Windows Vulnerabilities - PimmyTrousers/Cooking-Recipes GitHub Wiki

General

  • Microsoft Baseline Security Analyzer 2.3

    • Provides a streamlined method to identify missing security updates and common security misconfigurations. MBSA 2.3 release adds support for Windows 8.1, Windows 8, Windows Server 2012 R2, and Windows Server 2012.
    • link to download
    • In that same vein, we should be looking to see if any third-party software that we need to keep online has any security updates and act accordingly
    • Script for automating

  • Malicious USB Usage

    • There is a possibility that the Red Team will have a malicious USB inserted into one of our computers before the competition starts.
    • The workspace and computers should be inspected at the beginning to prevent this from happening
    • If there has been a USB in any computer we can use forensic techniques to find out what has been changed in the registry (https://www.youtube.com/watch?v=VYROU-ZwZX8)

  • File Sharing Permissions

    • Check what’s being sent and shared
      • Evaluate the importance of the documents in shared folders and determine whether they belong shared at all
    • There should NOT be any sensitive data in the “Everyone” folder
    • Windows 10 has a “Controlled Folder Access” feature we can enable to further harden
      • source
      • In powershell the command to enable CFA is Set-MpPreference -EnableControlledFolderAccess Enabled
        • In addition, the admin can run the Group Policy Management Console for enabling the feature on all systems.

  • Drive Encryption

    • Bitlocker Included with Windows Vista, Windows 7 (Enterprise & Ultimate eds.), Windows 8/8.1 (Enterprise & Pro eds.), Windows 10 (Pro, Enterprise, & Education eds.), and Windows Server 2008
    • Encrypting File System (EFS) for Windows XP and Windows Server 2003
      • Limits permissions of encrypted files by requiring login-password combo
      • The only con is if we lose our passwords or if they are changed unknowingly those files are as good as gone
      • Microsoft Technet overview
    • 3rd Party assessment of EFS 3rd Party Drive Encryption
      • Veracrypt is drive encryption software available on Windows, OS X, and Linux

  • File Integrity Monitor

    • Windows has File Checksum Integrity Verifier