/strong><\/th>\r\n<th><strong>Risk Seviyesi<\/strong><\/th>\r\n<th><strong>K&ouml;t&uuml;ye Kullan\u0131m Senaryolar\u0131<\/strong><\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td><strong>PowerShell.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Kritik<\/td>\r\n<td>Malware indirme, C2 ileti\u015fimi, kod &ccedil;al\u0131\u015ft\u0131rma<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Certutil.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>Base64 decode, dosya indirme, sertifika manip&uuml;lasyonu<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Regsvr32.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>Proxy execution, DLL y&uuml;kleme, bypass teknikleri<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Rundll32.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>DLL &ccedil;al\u0131\u015ft\u0131rma, process injection<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>MSBuild.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Orta<\/td>\r\n<td>Kod derleme ve &ccedil;al\u0131\u015ft\u0131rma<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Wmic.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>WMI komut &ccedil;al\u0131\u015ft\u0131rma, bilgi toplama<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Wscript\/Cscript<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>VBS\/JS malware &ccedil;al\u0131\u015ft\u0131rma<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>BitsAdmin.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Orta<\/td>\r\n<td>Dosya transferi, persistence<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Curl.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Orta<\/td>\r\n<td>Veri s\u0131zd\u0131rma, dosya indirme<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>FTP.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f D&uuml;\u015f&uuml;k<\/td>\r\n<td>Dosya transferi<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h2>Script'i G&uuml;venli Uygulama<\/h2>\r\n<h3>&Ouml;n Haz\u0131rl\u0131k<\/h3>\r\n<pre><code class=\"language-powershell\"># 1. Mevcut kurallar\u0131 yedekle\r\nnetsh advfirewall export \"C:\\Backup\\firewall_backup.wfw\"\r\n\r\n# 2. Script'i test ortam\u0131nda dene\r\n# Test VM'de &ccedil;al\u0131\u015ft\u0131r ve sonu&ccedil;lar\u0131 g&ouml;zlemle\r\n\r\n# 3. \u0130zin verilecek sunucular\u0131 tan\u0131mla\r\n$AllowedSMBServers = @(\r\n    \"192.168.1.10\",  # Domain Controller\r\n    \"192.168.1.20\"   # File Server\r\n)\r\n<\/code><\/pre>\r\n<h3>&Ouml;zelle\u015ftirilmi\u015f Uygulama<\/h3>\r\n<pre><code class=\"language-powershell\"># Organizasyona &ouml;zel LOLBin ekleme\r\n$CustomLOLBins = @(\r\n    @{ Name = \"Block TeamViewer\"; Path = \"C:\\Program Files\\TeamViewer\\TeamViewer.exe\" },\r\n    @{ Name = \"Block AnyDesk\"; Path = \"C:\\Program Files\\AnyDesk\\AnyDesk.exe\" }\r\n)\r\n\r\n# Script'e ekle\r\nforeach ($item in $CustomLOLBins) {\r\n    Ensure-ProgramBlockRule -Name $item.Name -ProgramPath $item.Path\r\n}\r\n<\/code><\/pre>\r\n<h2>Monitoring ve Logging<\/h2>\r\n<h3>PowerShell ile Log