awesome-windows-domain-hardening
A curated list of awesome Security Hardening techniques for Windows.
2k stars
120 watching
266 forks
last commit: over 4 years ago
Linked from 5 awesome lists
hardeningsecuritywindows
Awesome Windows Domain Hardening / Initial foothold | |||
| EMET | Deploy to Workstations (End of line in July 2018 - Consider keeping EMET for Windows 7 but prioritize upgrades to Windows 10 and Edge) | ||
| AppLocker | Use to block exec content from running in user locations (home dir, profile path, temp, etc) | ||
| Here you go | Hardening against DMA Attacks? and an interesting article from | ||
| PowerShell logging | Enable (v3+) & command process logging | ||
| Block Office macros | (Windows & Mac) on content downloaded from the Internet | ||
| WEF | Deploy security tooling that monitors for suspicious behavior. Consider using to forward only interesting events to your SIEM or logging system | ||
Awesome Windows Domain Hardening / Initial foothold / Limit capability by blocking/restricting attachments via email/download: | |||
| these file types | Ensure are blocked | ||
| Excel file extensions | Block forgotten/unused : IQY, SLK | ||
Awesome Windows Domain Hardening / Initial foothold | |||
| Preventing activation of OLE packages | in Office with the PackagerPrompt registry setting | ||
Awesome Windows Domain Hardening / Reconnaissance | |||
| GPO | Increase security on sensitive s | ||
| (Microsoft ATA) | Evaluate deployment of behavior analytics | ||
| NetCease | Use to prevent unprivileged session enumeration | ||
| Samri10 | Use to prevent unprivileged local admin collection (this fix already exists in Windows 10 1607 and above) | ||
Awesome Windows Domain Hardening / Lateral Movement | |||
| (KB2871997) | Configure GPO to prevent local accounts from network authentication . In addition to this KB, is recommending two other changes in the registry: | ||
| (Microsoft LAPS) | Ensure local administrator account passwords are automatically changed & remove extra local admin accounts | ||
| (Windows Firewall) | Limit workstation to workstation communication | ||
Awesome Windows Domain Hardening / Privilege Escalation | |||
| (including GPP) | Remove files with passwords in SYSVOL | ||
| PAWs | Provide Privileged Access Workstations or for all highly privileged work. Those should never have access to the Internet | ||
| (FGPP) | Use Managed Service Accounts for SAs when possible | ||
| Fine-Grained Password Policy | For systems that do not support Managed Service Accounts, deploy a to ensure the passwords are >32 characters | ||
| LM/NTLMv1 | Ensure all computers are talking NTLMv2 & Kerberos, deny | ||
Awesome Windows Domain Hardening / Protect Administration Credentials | |||
| Protected Users group | Add all admin accounts to (requires Windows 2012 R2 DCs) | ||
Awesome Windows Domain Hardening / Protect Administration Credentials / Admin workstations & servers: | |||
| LLMNR | Disable | ||
| WPAD | Disable | ||
Awesome Windows Domain Hardening / Strengthen/Remove Legacy | |||
| LDAP signing | Enforce | ||
| SMB signing | Enable (& encryption where poss.) | ||
| shims | Use to enable old applications that require admin privileges to work by believing they have them | ||
Awesome Windows Domain Hardening / Tools | |||
| PingCastle | an Active Directory audit tool (and free!) with pretty good metrics | ||
| Responder | 5,372 | 11 days ago | A LLMNR, NBT-NS and MDNS poisoner |
| BloodHound | 9,779 | 3 months ago | Six Degrees of Domain Admin |
| AD Control Path | 648 | almost 4 years ago | Active Directory Control Paths auditing and graphing tools |
| PowerSploit | 11,812 | about 4 years ago | A PowerShell Post-Exploitation Framework |
| PowerView | 11,812 | about 4 years ago | Situational Awareness PowerShell framework |
| Empire | 7,406 | over 4 years ago | PowerShell and Python post-exploitation agent |
| Mimikatz | 19,281 | 3 months ago | Utility to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets |
| Tools Cheatsheets | 1,028 | almost 7 years ago | (Beacon, PowerView, PowerUp, Empire, ...) |
| UACME | 6,278 | 3 months ago | Defeating Windows User Account Control |
| Windows System Internals | (Including Sysmon etc.) | ||
| Hardentools | 2,899 | 6 months ago | Collection of simple utilities designed to disable a number of "features" exposed by Windows |
| CrackMapExec | 8,368 | 10 months ago | A swiss army knife for pentesting Windows/Active Directory environments |
| SharpSploit | 1,736 | about 3 years ago | |
| Rubeus | 4,045 | 23 days ago | Rubeus is a C# toolset for raw Kerberos interaction and abuses |
| Koadic | Koadic, or COM Command & Control, is a Windows post-exploitation rootkit | ||
| SILENTTRINITY | 2,176 | 10 months ago | A post-exploitation agent powered by Python, IronPython, C#/.NET |
Awesome Windows Domain Hardening / Videos | |||
| Beyond the Mcse: Active Directory for the Security Professional | |||
| BSides DC 2016 - PowerShell Security: Defending the Enterprise from the Latest Attack Platform | |||
| Six Degrees of Domain Admin... - Andy Robbins, Will Schroeder, Rohan Vazarkar | |||
| 111 Attacking EvilCorp Anatomy of a Corporate Hack | |||
| Red vs Blue: Modern Active Directory Attacks & Defense | |||
| Offensive Active Directory with Powershell | |||
| Advanced Incident Detection and Threat Hunting using Sysmon and Splunk | |||
| Real Solutions From Real Incidents: Save Money and Your Job! | |||
| AppLocker Bypass Techniques | |||
Awesome Windows Domain Hardening / Slides | |||
| From Workstation To Domain Admin - Why Secure Administration Isn't Secure | |||
| Exploiting AD Administrator Insecurities | |||
| How to go from Responding to Hunting with Sysinternals Sysmon | |||
| 111 Attacking EvilCorp Anatomy of a Corporate Hack | |||
| Real Solutions From Real Incidents: Save Money and Your Job! | |||
Awesome Windows Domain Hardening / Additional resources | |||
| ADSecurity | |||
| Harmj0y's blog | |||
| Sysmon SecuriTay's configuration file | 4,755 | 3 months ago | template with default high-quality event tracing |
| Explaining and adapting Tay’s Sysmon configuration | and | ||
| Use of PSExec | |||
| Preventing Mimikatz attacks | |||
| Useful list of Windows Security Log Events | |||
| Introducing SharpSploit: A C# Post-Exploitation Library | |||
| From Kekeo to Rubeus | |||
| Windows oneliners to download remote payload and execute arbitrary code | |||
| Configuration guidance for implementing the Windows 10 and Windows Server 2016 DoD Secure Host Baseline settings. | 1,551 | almost 2 years ago | |
lissy93/awesome-privacy
decalage2/awesome-security-hardening
coreb1t/awesome-pentest-cheat-sheets
bytesnipers/awesome-pentest-cheat-sheets
spacial/awesome-systools