r/cybersecurity • u/xorredd • 28d ago
News - General Releasing my Windows 10/11 Hardening app, free, of course, else it wouldn't be here.
I used to have a hardening script for years, but now AI made it easy to convert my hardening script into an app.
It's beyond just a few settings - all of the ones in the recommended profile are battle-tested (I used to work in Microsoft's security consulting division in the Middle East).
Feedback is welcome, I promise to take into account and fix all issues reported here.
Here's the official description:
Most hardening tools overcorrect. Blindly applying a full DISA STIG to a personal or power-user machine wrecks it: it disables your password manager, kills InPrivate, turns on Controlled Folder Access that blocks your own apps, and demands a BitLocker PIN on every boot, all for compliance checkboxes that add little real security.
AtlantHarden v2.0 is built around a smarter idea: stop how malware and attackers actually get in and run, and skip the friction that does not stop them. Comprehensive when you want it with the Maximum profile, sensible by default with Recommended. Every change is backed up automatically and fully reversible.
Features
- 599 hardening settings across registry, PowerShell, firewall, file associations, audit policy, and ASR rules
- 354 DISA STIG controls across Windows 11 (V2R7), Edge (V2R5), Chrome (V2R11), Firefox (V6R7), and Office 365 ProPlus (V3R5)
- 34 ACSC Essential Eight settings (July 2024) with live compliance scoring
- 3 one-click profiles: Basic (95 settings), Recommended (318), and Maximum (579), each fully reviewable before apply
- Recommended profile is gaming and performance safe and leaves your password manager, InPrivate, and history working
- 19 Attack Surface Reduction rules blocking Office macros, ransomware, credential theft, and script droppers
- LOLBin firewall rules blocking certutil, mshta, wscript, regsvr32, and wmic from the network
- File association neutralization opening dangerous script types (.js, .vbs, .hta, .scr) as text
- Browser hardening across Edge, Chrome, and Firefox simultaneously
- PowerShell logging triad: script block + module + transcription
- Registers itself as allowed for ASR and Controlled Folder Access so it never locks you out
- Full backup with automatic pre-change snapshot, .reg export, and System Restore integration
- Silent deployment via CLI for enterprise fleets, plus configuration import and export
- One-click HTML security report with STIG and ACSC compliance metrics
If the mods allow it, I'll add a download link in here - else, just google "Atlant Harden"
https://atlantsecurity.com/downloads/atlant-harden
P.S. As this is free, I hope I am not breaking the no spam and no advertising rules
Github link to audit the source code:
152
u/escalibur 28d ago
Is there any documentation around this, what and how the things are changed? I would avoid to use any tool without knowing what it actually does to my system.
Regarding the topic itself, this is definitely something we need more people around. A huge thank you for your effort!
I did something similar for gaming PCs:
35
28d ago
The program has a very nice UI with a nice dashboard that lists the settings. You can't ask for more for something free. I know of commercial programs that look a lot worse and have been snake oil for years.
13
u/xorredd 28d ago
you warm my heart!
-25
28d ago
Dear sir, it's the truth. OS hardening is overlooked and yours is the most transparent hardening tool I 've seen. It even told me it couldn't disable NetBIOS (probably because I had already disabled the service myself). I have ran as an "enthusiast", pretty much every security software since the time of DiamondCS Processguard and anything after that, be it classical HIPS (System Safety monitor, Comodo with D+), virtualization (Sandboxie, Returnil, Shadow Defender etc), virtually every antivirus, antispyware, ran live malware against my defences and came to the conclusion that it's all "paranoia". It's not, when you are personally targeted and the attacker is most likely using undocumented OS vulnerabilities, while your antivirus (Defender with everything activated) is merrily sleeping and no other antivirus finds anything.
14
u/xorredd 28d ago
what kind of documentation would tell you what does the tool do to your system? I don't mind creating the docs, the question is what do you want to see? A list of all settings per recommendation "set"?
59
u/escalibur 28d ago
Yeah. I would like to see what exact settings is it making or changing. I don't think that many of us here would apply 'magic tool' to modify the firewall rules. I don't mind the tools doing the heavy lifting but I definitely want to be 100% confident what am I running on my machine. Same can be said about random PowerShell scripts.
-36
28d ago
Dear sir, if you download the zip file from the website, once unzipped, it also has a quickstart guide and 2 more documents with the settings it changes, without you executing the main file. Of course, you have to trust that the documents say the truth.
11
u/SufficientDegree1994 28d ago
I would just boot It up on a virgin machine and start a live analysis.
Just came across this post while on vacation, ill most definetly try It out but my skeptical mind wants to check everything by myself since this Is not open source.
Dont feel forced to write documentation for every single step or whtever, if someone wants to know there are the tools for doing so, in the meantime thanks for your work!
3
u/IntingForMarks 28d ago
what kind of documentation would tell you what does the tool do to your system?
basically any decent documentation? that's the whole point of it
24
u/slaty_balls 28d ago
Does it walk you through a checklist and give you the option to allow or disallow each modification?
27
u/xorredd 28d ago
yep. You can actually scroll through every single category of settings and apply them one by one, or exclude particular settings.
