block Internet access for some apllications

[sokatra]

I recommend that hardentools would block internet access for some Windows tool which can be abused to dwonload malicious code

example:
netsh advfirewall firewall add rule name="Block certutil.exe netconns" program="%systemroot%\system32\certutil.exe" protocol=tcp dir=out enable=yes action=block profile=any
source
windows_hardening.cmd in gitgub
https://gist.github.com/ricardojba/ecdfe30dadbdab6c514a530bc5d51ef6

CertUtil.exe Could Allow Attackers To Download Malware While Bypassing AV
https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/

[tyrell-wallace]

You can use a firewall for that