Analizi<\/h3>\r\n<pre><code class=\"language-powershell\"># Engellenen trafi\u011fi izleme\r\nfunction Get-BlockedTraffic {\r\n    $logPath = \"$env:windir\\system32\\LogFiles\\Firewall\\pfirewall.log\"\r\n    Get-Content $logPath -Tail 100 | \r\n        Where-Object {$_ -match \"DROP\"} |\r\n        ConvertFrom-Csv -Delimiter \" \" |\r\n        Select-Object date, time, action, protocol, src-ip, dst-ip, dst-port\r\n}\r\n\r\n# Rapor olu\u015fturma\r\nGet-BlockedTraffic | \r\n    Group-Object dst-port | \r\n    Sort-Object Count -Descending |\r\n    Select-Object Count, Name |\r\n    Export-Csv \"C:\\Reports\\blocked_traffic.csv\"\r\n<\/code><\/pre>\r\n<h2>Potansiyel Sorunlar ve &Ccedil;&ouml;z&uuml;mleri<\/h2>\r\n<h3>1. <strong>Me\u015fru Uygulama Engellemeleri<\/strong><\/h3>\r\n<pre><code class=\"language-powershell\"># Whitelist olu\u015fturma\r\n$WhitelistApps = @(\r\n    \"C:\\Program Files\\Microsoft\\Exchange Server\\*\",\r\n    \"C:\\Program Files\\SQL Server\\*\"\r\n)\r\n\r\n# \u0130stisna kural\u0131 ekleme\r\nforeach ($app in $WhitelistApps) {\r\n    New-NetFirewallRule -DisplayName \"Allow $app\" `\r\n        -Direction Outbound `\r\n        -Program $app `\r\n        -Action Allow `\r\n        -Priority 1\r\n}\r\n<\/code><\/pre>\r\n<h3>2. <strong>PowerShell Gereksinimi<\/strong><\/h3>\r\n<pre><code class=\"language-powershell\"># G&uuml;venilir host'lar i&ccedil;in izin\r\n$TrustedHosts = @(\"10.0.0.5\", \"10.0.0.10\")\r\nforeach ($host in $TrustedHosts) {\r\n    New-NetFirewallRule -DisplayName \"Allow PowerShell to $host\" `\r\n        -Direction Outbound `\r\n        -Program \"$env:windir\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" `\r\n        -RemoteAddress $host `\r\n        -Action Allow\r\n}\r\n<\/code><\/pre>\r\n<h2>Alternatif Yakla\u015f\u0131mlar<\/h2>\r\n<h3>1. <strong>AppLocker Entegrasyonu<\/strong><\/h3>\r\n<pre><code class=\"language-xml\"><!-- AppLocker politikas\u0131 ile birlikte kullan\u0131m -->\r\n\r\n  \r\n    \r\n      \r\n        \r\n      \r\n    \r\n  \r\n\r\n<\/code><\/pre>\r\n<h3>2. <strong>WDAC (Windows Defender Application Control)<\/strong><\/h3>\r\n<pre><code class=\"language-powershell\"># WDAC politikas\u0131 olu\u015fturma\r\nNew-CIPolicy -Level Publisher `\r\n    -FilePath \".\\WDAC-Policy.xml\" `\r\n    -UserPEs `\r\n    -Deny \"C:\\Windows\\System32\\certutil.exe\"\r\n<\/code><\/pre>\r\n<h2>Performans Etkisi ve Optimizasyon<\/h2>\r\n<pre><code class=\"language-powershell\"># Kural say\u0131s\u0131n\u0131 kontrol et\r\n(Get-NetFirewallRule | Where-Object {$_.DisplayName -like \"W11-HARDENING*\"}).Count\r\n\r\n# Performans metrikleri\r\nMeasure-Command {\r\n    Get-NetFirewallRule | Where-Object {$_.Enabled -eq $true}\r\n} | Select-Object TotalMilliseconds\r\n\r\n# Optimize edilmi\u015f kural gruplamas\u0131\r\n# Tek tek kural yerine grup halinde uygulama\r\n$LOLBinPaths = @(\r\n    \"$env:windir\\System32\\certutil.exe\",\r\n    \"$env:windir\\System32\\regsvr32.exe\",\r\n    \"$env:windir\\System32\\rundll32.exe\"\r\n)\r\n\r\nNew-NetFirewallRule -DisplayName \"Block