paulsec / awesome-windows-domain-hardening

A curated list of awesome Security Hardening techniques for Windows.

Hi there 👋

☁️🤖 Engineering Manager and craftsman in the field of information technology 🚀☕️ - My personal blog: https://paulsec.github.io/

• 💬 Ask me about Security, Python, Kafka, API things, ...
• 📫 How to reach me: https://twitter.com/paulwebsec, https://www.linkedin.com/in/paul-amar/
• 😄 Pronouns: He/Him
• ⚡ Fun fact: I'm the one behind CFPTime
• 👉🏼 : Follow me on my French Blog: https://paulsec.github.io/.

My Stats

Connect with me

awesome-windows-domain-hardening's Issues

Office PackagerPrompt registry setting

Consider preventing activation of OLE packages in Office with the PackagerPrompt registry setting :

https://blogs.technet.microsoft.com/mmpc/2016/06/14/wheres-the-macro-malware-author-are-now-using-ole-embedding-to-deliver-malicious-files/

add link to AD-control-path

https://github.com/ANSSI-FR/AD-control-paths

Bloodhound is similar to AD-control-paths

Use PingCastle ?

Just a remark.
I tried to do a checklist but become complicated quite fast.
Example: by default any user can add up to 10 computers to the domain => set ms-DS-MachineAccountQuota = 0
Check for trusts SID Filtering
Passwords in GPP or the DC object ownership:
Get-ADComputer -server my.domain.to.check -LDAPFilter "(&(objectCategory=computer)(|(primarygroupid=521)(primarygroupid=516)))" -properties name, ntsecuritydescriptor | select name,{$_.ntsecuritydescriptor.Owner}
(should be domain admin or entreprise admin)
=> I automatize many checks in the PingCastle tool (https://www.pingcastle.com) and made further steps.
Do not hesitate to come back to me - note: check my previous work in the attack field
Vincent

Prevent BloodHound

It would be great if you can add the following to prevent execution of BloodHound tool:

1. Use NetCease  to prevent unprivileged session enumeration.
2. Use Samri10  to prevent unprivileged local admin collection (this fix already exists in Windows 10 1607 and above).

Link to "Explaining and adapting Tay’s Sysmon configuration" is dead

Adding Lithnet Password Protection

"Lithnet Password Protection for Active Directory (LPP) enhances the options available to an organization wanting to ensure that all their Active Directory accounts have strong passwords."

https://github.com/lithnet/ad-password-protection

Hardening against DMA attacks

Due to driver loading happening on-the-fly when devices are inserted, an attacker can insert DMA based devices and extract hard drive and memory content.

Article by Microsoft