Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
1 vote
0 answers
26 views

Unlocking a Windows computer through the CMD prompt [closed]

Let's say I had an "NT AUTHORITY\SYSTEM" command shell on my locked Windows computer (at the login prompt) and I would like to get log in as user X (as if I logged in normally with their ...
user avatar
-1 votes
0 answers
10 views

How delete windows logs with powershell & cmd command in period of time [closed]

I am curious that how can can i delete windows logs with PowerShell & cmd command in period of time? Period of time mean only delete specific logs related to last two month. Please show all ...
user avatar
0 votes
0 answers
7 views

Why is Chrome connecting to wpad:80 and why is the connection hanging so long? [migrated]

I am using Socks5 using with proxifire v3.21 When I open Chrome, there are some wpad connections in proxifire with connecting status like below : What are these connections? They cause one minute ...
user avatar
-1 votes
0 answers
59 views

How remove undetected ransomware from my Windows PC [closed]

I am c# developer and i am researching on security and i am totally new in this field. Some month ago i received a mail like this : Hi. This is the last warning. I hacked your operating system ...
user avatar
0 votes
1 answer
59 views

File sharing with compromised Windows machine

I want to connect a known to be compromised Windows machine to the network for file sharing, it has lots of pirated software installed therefor not secure. Can it be isolated so that nothing can ...
user avatar
  • 1
1 vote
1 answer
34 views

Is there any way to disable/not allow unquoted service paths in Windows?

Unquoted service paths might be used as a privilege escalation vector after an attacker gains access to a Windows host. Given Hector's answer in the following question: "Windows Unquoted Search&...
user avatar
  • 133
1 vote
1 answer
22 views

Export ECDSA certificate from Windows Store

I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
user avatar
0 votes
0 answers
32 views

How to securely transfer the privatekey and pass it to wireguard in a memory safe manner?

Suppose I have a game server with only the wireguard port open, the client request wireguard configuration from a HTTPS server. And use the obtained configuration in a modified wireguard. The ...
user avatar
20 votes
9 answers
7k views

Need to leave computer in repair shop. How can I secure solid state drive contents?

I need to take my desktop into a PC repair shop and leave it for a few days. It would be easy for them to copy the drives without me knowing. I am running Windows 10 with a password but this doesn't ...
user avatar
  • 431
0 votes
1 answer
36 views

Common attack vectors for Microsoft Exchange Server?

What are the common attack vectors for a Microsoft Exchange Server? My online searches only yield discussion into various APT groups, and technical write-ups of different 0day exploits. There does not ...
user avatar
-2 votes
1 answer
112 views

How can this Jim Browning YouTuber have access to so many scammers' computers/networks?

I'm frankly sick of these videos, and the only interesting part to me has nothing to do with the scam or the content of the video, but simply the fact that he is apparently somehow able to see exactly ...
user avatar
0 votes
0 answers
15 views

how to use a custom dns and socks5 at the same time?

So I have a program that gives me a socks5 connection 127.0.0.1:1080 (it connects to my server and creates a socks5) I want to make firefox connect to this socks5 (to use the server IP) but use a ...
user avatar
  • 1
0 votes
2 answers
64 views

Local Machine certificate (certlm.msc) Import - Enable strong private key protection

We were trying key export from Windows Certificate Store as part of a certificate module development. The code is in C++ and mostly WinCrypt and openssl APIs are used. I installed a certificate that ...
user avatar
2 votes
0 answers
91 views

Windows XP SP3 2002 is not vulnerable to MS08-067

Why is my VM not vulnerable to MS08-067? There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
user avatar
0 votes
0 answers
44 views

How can a service securely update an application even when the computer's current user could be hostile

Keep in mind that I am not a security specialist or a networking specialist. I am a software developer dealing with this kind of software for the first time. Our software is used to control user ...
user avatar
1 vote
0 answers
77 views

How do screenshot blocking technologies work? [closed]

I've noticed I can't take screenshots of videos in Star+. When I paste whatever I tried to shot, it comes all black (subtitles however are visible). After some research, I found out it happens with ...
user avatar
  • 111
-1 votes
2 answers
76 views

How exactly is a fingerprint stored in Windows Hello? Why is it claimed to be more secure than a password?