All LOLBins\" `\r\n    -Direction Outbound `\r\n    -Program $LOLBinPaths `\r\n    -Action Block\r\n<\/code><\/pre>\r\n<h2>De\u011ferlendirme Metrikleri<\/h2>\r\n<h3>Script Etkinli\u011fi Kontrol&uuml;<\/h3>\r\n<pre><code class=\"language-powershell\"># Test senaryolar\u0131\r\nfunction Test-LOLBinBlocking {\r\n    $tests = @{\r\n        \"Certutil\" = { certutil.exe -urlcache -f http:\/\/example.com\/test.txt }\r\n        \"PowerShell\" = { Invoke-WebRequest -Uri http:\/\/example.com }\r\n        \"BitsAdmin\" = { bitsadmin \/transfer test http:\/\/example.com\/file C:\\temp\\file }\r\n    }\r\n    \r\n    foreach ($test in $tests.GetEnumerator()) {\r\n        try {\r\n            &amp; $test.Value\r\n            Write-Host \"\u274c $($test.Key) - BLOCKED FAILED\" -ForegroundColor Red\r\n        } catch {\r\n            Write-Host \"\u2705 $($test.Key) - Successfully Blocked\" -ForegroundColor Green\r\n        }\r\n    }\r\n}\r\n<\/code><\/pre>\r\n<h2>G&uuml;venlik En \u0130yi Uygulamalar\u0131<\/h2>\r\n<ol>\r\n<li>\r\n<p><strong>Kademeli Da\u011f\u0131t\u0131m<\/strong><\/p>\r\n<ul>\r\n<li>&Ouml;nce test ortam\u0131nda uygula<\/li>\r\n<li>Pilot grup ile ba\u015fla<\/li>\r\n<li>Log'lar\u0131 analiz et<\/li>\r\n<li>T&uuml;m sisteme yay<\/li>\r\n<\/ul>\r\n<\/li>\r\n<li>\r\n<p><strong>D&uuml;zenli G&uuml;ncelleme<\/strong><\/p>\r\n<ul>\r\n<li>Yeni LOLBin'leri takip et<\/li>\r\n<li>MITRE ATT&amp;CK g&uuml;ncellemelerini kontrol et<\/li>\r\n<li>Ayl\u0131k g&ouml;zden ge&ccedil;irme yap<\/li>\r\n<\/ul>\r\n<\/li>\r\n<li>\r\n<p><strong>Kompansatuar Kontroller<\/strong><\/p>\r\n<ul>\r\n<li>EDR &ccedil;&ouml;z&uuml;m&uuml; kullan<\/li>\r\n<li>Sysmon loglama aktif et<\/li>\r\n<li>SIEM entegrasyonu sa\u011fla<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ol>\r\n<p>Bu script,&nbsp;<strong>Defense in Depth<\/strong> stratejisinin &ouml;nemli bir par&ccedil;as\u0131d\u0131r ve:<\/p>\r\n<ul>\r\n<li>\u2705 C2 ileti\u015fimini zorla\u015ft\u0131r\u0131r<\/li>\r\n<li>\u2705 Veri s\u0131zd\u0131rma riskini azalt\u0131r<\/li>\r\n<li>\u2705 APT sald\u0131r\u0131lar\u0131na kar\u015f\u0131 diren&ccedil; sa\u011flar<\/li>\r\n<li>\u2705 CIS ve Microsoft Security Baseline ile uyumludur<\/li>\r\n<\/ul>\r\n<p><strong>Kritik Not<\/strong>: Script'i uygulamadan &ouml;nce mutlaka:<\/p>\r\n<ol>\r\n<li>Test ortam\u0131nda deneyin<\/li>\r\n<li>\u0130\u015f kritik uygulamalar\u0131 belirleyin<\/li>\r\n<li>Rollback plan\u0131 haz\u0131rlay\u0131n<\/li>\r\n<li>Monitoring altyap\u0131s\u0131n\u0131 kurun<\/li>\r\n<\/ol>\r\n<p>Bu yakla\u015f\u0131m, &ouml;zellikle <strong>Zero Trust<\/strong> mimarisi benimseyen organizasyonlar i&ccedil;in g&uuml;&ccedil;l&uuml; bir g&uuml;venlik katman\u0131 sa\u011flamaktad\u0131r.<\/p>\r\n<pre class=\"language-csharp\"><code>&lt;#\r\n\r\n.SYNOPSIS\r\n\r\n Windows 11 Pro Firewall Hardening Script\r\n\r\n.DESCRIPTION\r\n\r\n Implements firewall hardening recommendations:\r\n\r\n - Secure profile defaults (Domain\/Private\/Public)\r\n\r\n - Block high-risk inbound ports (SMB, RDP, WinRM, WMI\/DCOM, discovery protocols)\r\n\r\n - Restrict outbound SMB to approved servers\r\n\r\n - Block outbound traffic from commonly abused Windows binaries (LOLBins)\r\n\r\n - Disable local firewall rule overrides\r\n\r\n.NOTES\r\n\r\n Run as Administrator.