🟣 Lesson 008: Shutting the Hacker's Windows Backdoor 🚪

Hackers have a terrifying strategy: they don't use obvious viruses. They use your own Windows tools against you. It’s called "Living Off the Land" (LotL). They hijack trusted utilities you use every day, like Command Prompt (cmd.exe), PowerShell, and the Windows Script Host (wscript.exe). Your antivirus does nothing because it thinks Windows is just doing its job. A hacker can use these "trusted" tools to secretly "phone home," download ransomware, or steal your data, bypassing your defenses completely.

You can shut this backdoor for good. By creating a specific set of firewall rules, you can block these powerful administrative tools from ever accessing the internet. The tools still work for local tasks, but they can no longer be used as a backdoor to the web.

⚠️ Warning: This Is an Advanced Tip This is a powerful trade-off. Blocking these tools will break some legitimate network commands, such as ping, tracert, and nslookup. If you are a developer or admin who needs these, this rule is not for you. For 99% of users, this simply locks a door you never use.

🎥 Video guide

📖 How to

1. Click the Start button, type Windows Defender Firewall, and open "Windows Defender Firewall with Advanced Security".
2. In the left-hand pane, click "Outbound Rules".
3. In the right-hand "Actions" pane, click "New Rule...".
4. Select "Program" and click Next.
5. Choose "This program path:" and paste in the full path of the first target from the list below.
6. Click Next. Select "Block the connection" and click Next.
7. Ensure all three boxes (Domain, Private, Public) are checked, and click Next.
8. Give it a clear name (e.g., BLOCK - Command Prompt (Internet)) and click Finish.
9. You must repeat steps 3-8 for all 8 of these critical targets:

🎯 Target Group 1: Command Prompt

%SystemRoot%\System32\cmd.exe
%SystemRoot%\SysWOW64\cmd.exe

🎯 Target Group 2: PowerShell

%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

🎯 Target Group 3: Windows Script Host (Visual)

%SystemRoot%\System32\wscript.exe
%SystemRoot%\SysWOW64\wscript.exe

🎯 Target Group 4: Windows Script Host (Console)

%SystemRoot%\System32\cscript.exe
%SystemRoot%\SysWOW64\cscript.exe

That's it. You've just slammed a major door in a hacker's face and made your system significantly harder to compromise.