I can't quite imagine a scenario where fingerprints can be stored in a way that defeats the weaknesses of password storage (i.e. pass the hash attacks or password reuse). Moreover, I couldn't quite ...
user avatar
  • 9
0 votes
0 answers
62 views

Windows hello pin removal/crack

Is there a workaround to the Windows 10 Hello PIN security login policy? The PIN is the only credential needed to log in, no password is set, checked with samdump2. I inherited this computer from a ...
user avatar
  • 1
1 vote
2 answers
151 views

How to secure against USB drives?

Is it possible to set up Windows in a way that plugging in external storage can't compromise the device/network? To clarify, I would like to use the storage device to transfer data into the network. ...
user avatar
  • 615
0 votes
0 answers
63 views

Microsoft Pluton Security Chip - Specs and API?

Microsoft introduced a new security chip dubbed Pluton that is ought to become mandatory for systems running Windows (11 and forward). AMD has already implemented or is about to implement the chip as ...
user avatar
  • 191
0 votes
0 answers
108 views

C# Hello World program detected as virus

I just wrote and compiled a Hello World program in C# (I'm using Visual Studio 2022) and when I sent the file to VirusTotal, 1 antivirus program detected the exe as unsafe (VirusTotal results of C# ...
user avatar
0 votes
0 answers
261 views

security certificate does not specify Subject Alternative Names

We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
user avatar
  • 101
2 votes
2 answers
4k views

Microsoft Defender flagged Surfshark.exe as "Misleading:Win32/Lodi"

Can this be safely ignored? VirusTotal shows that Microsoft is the only security vendor that flagged this file as malicious. I did not modify my Surfshark installation in any way, except for an update ...
user avatar
6 votes
1 answer
354 views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
user avatar
0 votes
1 answer
32 views

Does adding a new user (instead of just using root) help WSL2 security?

Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux ...
user avatar
  • 1,128
0 votes
0 answers
83 views

lsass.exe spawning lsass.exe

In logs, I found lsass.exe spawning lsass.exe. C:\Windows\System32\smss.exe C:\Windows\System32\smss.exe C:\Windows\System32\wininit.exe C:\Windows\System32\lsass.exe C:\WINDOWS\system32\...
user avatar
0 votes
2 answers
45 views

How do AV interact with malicious executables in remote shares?

I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish. Say I'm attacking a Windows machine and host an SMB share from my Linux machine with ...
user avatar
0 votes
1 answer
125 views

What can prevent Mimikatz from accessing LSA?

I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully. .#####. mimikatz 2.2.0 (x64) #...
user avatar
0 votes
0 answers
75 views

Hash-Based Technique to Detect Ransomware Corruption on the Fly?

I have developed an Excel spreadsheet to compare lists of SHA-512 hashes from two separate drives. One drive is the source data drive on a Windows machine. The other is a backup of that drive, ...
user avatar
3 votes
1 answer
96 views

What is the Print Nightmare threat vector?

I've researched this topic a few times and have not been able to come up with a definitive answer. It appears the threat may be multi-faceted. I ask in the context of a standard Server/Client Windows ...
user avatar
0 votes
0 answers
40 views

How to find data associated with windows defender processStart reference in windows10

Recently my windows defender warned me about a possibly malicious program it found on my pc. I have trouble interpreting the data windows defender serves me and I haven't found any microsoft ...
user avatar
0 votes
2 answers
65 views

connecting to Windows Admin Center using port 443

I want to use Windows Admin Center, but I don't want to install a SSL certificate. If I were to forward packets from 80 to 443 using firewall rules would they automatically be encrypted?
user avatar
  • 1
1 vote
4 answers
127 views

Is doc file really modifying registry in Windows?

Been given a .docx file to check whether it has a virus or something, ran McAfee and SuperAntiSpyware on it and results came back negative so I though it was good and proceeded to open it, just a file ...
user avatar
1 vote
1 answer
133 views

What's suspicious about this event log?

I got an event that something is wrong with, but I don't understand what exactly. { "EventTime":"2021-11-22 21:05:45", "Hostname":"pc2", "...
user avatar
1 vote
1 answer
82 views

How exactly does Windows Bitlocker work?

