Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

8
votes
1answer
1k views

Nuke it from orbit - surely can only mean bin and buy replacement?

If there are places on a laptop malicious programs can leave elements, hooks, back doors etc, in locations such as BIOS, device controllers, firmware etc - what confidence can one have in wiping the ...
0
votes
0answers
32 views

Brand new 8th gen core i7 laptop using 2.9/7.9 GB RAM idling on desktop [on hold]

Brand new 8th gen core i7 laptop using 2.9/7.9 GB RAM while idling on desktop. Machine running Windows 10 and nothing running that Windows hasn’t arranged in the background. I happen to fear a ...
2
votes
1answer
114 views

Reliable signs a Windows laptop has been booted for first time [duplicate]

Are there any ways to reliably determine that a Windows laptop has been booted for the first time? I do no trust the system log, and so am hoping there may be certain files or other data (or an ...
0
votes
2answers
96 views

How do we create more secure software when we already work with source code auditing tools like GitLab?

I’m interested to know how CIA, NSA and FBI secure their software when they’re developing a software. My company builds software and products based on c# .NET framework with rest API that communicates ...
0
votes
0answers
38 views

Un-setup (but presumably fully working) Windows, susceptible to malware? [on hold]

If a usb stick with a malware program were inserted into a computer prior to the Windows 10 “installation” process/ setup (I assume a fully working os image is already on the hard disk and running, ...
1
vote
0answers
16 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
1
vote
1answer
48 views

Executing vs Extracting PE32/PE32+ executable

If you have a malicious upon execution ("running" it / double clicking on it) .exe , would extracting its contents with something like 7-Zip utility mitigate its effects? Or can it still do harm?
0
votes
1answer
35 views

Guidelines to make Windows Server 2008 Common Criteria Installation

I'm new to certification arguments. I have an issue with a requirement that is to make an application in a certified Windows 2008 environment. What are / where can I find a guide to WS2008 CC-...
0
votes
0answers
44 views

Can I exploit Windows SP2 [closed]

Can I exploit Windows SP2 if the port is filtered? I am stuck on my first step. I ran nmap and got this. Now trying Nessus on the site. Maybe I can get something out of there. I'm getting a few ports ...
0
votes
0answers
3 views

How to determine why Windows security event log ID 4624 are occurring and what is being done on my computer? [migrated]

I work for a smaller company that has an IT guy that is a real hot-head, who thinks he’s God. I’ve noticed lately that I have a bunch of event ID 4624 (successful logon) events popping up in my ...
0
votes
0answers
44 views

Windows Smart Screen pops up after EV Code Signing

I am code signing my application's installer using an EV Code Signing that we have bought recently at work. The code signing is performed when the installer is created using Inno Setup (version 5.6.1)....
2
votes
0answers
72 views

What are the security implications to clients from a rogue Windows KMS server?

Consider a Windows KMS server is controlled by a rogue actor. What are the capabilities of the Windows KMS system, beyond activation and licensing? Are there any security implications to the client ...
0
votes
1answer
78 views

Accidentally “trusted” work PC when I connected my iPhone 6 - can my employers still see my pictures after I unplug it?

I just trusted my work PC (Windows 10). I didn't open my iPhone 6 files. I didn't view any pictures and I unplugged it pretty quick after I accidentally trusted it. I was wondering if my employers ...
1
vote
1answer
39 views

Windows certificate manager imports a SHA256 root CA certificate as SHA1

I generated the root CA test cert using: makecert -a sha256 -n "CN=RootCATest" -r -sv RootCATest.pvk RootCATest.cer I've imported this root CA certificate on another machine (Win Server 2019, ...
-1
votes
2answers
86 views

is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?

My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and ...
0
votes
2answers
102 views

unauthorized devices appear in windows 10 network drive SMB [closed]

Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile ...
-4
votes
1answer
62 views

After have all the Patches, NotPetya can still run? [closed]

NotPetya runs inmediatly after infection or can be there and being executed even do i have all the security patches?
1
vote
1answer
111 views

How are malware able to start on boot on windows without administrator rights? [closed]

I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
0
votes
0answers
37 views

How to find out what program called an API in windows?

Okay, so I am developing a kernel module that does kernel mode hooking to hook APIs and modify some values. But is there anyway I could tell if what program called a specific API? Say a program from ...
0
votes
0answers
35 views

I think I might be infected with some sort of remote access malware/keylogger and victim to hacker attack [duplicate]

I've learned about computers over the years but it hasn't been until recently where I really sat down and tried to learn about malware in-depth (like the registry and embedding in files, etc.). I've ...
0
votes
2answers
57 views

Can 3rd party AVs have accessed to my Windows PC and Android phone even after uninstalling and removing them?

Before we start this, I have paranoia issues (doctor diagnosed, not self-diagnosed) so things might at some points seem like an extremely far reach, but please bear with me. I bought an AV yesterday ...
7
votes
2answers
146 views

What is the safest and most convenient way to transfer data from my computer to “unknown” USB devices?

I recently attended a friends wedding. As a gift to the couple I filmed lots of things and edited the clips into a montage of the big day. Thankfully they loved it and I have had requests from a ...
0
votes
2answers
100 views

Is it possible for specific event logs to have been deleted?