\r\n\r\n Test in a lab before broad deployment.\r\n\r\n#&gt;\r\n\r\n$ErrorActionPreference = \"Stop\"\r\n\r\n# ============================\r\n\r\n# CONFIGURABLE SETTINGS\r\n\r\n# ============================\r\n\r\n# List of file servers allowed to receive outbound SMB (TCP 445) from this workstation.\r\n\r\n# Use IP addresses or CIDR ranges. Leave empty to block all outbound SMB. Include Domain Controllers and File Servers here:\r\n\r\n$AllowedSMBServers = @(\r\n\r\n # \"192.168.10.10\",\r\n\r\n # \"10.0.0.5\"\r\n\r\n)\r\n\r\n# Whether to block inbound RDP (recommended unless you explicitly use RDP to this PC)\r\n\r\n$BlockRDPInbound = $true\r\n\r\n# Name prefix for all rules this script manages\r\n\r\n$RulePrefix = \"W11-HARDEN - \"\r\n\r\n# ============================\r\n\r\n# HELPER FUNCTIONS\r\n\r\n# ============================\r\n\r\nfunction Set-FirewallProfileSecure {\r\n\r\n param(\r\n\r\n [Parameter(Mandatory)][ValidateSet(\"Domain\",\"Private\",\"Public\")]\r\n\r\n [string]$ProfileName\r\n\r\n )\r\n\r\n Write-Host \"Configuring firewall profile: $ProfileName\"\r\n\r\n Set-NetFirewallProfile -Profile $ProfileName `\r\n\r\n -Enabled True `\r\n\r\n -DefaultInboundAction Block `\r\n\r\n -DefaultOutboundAction Allow `\r\n\r\n -NotifyOnListen False `\r\n\r\n -AllowLocalFirewallRules False `\r\n\r\n -AllowLocalIPsecRules False `\r\n\r\n -Verbose:$false\r\n\r\n}\r\n\r\nfunction Ensure-PortRule {\r\n\r\n param(\r\n\r\n [Parameter(Mandatory)][string]$Name,\r\n\r\n [Parameter(Mandatory)][ValidateSet(\"Inbound\",\"Outbound\")][string]$Direction,\r\n\r\n [Parameter(Mandatory)][ValidateSet(\"Allow\",\"Block\")][string]$Action,\r\n\r\n [Parameter(Mandatory)][string]$Protocol,\r\n\r\n [Parameter()][string]$LocalPort = \"\",\r\n\r\n [Parameter()][string]$RemotePort = \"\",\r\n\r\n [Parameter()][string]$RemoteAddress = \"Any\"\r\n\r\n )\r\n\r\n $displayName = \"$RulePrefix$Name\"\r\n\r\n $existing = Get-NetFirewallRule -DisplayName $displayName -ErrorAction SilentlyContinue\r\n\r\n $baseParams = @{\r\n\r\n DisplayName = $displayName\r\n\r\n Direction = $Direction\r\n\r\n Action = $Action\r\n\r\n Enabled = 'True'\r\n\r\n Profile = 'Any'\r\n\r\n }\r\n\r\n if ($existing) {\r\n\r\n Write-Host \"Updating rule: $displayName\"\r\n\r\n Set-NetFirewallRule -DisplayName $displayName @baseParams -ErrorAction SilentlyContinue | Out-Null\r\n\r\n # Update port filter\r\n\r\n $filterParams = @{\r\n\r\n Protocol = $Protocol\r\n\r\n }\r\n\r\n if ($LocalPort) { $filterParams.LocalPort = $LocalPort }\r\n\r\n if ($RemotePort) { $filterParams.RemotePort = $RemotePort }\r\n\r\n Get-NetFirewallRule -DisplayName $displayName |\r\n\r\n Set-NetFirewallPortFilter @filterParams -ErrorAction SilentlyContinue | Out-Null\r\n\r\n # Update remote address if applicable\r\n\r\n if ($RemoteAddress -and $RemoteAddress -ne \"Any\") {\r\n\r\n