I wonder how Windows Bitlocker and other similar software works. I know they differ in terms of security level as some software does not fully encrypt locked files, but I'm speaking of unauthorized ...
user avatar
  • 113
0 votes
0 answers
30 views

Weird Problem with Virtual Machine and Comodo

I am new to this forum and I have the following issue: Some days ago, I clicked on a pop up-window in my Linux-VM that said I need to Update some features or so ... after I clicked "Okay", ...
user avatar
  • 1
0 votes
0 answers
41 views

Most Secure ways to to authorize clients on their devices that are remotely connected by (AnyDesk, TeamViewer, etc...) without knowing the password

My case is I'm designing an app based on chromium browser powered by Electron . And I need sometimes to log the clients in with some web apps. The password is only visible as dots in browsers by ...
user avatar
2 votes
2 answers
274 views

Is Windows 10 Home more secure than Windows 10 Pro in some way?

I'm planning to do a fresh install of Windows 10 on my mother's computer. Despite it has Pro version right now, I wonder if I should use Home version instead, which is also called Single Language. ...
user avatar
  • 757
0 votes
0 answers
198 views

Is the Windows service "Session Detection" (SessionService.exe) safe?

I was restarting a service and happened to notice that I had one service running that had no description. This struck me as curious. It's called "Session Detection" and is located at c:\...
user avatar
0 votes
0 answers
32 views

How to permanently remove DDE Exploit:O97M/DDEDownloader.C? Do I need to nuke my computer? Is it safe to not do so? [duplicate]

1Starting yesterday windows defender has found and quarantined 5 copies (pic 1) of the following threat (pic2) Exploit:O97M/DDEDownloader.C see here. I tried contacting Microsoft tech support but they ...
user avatar
  • 1
2 votes
2 answers
156 views

How to create a safe environment in Windows 10 for high-performance programs?

My friend handed me a .exe file of an old game we want to play together. My laptop has important files, so I do not want to install it immediately. I am still sceptical that he might not know it ...
user avatar
  • 21
1 vote
1 answer
84 views

Detect bruteforce attempts on Windows 10 (without event log)

I'm currently working on a software project as part of a course on Operating Systems Security and one of the features in my project is to detect bruteforce attacks on Windows hosts. I know that I can ...
user avatar
0 votes
0 answers
28 views

How would you go about preventing a multi-threaded process from suspending? (Windows 10) [duplicate]

I have a, well, disobedient program which, as I continue exploring it, shows some very interesting, possibly dangerous programming techniques. I do not have the source for this program. One of the ...
user avatar
0 votes
1 answer
108 views

What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?

I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
user avatar
  • 23
2 votes
1 answer
72 views

Child processes vs microservices for communication between components

This is a question for operating system security experts. We have an application using one platform/language, and it has to integrate with a library that uses another platform/language. There is no ...
user avatar
  • 234
0 votes
1 answer
61 views

Is Sysmon.exe modifying root certificate legit activity

Today I got an alert on my Elastic SIEM that sysmon.exe has modified or created a root certificate. I tried to look for the certificate thumbprint in the Microsoft trusted root program and could not ...
user avatar
  • 31
1 vote
1 answer
105 views

Fresh OS install after Ransomware, but it’s still coming back. What’s the correct procedure for a fresh install to protect myself?

I’ve been hit by Ransomware several times this year, and I’m going nuts trying to stop it. About a month ago I got hit, and I did a complete rebuild of my Windows 10 machine. Fresh OS and installed ...
user avatar
0 votes
0 answers
48 views

Executing cmd command on XP with metasploit

I am pretty knew to cyber, but looking at metasploit and trying to execute arbitrary commands in cmd on an old Windows XP. I am trying to use https://www.infosecmatter.com/metasploit-module-library/?...
user avatar
  • 1
2 votes
1 answer
103 views

Does Windows use Bluetooth Authenticated pairing with encryption automatically?

Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
user avatar
0 votes
1 answer
78 views

Why does Microsoft SmartScreen require OV certificates to be signed by a trusted CA?

Signing your applications with an OV code signing certificate enables them to build reputation together in Microsoft SmartScreen, rather than each binary building reputation separately. This allows ...
user avatar
  • 223

1
2 3 4 5
42