Blocking EVERYTHING with Windows Firewall
Source: YouTube · John Hammond · published May 6, 2025 · 29:45
The local Windows firewall is a powerful, underutilized tool for endpoint security, capable of blocking lateral movement by restricting outbound traffic from "living off the land" binaries 0:16-0:38.
Key Takeaways:
• The experiment blocks outbound connections from common living off the land binaries (e.g., BITS Admin, PowerShell, util.exe) using PowerShell scripts and the Windows firewall API 2:00-2:45.
• A script pulls data from the Lolbass repository, validates binary paths, and applies firewall rules to restrict outbound traffic 4:00-13:50.
• Performance issues arise due to PowerShell version limitations, but job concurrency improves execution speed 16:46-17:10.
• Attempts to download files using tools like util.exe are blocked, confirming the firewall's effectiveness 23:14-23:51.
• Core tools like PowerShell and Edge remain functional, demonstrating minimal disruption to critical services 27:11-27:38.
The local Windows firewall should be leveraged more in endpoint security to reduce internal attack surfaces under an "assume breach" model.
Sources:
- 0:16-0:38 Discussion on the local Windows firewall as a critical endpoint security tool
- 2:00-2:45 Overview of living off the land binaries and experiment setup
- 4:00-13:50 Script development and firewall rule implementation
- 16:46-17:10 Performance limitations and concurrency improvements in PowerShell script
- [23:14-23:51](https://www.youtube.com/
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
The local Windows firewall is pretty good and I don't think it gets enough love. I think it's honestly slept on and no one really uses it to its full potential because it is like the single source of truth or at least a source of truth on one computer, one device, one endpoint where you can control what goes in and out. So you're not relying on some broad networkwide maybe firewall at the gateway, but you've got something between each individual machine. And if you have that managed across a fleet of devices, then you can really lock down what could end up being lateral movement when thread actors, hackers, or malware try to move throughout your environment. So, in this video, I want to do a little bit of an experiment. I'm going to use the Windows local firewall and actually block outboun…