Set-NetFirewallRule -DisplayName $displayName -RemoteAddress $RemoteAddress | Out-Null\r\n\r\n } else {\r\n\r\n Set-NetFirewallRule -DisplayName $displayName -RemoteAddress Any | Out-Null\r\n\r\n }\r\n\r\n }\r\n\r\n else {\r\n\r\n Write-Host \"Creating rule: $displayName\"\r\n\r\n $newParams = $baseParams.Clone()\r\n\r\n $newParams[\"Protocol\"] = $Protocol\r\n\r\n if ($LocalPort) { $newParams[\"LocalPort\"] = $LocalPort }\r\n\r\n if ($RemotePort) { $newParams[\"RemotePort\"] = $RemotePort }\r\n\r\n if ($RemoteAddress) { $newParams[\"RemoteAddress\"] = $RemoteAddress }\r\n\r\n New-NetFirewallRule @newParams | Out-Null\r\n\r\n }\r\n\r\n}\r\n\r\nfunction Ensure-ProgramBlockRule {\r\n\r\n param(\r\n\r\n [Parameter(Mandatory)][string]$Name,\r\n\r\n [Parameter(Mandatory)][string]$ProgramPath\r\n\r\n )\r\n\r\n if (-not (Test-Path $ProgramPath)) {\r\n\r\n Write-Host \"Skipping (file not found): $ProgramPath\"\r\n\r\n return\r\n\r\n }\r\n\r\n $displayName = \"$RulePrefix$Name\"\r\n\r\n $existing = Get-NetFirewallRule -DisplayName $displayName -ErrorAction SilentlyContinue\r\n\r\n if ($existing) {\r\n\r\n Write-Host \"Updating program block rule: $displayName\"\r\n\r\n Set-NetFirewallRule -DisplayName $displayName `\r\n\r\n -Direction Outbound `\r\n\r\n -Action Block `\r\n\r\n -Enabled True `\r\n\r\n -Profile Any `\r\n\r\n -Program $ProgramPath | Out-Null\r\n\r\n }\r\n\r\n else {\r\n\r\n Write-Host \"Creating program block rule: $displayName\"\r\n\r\n New-NetFirewallRule -DisplayName $displayName `\r\n\r\n -Direction Outbound `\r\n\r\n -Action Block `\r\n\r\n -Enabled True `\r\n\r\n -Profile Any `\r\n\r\n -Program $ProgramPath | Out-Null\r\n\r\n }\r\n\r\n}\r\n\r\n# ============================\r\n\r\n# 1. SECURE FIREWALL PROFILES\r\n\r\n# ============================\r\n\r\nSet-FirewallProfileSecure -ProfileName Domain\r\n\r\nSet-FirewallProfileSecure -ProfileName Private\r\n\r\nSet-FirewallProfileSecure -ProfileName Public\r\n\r\n# Enable basic logging (you can adjust paths\/sizes as needed)\r\n\r\nWrite-Host \"Enabling firewall logging...\"\r\n\r\nSet-NetFirewallProfile -Profile Domain,Private,Public `\r\n\r\n -LogFileName '%systemroot%\\system32\\LogFiles\\Firewall\\pfirewall.log' `\r\n\r\n -LogMaxSizeKilobytes 16384 `\r\n\r\n -LogAllowed True `\r\n\r\n -LogBlocked True | Out-Null\r\n\r\n# ============================\r\n\r\n# 2. INBOUND HARDENING RULES\r\n\r\n# ============================\r\n\r\nWrite-Host \"`nConfiguring inbound hardening rules...\"\r\n\r\n# SMB\/CIFS inbound: block\r\n\r\nEnsure-PortRule -Name \"Inbound Block SMB TCP 445\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 445\r\n\r\nEnsure-PortRule -Name \"Inbound Block SMB TCP 139\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 139\r\n\r\nEnsure-PortRule -Name \"Inbound Block NetBIOS UDP 137\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 137\r\n\r\nEnsure-PortRule -Name \"Inbound Block NetBIOS UDP 138\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 138\r\n\r\n# RDP inbound (TCP 3389)\r\n\r\nif ($BlockRDPInbound) {\r\n\r\n Ensure-PortRule -Name \"Inbound Block RDP TCP 3389\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 3389\r\n\r\n}\r\n\r\n# WinRM inbound (5985\/5986)\r\n\r\nEnsure-PortRule -Name \"Inbound Block WinRM TCP 5985\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 5985\r\n\r\nEnsure-PortRule -Name \"Inbound Block WinRM TCP 5986\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 5986\r\n\r\n# WMI\/DCOM RPC endpoint (TCP 135)\r\n\r\nEnsure-PortRule -Name \"Inbound Block RPC Endpoint Mapper TCP 135\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 135\r\n\r\n# Discovery \/ legacy protocols\r\n\r\nEnsure-PortRule -Name \"Inbound Block SSDP UDP 1900\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 1900\r\n\r\nEnsure-PortRule -Name \"Inbound Block mDNS UDP 5353\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 5353\r\n\r\nEnsure-PortRule -Name \"Inbound Block LLMNR UDP 5355\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 5355\r\n\r\nEnsure-PortRule -Name \"Inbound Block WSD UDP 3702\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 3702\r\n\r\nEnsure-PortRule -Name \"Inbound Block TFTP UDP 69\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 69\r\n\r\n# (Optional) ICMP echo blocking could be added here if desired.\r\n\r\n# ============================\r\n\r\n# 3. OUTBOUND SMB RESTRICTIONS\r\n\r\n# ============================\r\n\r\nWrite-Host \"`nConfiguring outbound SMB controls...\"\r\n\r\n# Allow outbound SMB only to approved servers\r\n\r\nif ($AllowedSMBServers.Count -gt 0) {\r\n\r\n foreach ($server in $AllowedSMBServers) {\r\n\r\n Ensure-PortRule -Name \"Outbound Allow SMB to $server\" `\r\n\r\n -Direction Outbound -Action Allow -Protocol TCP -RemotePort 445 -RemoteAddress $server\r\n\r\n }\r\n\r\n}\r\n\r\n# Block all other outbound SMB\r\n\r\nEnsure-PortRule -Name \"Outbound Block SMB TCP 445 All\" `\r\n\r\n -Direction Outbound -Action Block -Protocol TCP -RemotePort 445 -RemoteAddress \"Any\"\r\n\r\n# ============================\r\n\r\n# 4. OUTBOUND DISCOVERY \/ LEGACY PROTOCOL BLOCKS\r\n\r\n# ============================\r\n\r\nWrite-Host \"`nConfiguring outbound discovery protocol blocks...\"\r\n\r\nEnsure-PortRule -Name \"Outbound Block SSDP UDP 1900\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 1900\r\n\r\nEnsure-PortRule -Name \"Outbound Block mDNS UDP 5353\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 5353\r\n\r\nEnsure-PortRule -Name \"Outbound Block LLMNR UDP 5355\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 5355\r\n\r\nEnsure-PortRule -Name \"Outbound Block WSD UDP 3702\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 3702\r\n\r\nEnsure-PortRule -Name \"Outbound Block TFTP UDP 69\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 69\r\n\r\n# ============================\r\n\r\n# 5. OUTBOUND PROGRAM-LEVEL BLOCKS (LOLBINS)\r\n\r\n# ============================\r\n\r\nWrite-Host \"`nConfiguring outbound program-level blocks (LOLBins)...