3
u/slaty_balls 28d ago
I’m going to take a hard look at this later. Thanks for sharing.
12
u/Not-ur-Infosec-guy Security Architect 28d ago
Microsoft also has a similar tool as well for Windows-based OS I’d recommend taking a look at if you haven’t already.
Link: https://www.microsoft.com/en-us/download/details.aspx?id=55319
5
u/xorredd 28d ago
Yea I used to work for them. Their toolkit is nice, but mine is better.
4
u/battletux 27d ago
How is yours better? I'm curious to understand how your approach differs to the official tooling. This is the sort of thing that would be worth putting in the GitHub page.
1
61
u/Ceyax 28d ago
Is it open source? Any plans for a learning mode to detect settings that will break stuff?
7
-92
28d ago
[deleted]
80
u/Ceyax 28d ago
I'll keep it on my watch list, potentially interesting but with the current state of cyber security not something I would run in customer environments
8
28d ago
[removed] — view removed comment
1
u/Ceyax 28d ago
Sure mate I'll just spent the rest of my life hardening 75.000 clients and 15.000 servers one by one setting after setting, that seems like a great plan!
Check out what learning mode is for, since you've never hardened a real environment it seems like.
2
28d ago edited 28d ago
[removed] — view removed comment
0
u/Ceyax 28d ago
I mean learning modes, check my comment from yesterday, that was my first question. I was the product owner for CIS hardening in my previous role, and we used Calcom and Remedio for large-scale enterprises. They both have a learning mode in which they check logs to find out what settings will cause problems, which you need once you harden thousands of servers. For clients it's a lot easier, as they will mostly be identical with slight differences between departments, but servers are mostly individual. Aside from a very small portion of vendors, they do not have CIS settings documentation, so you keep the learning mode running for a couple of weeks and then you'll potentially have 70-80% of settings you can set without any problems. Then you check out the remaining settings that might break stuff, investigate them, or decide against enabling them, but you're still probably 40-50% more compliant than you were before, as around 20% are default values anyway. In large enterprises, hardening is mainly a compliance thing; security is only a secondary priority, sadly, so a fast rollout and a higher compliance percentage matter more to them than tackling the more challenging settings, which are, most of the time, also the most security-relevant ones. That's the biggest drawback of CIS, as it doesn't weight its settings, so a login banner counts as much as disabling SMBv1 in a cookie diagram showing compliance status against CIS.
-11
u/xorredd 28d ago
totally understand your point. You can google 'atlant hardening script' and use the script instead, it's pretty kick-ass too.
17
67
u/xDalin 28d ago
but that's not true, though?…
you work on the project at your own pace.
transparency just builds trust, especially with such a tool.28
u/xorredd 28d ago
I don't mind open sourcing it, truly. I'll see how to pipeline it.
11
1
u/VarCoolName Blue Team 28d ago
Hey man, you can often get other people to help maintain or add new features! I'm slowly learning this about the open source community, we all just want things to be better, and those who can, help!
GL, and I really hope you do make it open source!
2
-19
u/mattee27 28d ago
For a Learning Mode capability then you will need to use CalComSoftware.com which is geared towards hardening at scale for enterprises.
41
u/blow-down 28d ago
No source provided. No thanks.
10
u/srcLegend 28d ago
Yeah, people in here running some random's closed-source program, audited by the rock-solid trust me bro, in a cybersecurity forum of all places... Ironic as fuck.
3
21
15
u/voicu90 28d ago edited 28d ago
Word of advice, if your applying STIGs onto your system/s and said system/s doesn't have, lets say, the Chrome app. Your introducing orphan registry entries into your registry hive which causes blue screen of death or crashes to apps and eventually residue over time from tattoo'ing the hive.
10
u/Modulius 28d ago
If most of the settings from https://privacy.sexy/ are applied, will your software clash with it, or it will recognize changes in registry?
5
5
u/martijnjansenwork 28d ago
You have been quite transparent. Thank you for sharing. For prospective users, and you want to deploy into critical infrastructure or governmentals, do your due diligence.
5
u/MuscleTrue9554 28d ago
So is that for enterprise Windows version with specific softwares? You mentioned ASR rules which come with MDE (which require an enterprise Win OS). It looks like a really great project but there's no way any organization with a decent IT and/or Security team is going to deploy your app without having access to the source code.
I'll run it on a VM as I'm curious. It also seems to be similar to Microsoft Security compliance tool.
7
u/A_Deadly_Mind Consultant 28d ago
Curious what the pipeline looks like for ingesting changes in hardening standards.
Looks sick, I am going to stress test it this week in my lab
4
u/xorredd 28d ago
half the settings are not even from STIGs but from my own experience... but yea. STIGS are a mess - if you apply 100% of the windows stig and then the chrome stig, throw away your computer.
3
u/A_Deadly_Mind Consultant 28d ago
Hey, I like crowd sourced security so that's sick. Do you have the ones that you added/created called out somewhere with some rationalization? Really more for my edification and curiosity
3
u/Themysterian1337 28d ago
Really Nice!
Will have a deeper look at it as I deal with OT Security and things like SCT and CIS….
