ConfigureDefender VS Windows-Sandbox-Utilities

https://github.com/AndyFul/ConfigureDefender lets you dig into some settings, but not what I need.

Windows Defender + ConfigureDefender and set it to Maximum Protection Level = Defender on Steroids.

When using defender I recommend using this utiliy https://github.com/AndyFul/ConfigureDefender

You can prevent the LOLbin from contacting its C2 server by using an tool like FirewallHardening which you can download here, it allows you to add firewall block rules in Windows Firewall to prevent LOLbins from phoning home, not only .NET framework files but also things like Powershell and ConHost which are abused by the majority of malware.

What is the easiest way to use all the links via the search function again if you are not an sys-admin?In my case it is about Windows Pro/Home in the private area, i used https://github.com/AndyFul/ConfigureDefender for my Windows Defender. I have no idea which script to start here now. :(

ConfigureDefender

For keeping malware off your machine Windows Defender and some common sense should be perfectly fine, although I would recommend running ConfigureDefender and choosing whatever security level you find most appropriate for your use case. Also if you ever suspect you have malware that Defender didn't detect, just download the free version of malwarebytes, do a quick scan and uninstall it again; it's highly unlikely that something would make it past both of them.

Microsoft Defender configured by configure defender

Windows 11 built-in security is quite good, particularly when paired with the likes of ConfigureDefender or DefenderUI which allows you to tweak the built-in protection https://github.com/AndyFul/ConfigureDefender but there are third party options out there. Andy Ful also has system hardening tools that add an extra layer of protection but there have been some compatibility issues with windows new SmartApp Control feature https://github.com/AndyFul/Hard_Configurator/tree/master/Simple%20Windows%20Hardening .

Windows has a lot of things in this department. https://github.com/microsoft/Windows-Sandbox-Utilities sounds similar to what you describe, but there are also finer-grained APIs: https://learn.microsoft.com/en-us/windows/win32/secauthz/app...

You could use the Windows Sandbox to prevent them from accessing anything sensitive on your computer. https://docs.microsoft.com/en-us/windows/security/threat-pro...

If you're unsure about a program's security (and you have 10 Pro), run it in Sandbox mode. Otherwise, download VMWare Workstation and create a virtual machine.

https://docs.microsoft.com/en-us/windows/security/threat-pro...

Windows Sandbox is literally made for this, is lighter, integrated into the OS and free.

He directed me to start a browser, which I did inside Windows Sandbox (a new lightweight container-based VM-ish on Windows). He asked me to go to "9190.org" in the browser, enter the invoice number. That downloads a "ScreenShareClientRefund.exe" which he instructed me to start. At that point I told him "Nice try, scammer! That would have fooled a lot of people." He hung up - no drama.

Windows Sandbox is a feature of Windows 10+. If you use older or can't use it for some reason, get VirtualBox and make a VM without any network access.

Do you think he is confusing the partial sandboxing of Windows Defender with Windows Sandbox? If so, why?