\"\r\n\r\n$system32 = Join-Path $env:WINDIR \"System32\"\r\n\r\n$syswow64 = Join-Path $env:WINDIR \"SysWOW64\"\r\n\r\n$psv1Path = Join-Path $system32 \"WindowsPowerShell\\v1.0\"\r\n\r\n$pswowv1 = Join-Path $syswow64 \"WindowsPowerShell\\v1.0\"\r\n\r\n$ProgramBlockList = @(\r\n\r\n # PowerShell\r\n\r\n @{ Name = \"Block Outbound PowerShell (x64)\"; Path = Join-Path $psv1Path \"powershell.exe\" },\r\n\r\n @{ Name = \"Block Outbound PowerShell ISE (x64)\"; Path = Join-Path $psv1Path \"powershell_ise.exe\" },\r\n\r\n @{ Name = \"Block Outbound PowerShell (x86)\"; Path = Join-Path $pswowv1 \"powershell.exe\" },\r\n\r\n @{ Name = \"Block Outbound PowerShell ISE (x86)\"; Path = Join-Path $pswowv1 \"powershell_ise.exe\" },\r\n\r\n # Windows scripting\r\n\r\n @{ Name = \"Block Outbound wscript\"; Path = Join-Path $system32 \"wscript.exe\" },\r\n\r\n @{ Name = \"Block Outbound cscript\"; Path = Join-Path $system32 \"cscript.exe\" },\r\n\r\n @{ Name = \"Block Outbound mshta\"; Path = Join-Path $system32 \"mshta.exe\" },\r\n\r\n # Downloaders \/ transfer tools\r\n\r\n @{ Name = \"Block Outbound certutil\"; Path = Join-Path $system32 \"certutil.exe\" },\r\n\r\n @{ Name = \"Block Outbound bitsadmin\"; Path = Join-Path $system32 \"bitsadmin.exe\" },\r\n\r\n @{ Name = \"Block Outbound curl\"; Path = Join-Path $system32 \"curl.exe\" },\r\n\r\n @{ Name = \"Block Outbound ftp\"; Path = Join-Path $system32 \"ftp.exe\" },\r\n\r\n @{ Name = \"Block Outbound tftp\"; Path = Join-Path $system32 \"tftp.exe\" },\r\n\r\n # WMI and management\r\n\r\n @{ Name = \"Block Outbound wmic\"; Path = Join-Path $system32 \"wbem\\wmic.exe\" },\r\n\r\n # LOLBins commonly abused for code execution\r\n\r\n @{ Name = \"Block Outbound regsvr32\"; Path = Join-Path $system32 \"regsvr32.exe\" },\r\n\r\n @{ Name = \"Block Outbound rundll32\"; Path = Join-Path $system32 \"rundll32.exe\" },\r\n\r\n # Dev \/ build tools\r\n\r\n @{ Name = \"Block Outbound MSBuild\"; Path = Join-Path $system32 \"MSBuild.exe\" },\r\n\r\n @{ Name = \"Block Outbound msxsl\"; Path = Join-Path $system32 \"msxsl.exe\" },\r\n\r\n # Injection &amp; remote tools\r\n\r\n @{ Name = \"Block Outbound mavinject\"; Path = Join-Path $system32 \"mavinject.exe\" },\r\n\r\n # Remote admin \/ post-ex tools (if present)\r\n\r\n @{ Name = \"Block Outbound PsExec\"; Path = \"C:\\Windows\\System32\\psexec.exe\" },\r\n\r\n @{ Name = \"Block Outbound PAExec\"; Path = \"C:\\Windows\\System32\\paexec.exe\" },\r\n\r\n # Quick Assist (if present)\r\n\r\n @{ Name = \"Block Outbound Quick Assist\"; Path = Join-Path $system32 \"quickassist.exe\" }\r\n\r\n)\r\n\r\nforeach ($item in $ProgramBlockList) {\r\n\r\n Ensure-ProgramBlockRule -Name $item.Name -ProgramPath $item.Path\r\n\r\n}\r\n\r\nWrite-Host \"`nFirewall hardening complete.\" -ForegroundColor Green<\/code><\/pre>","excerpt":"","created_at":"2025-11-26 17:34:05","updated_at":"2026-09-07 06:59:33","category_id":7,"view_count":735,"reading_time":10,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-26 14:34:00","featured_image":"2120641a2116dffa518b171cb74b0a1e.png","slug":"windows-11-guvenlik-duvari-lolbin-engelleme-scripti","category_name":"Cyber Security","category_slug":"cyber-security"}