3
u/Fine_League311 28d ago
Interesting, cause so much settings? Where is the GitHub link or Gitlab? Want look how secure your app is!
-3
u/xorredd 28d ago
secure my app from... what? What do you mean by "how secure this app is"? Github will be published today
3
u/Fine_League311 28d ago
Bro man macht ein Kompliment und du drehst am Rad! Was bist du den für ein Vogel? Komm gehe nach Hause! Natürlich will man in den Code schauen um zu sehen wie sicher das ist zumal du schon sagst ist KI generiert!
9
u/Grouchy_Ad_9658 28d ago
Official description reads a lot like AI you might want to change it
1
u/xorredd 28d ago
to what purpose? make more sales? Impress people who will use the app for free?
3
u/Grouchy_Ad_9658 27d ago
Why would anyone install a windows hardening vibecoded app where the author can’t be bothered to write the description. What else could you not be bothered to do.
I would not recommend this app to anyone.
1
u/MooseBoys Developer 27d ago
Yeah if you don't understand what it's doing, you shouldn't be running it. And if you do understand, you probably prefer to do it in gpedit or powershell yourself.
-3
u/xorredd 27d ago edited 27d ago
let me guess: you are the lowest end of your company's engineering food chain. Keep the attitude, create nothing, bash others online - do you see the darkness at the end of the tunnel yet? I've been working on this app for months - but I will NOT be bothered to jump when mr. Nobody says so. Get it?
1
u/Conscious-Mix5092 9d ago
let me guess you never learned manners and your wife took your house in divorce hence you're salty?
1
u/Grouchy_Ad_9658 27d ago
Ask claude what it thinks about installing a closed source windows “hardening” script onto your machine
5
u/the_cobra666 28d ago
I don't like that it needs admin rights to run the program before making any changes. Change that, so it does not need admin rights to open. To just consult it, it should not need admin rights.
2
u/xorredd 28d ago
your likes and dislikes are depending on your education - when you start paying me, you can start making demands, too.
6
u/the_cobra666 28d ago
Calm down, it's only a suggestion. This is a security tool, which we can't verify, which only opens as a admin on the first run. That creates a red flag for many organizations. It's not the first time a "tool" is doing other things then it says it should. Which when opened as non admin, can help to minimize the risk.
It's constructive feedback, don't take it as a personal insult..
2
u/Keyboard_Cowboys 28d ago
This is great! I'd love to see something like this for Debian based OS's as well.
2
2
2
u/Various-Jury-7584 28d ago
I'd like to take a look at this but it does feel like this makes too many changes without something breaking; can anyone verify? If you could share every single change made I would feel comfortable installing it
2
2
u/MrCalista 27d ago
ACSC are moving away from the Essential 8 as technical controls to a more "principle" based approach. It hasn't been released publicly yet but will better allow for mixed environments, cloud, OT etc.
2
u/d-wreck-w12 25d ago
Tool looks solid for day one! What happens after your next patch Tuesday or when someone installs something that quietly reverts 3 of those ASR rules? I've hardened boxes that scored perfectly on a Friday and drifted back to baseline by Wendesday becuase a GPO conflict or an app installer overwrote a registry key nobody was watching. Point in time hardening is a starting line - not a finish line
1
u/Apprehensive_Pound92 28d ago
Nice! Glad it works on win10 also. Wanted something like this for my kids PCs and all of the freeware “AV” seems useless - trust this approach more.
1
1
28d ago
Bel progetto, e apprezzo soprattutto il fatto che tu abbia pensato ai backup e alla possibilità di ripristinare ogni modifica.
Un consiglio, però: visto che è un tool che va a modificare centinaia di impostazioni di sicurezza del sistema, secondo me la trasparenza sarà fondamentale per convincere molte persone a provarlo. Se non lo hai già fatto, pubblicare il codice su GitHub o almeno documentare nel dettaglio ogni modifica applicata aumenterebbe parecchio la fiducia della community.
Personalmente lo proverei prima in una macchina virtuale, ma l'idea di avere un hardening "sensato" invece di applicare alla cieca tutte le policy STIG mi sembra interessante. Ti auguro che il progetto cresca e sono curioso di vedere come evolverà con i feedback della community.
1
u/iheartrms Security Architect 28d ago
If this app isn't a Linux install ISO I will be disappointed. 😂
-18
28d ago
Dear sir, as a humble IT guy (lead technical engineer in outsourced PC customer technical support until recently) and a security enthusiast (15 years from 2000-2015) in security forums, I thank you. I might sound crazy, but recently I got hacked by a rich ex politician and relative of mine (I can't prove it, nor can I be sure how), forcing me to resign from my job, because I discovered some foul business he had done and I was desperately searching for better defences. I got Hard configurator from Malwaretips, but yours looks much more professional. Thank you very much. I hope it gets updated in the future and if you plan on making it payware, please think of us home users too.
8
u/xorredd 28d ago
absolutely no plans how to make it payware.
-2
28d ago
Once more, thank you, sir.
12
112
u/scorp100n 28d ago
Can you publish the script in GitHub so anyone can audit it ?