awesome-windows-domain-hardening

Deploy to Workstations (End of line in July 2018 - Consider keeping EMET for Windows 7 but prioritize upgrades to Windows 10 and Edge)

Use to block exec content from running in user locations (home dir, profile path, temp, etc)

Hardening against DMA Attacks? and an interesting article from

Enable (v3+) & command process logging

(Windows & Mac) on content downloaded from the Internet

Deploy security tooling that monitors for suspicious behavior. Consider using to forward only interesting events to your SIEM or logging system

Ensure are blocked

Block forgotten/unused : IQY, SLK

in Office with the PackagerPrompt registry setting

Increase security on sensitive s

Evaluate deployment of behavior analytics

Use to prevent unprivileged session enumeration

Use to prevent unprivileged local admin collection (this fix already exists in Windows 10 1607 and above)

Configure GPO to prevent local accounts from network authentication . In addition to this KB, is recommending two other changes in the registry:

Ensure local administrator account passwords are automatically changed & remove extra local admin accounts

Limit workstation to workstation communication

Remove files with passwords in SYSVOL

Provide Privileged Access Workstations or for all highly privileged work. Those should never have access to the Internet

Use Managed Service Accounts for SAs when possible

For systems that do not support Managed Service Accounts, deploy a to ensure the passwords are >32 characters

Ensure all computers are talking NTLMv2 & Kerberos, deny

Add all admin accounts to (requires Windows 2012 R2 DCs)

Disable

Disable

Enforce

Enable (& encryption where poss.)

Use to enable old applications that require admin privileges to work by believing they have them

an Active Directory audit tool (and free!) with pretty good metrics

Responder

A LLMNR, NBT-NS and MDNS poisoner

BloodHound

Six Degrees of Domain Admin

AD Control Path

Active Directory Control Paths auditing and graphing tools

PowerSploit

A PowerShell Post-Exploitation Framework

PowerView

Situational Awareness PowerShell framework

Empire

PowerShell and Python post-exploitation agent

Mimikatz

Utility to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets

Tools Cheatsheets

(Beacon, PowerView, PowerUp, Empire, ...)

UACME

Defeating Windows User Account Control

(Including Sysmon etc.)

Hardentools

Collection of simple utilities designed to disable a number of "features" exposed by Windows

CrackMapExec

A swiss army knife for pentesting Windows/Active Directory environments

Rubeus

Rubeus is a C# toolset for raw Kerberos interaction and abuses

Koadic, or COM Command & Control, is a Windows post-exploitation rootkit

SILENTTRINITY

A post-exploitation agent powered by Python, IronPython, C#/.NET

Sysmon SecuriTay's configuration file

template with default high-quality event tracing

and