Skip to content

Latest commit

 

History

History
115 lines (88 loc) · 9.11 KB

README.md

File metadata and controls

115 lines (88 loc) · 9.11 KB
Raw

Awesome Windows Domain Hardening Awesome

A curated list of awesome Security Hardening techniques for Windows.

Created by gepeto42 and PaulWebSec but highly inspired from PyroTek3 research!

Summary

This document summarizes the information related to Pyrotek and Harmj0y's DerbyCon talk called "111 Attacking EvilCorp Anatomy of a Corporate Hack". Video and slides are available below.

It also incorporates hardening techniques necessary to prevent other attacks, including techniques discussed by gepeto42 and joeynoname during their THOTCON 0x7 talk.

Something's missing? Create a Pull Request and add it.

Initial foothold

  • No hardening effort should come at the expense of upgrading operating systems.
  • Deploy EMET to Workstations (End of line in July 2018 - Consider keeping EMET for Windows 7 but prioritize upgrades to Windows 10 and Edge).
  • Use AppLocker to block exec content from running in user locations (home dir, profile path, temp, etc).
  • Manage PowerShell execution via Applocker or constrained language mode.
  • Enable PowerShell logging (v3+) & command process logging.
  • Block Office macros (Windows & Mac) on content downloaded from the Internet.
  • Deploy security tooling that monitors for suspicious behavior. Consider using WEF to forward only interesting events to your SIEM or logging system.
  • Limit capability by blocking/restricting attachments via email/download:
    • Executables extensions:
    • (ade, adp, ani, bas, bat, chm, cmd, com, cpl, crt, hlp, ht, hta, inf, ins, isp, job, js, jse, lnk, mda, mdb, mde, mdz, msc, msi, msp, mst, pcd, pif, reg, scr, sct, shs, url, vb, vbe, vbs, wsc, wsf, wsh, exe, pif, etc.)
    • Office files that support macros (docm, xlsm, pptm, etc.)
  • Change default program for anything that opens with Windows scripting to notepad (test first!)
    • bat, js, jse, vbe, vbs, wsf, wsh, etc.

Reconnaissance

  • Deploy Windows 10 and limit local group enumeration.
  • Limit workstation to workstation communication.
  • Increase security on sensitive GPOs.
  • Evaluate deployment of behavior analytics (Microsoft ATA).

Lateral Movement

  • Configure GPO to prevent local accounts from network authentication (KB2871997).
  • Ensure local administrator account passwords are automatically changed (Microsoft LAPS) & remove extra local admin accounts.
  • Limit workstation to workstation communication (Windows Firewall).
    • Test psexec with good credentials between two workstations. If it works, you have a lateral movement problem.

Privilege Escalation

  • Remove files with passwords in SYSVOL (including GPP).
  • Ensure admins don’t log onto untrusted systems (regular workstations) by configuring DENY user right assignments with GPOs.
  • Provide Privileged Access Workstations or PAWs for all highly privileged work. Those should never have access to the Internet.
  • Use Managed Service Accounts for SAs when possible (FGPP)
  • For systems that do not support Managed Service Accounts, deploy a Fine-Grained Password Policy to ensure the passwords are >32 characters.
  • Ensure all computers are talking NTLMv2 & Kerberos, deny LM/NTLMv1.

Protect Administration Credentials

  • Ensure all admins only log onto approved admin workstations & servers. (See PAW in Privilege Escalation section)
  • Ensure all built-in groups but Administrator are denied from logging on to Domain Controllers user User Right Assignments. By default, Backup operators, Account operators can login to Domain Controllers, which is dangerous.
  • Add all admin accounts to Protected Users group (requires Windows 2012 R2 DCs).
  • Admin workstations & servers:
    • Control & limit access to admin workstations & servers.
    • Remove NetBIOS over TCP/IP
    • Disable LLMNR.
    • Disable WPAD.

Strengthen/Remove Legacy

  • Audit/Restrict NTLM.
  • Enforce LDAP signing.
  • Enable SMB signing (& encryption where poss.).
  • Disable WPAD & LLMNR & work to disable NetBIOS.
  • Windows 10, remove:
    • SMB 1.0/CIFS
    • Windows PowerShell 2.0
  • Use shims to enable old applications that require admin privileges to work by believing they have them.

Tools

  • Responder - A LLMNR, NBT-NS and MDNS poisoner
  • BloodHound - Six Degrees of Domain Admin
  • PowerSploit - A PowerShell Post-Exploitation Framework
  • PowerView - Situational Awareness PowerShell framework
  • Empire - PowerShell and Python post-exploitation agent
  • Mimikatz - Utility to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets
  • Tools Cheatsheets - (Beacon, PowerView, PowerUp, Empire, ...)
  • UACME - Defeating Windows User Account Control
  • Windows System Internals - (Including Sysmon etc.)
  • Hardentools - Collection of simple utilities designed to disable a number of "features" exposed by Windows

Videos

Slides

Additional resources