I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those ...
0
votes
0answers
17 views

EFS recovery in windows 7 after reinstalling windows [migrated]

My brother formatted my PC, removed the older version of windows 7 and installed a new version. Before he formatted it, I encrypted some files using EFS in windows 7, I was using an account name: AAAA....
0
votes
0answers
62 views

Privilege Escalation using a leaked thread handle without SeAssignPrimaryTokenPrivilege or SeImpersonatePrivilege

I have a leaked thread handle that grants me THREAD_ALL_ACCESS over a thread of a process running as SYSTEM. My process is running unprivileged and has no special privileges. This means I do not have ...
0
votes
0answers
10 views

Veracrypt bootloader not displaying after running bootrec commands during Windows 8.1 reset [migrated]

Symptoms and process described below: I have full disk encryption on all drives, including system drive. I did not decrypt any drives prior to attempting to reset (full reinstall, keeping no data) ...
1
vote
0answers
54 views

Can an unprivileged user on Windows DNS poison itself?

Can an unprivileged user on a Windows machine spoof DNS responses the machine it is running on makes? For example, if a privileged command prompt ran nslookup example.com, can an unprivileged process ...
0
votes
0answers
14 views

Windows registry subkey creation not generating logs (Windows event ID 4657) [migrated]

I am experiencing an issue where I am trying to audit a specific registry key via Windows Event ID 4657. TL; DR: I have tried to setup auditing on a registry key when a new subkey is created under it,...
1
vote
0answers
94 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
0
votes
0answers
46 views

Recover deleted Windows volumes

I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so Volume 1 - Unallocated. I believe NOT securely ...
23
votes
3answers
6k views

How to bypass password on Windows XP account? [closed]

I have an old ThinkPad R40 family laptop running Windows XP lying around and there's an account on it that has a password and it gave me a hint and I put everything I could possibly think in there and ...
-1
votes
1answer
80 views

Kleopatra importing private key

I'm using Kleopatra Version 3.1.4-gpg4win-3.1.5. I try to import private key (my private key is in a separate file, just a plain text) with GUI and I've got it imported without any problems. However, ...
0
votes
0answers
61 views

Named pipe impersonation affected windows versions

I want to know which windows versions are vulnerable to named pipe impersonation attack. And, are the techniques used in that attack for each version the same?
1
vote
0answers
37 views

CMSTP.exe used for Applocker Bypass

A lot of literature suggests that CMSTP can be used for AppLocker bypass by making use of a malicious INF file which can fetch and run a malicious sct file which can in turn run arbitrary code. (https:...
2
votes
0answers
64 views

Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
0
votes
0answers
61 views

How to spot malwares that hide their disk usage from Resource monitor?

So lets say a malware has hid itself from task manager, so it wont show up in there. lets also say that it also hides its disk usage from resource monitor as well. (based on previously asked ...
1
vote
0answers
56 views

The last logon time of the Administrator user in Windows 7 system is prior to the OS installation date, why?

What may be the reason behind the fact that in a digital forensics report (FSL report) of a computer's hard disk, the last logon time of the Administrator user in Windows 7 system is prior to the OS ...
4
votes
1answer
175 views

What is Windows Watchdog and what do we know about it?

Today I came across this term "Watchdog", and something about "DPC_WATCHDOG VIOLATION" errors in Windows. I tried googling around but I only found posts on how to fix Watchdog errors, but nothing on ...
0
votes
3answers
150 views

Can you detect that new files were added to a hard drive that was removed and replaced?

The internal HDD was removed from my laptop (with Windows 7) and connected to another machine to tamper with. Some new files were also created/copied by the mischief maker. After the tampering was ...
2
votes
1answer
190 views

How secure is the windows Cipher command?

So in windows CMD, there is the Cipher.exe Command Line tool. Supposedly it will allow you to fully overwrite empty disk space with 0x00 and 0xFF. (with the /w parameter) There is some further ...
1
vote
1answer
737 views

ShadowHammer: Limited to Windows?

I've been reading about ShadowHammer over the last couple of days: Kaspersky researchers estimated half a million Windows machines received the malicious backdoor via ASUS' update server. But the ...
0
votes
0answers
47 views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
0
votes
0answers
53 views

Windows Firewall - How do I know that I have completely blocked a program?

I have a specific software that I cannot let out to the internet but it is crucial that it has access to the local network. I can create an inbound and an outbound Block rule for the main application'...
0
votes
2answers
103 views

Windows - How to restrict access to VBScript.dll and JScript.dll?

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform. Recorded Future ...
0
votes
1answer
102 views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
1
vote
0answers
50 views

Is there any key in HKEY_CURRENT_USER which sad when user was login on pc?

Try to find information about user login time. Has no any events for searched time saved in windows security events. Thing that maybe registry can help me for that. Is there any key in ...
0
votes
1answer
69 views

Exploit Development on windows environments

I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?...
2
votes
0answers
100 views

Eventviewer empty logs with English written in Cyrillic Greek

So a while ago I entered my event viewer on windows 10 and I noticed a bunch of weird entries. They look like they where written in English but with the use of Cyrillic and Greek alphabets. I am ...
0
votes
0answers
19 views

How to run a snort rule over PCAP file in Windows? [duplicate]

I have a PCAP file from CICIDS, and what I'd like to know is how can I apply the Snortrule in Windows? I've not written any custom rules myself but want to run the rules already available. For now, ...
1
vote
2answers
125 views

Windows 10 User Profile name - is it ever visible outside network or on internet?

Taking this to the extreme just to make it clear. What if I named a Local Windows 10 user name the user's social security number, or full name? Not concerned about local threats, just regular network ...