Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

-1
votes
0answers
18 views

b7c81.rbf file? Is it dangerous? [on hold]

I started the computer as usual but I noticed of a weird process in the task manager, the file was called b7c81.rbf and when I looked its properties, it said that it was from a Config.msi file (or ...
0
votes
0answers
29 views

Windows Firewall - How do I know that I have completely blocked a program?

I have a specific software that I cannot let out to the internet but it is crucial that it has access to the local network. I can create an inbound and an outbound Block rule for the main application'...
0
votes
2answers
50 views

Windows - How to restrict access to VBScript.dll and JScript.dll?

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform. Recorded Future ...
0
votes
1answer
45 views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
1
vote
0answers
46 views

Is there any key in HKEY_CURRENT_USER which sad when user was login on pc?

Try to find information about user login time. Has no any events for searched time saved in windows security events. Thing that maybe registry can help me for that. Is there any key in ...
0
votes
0answers
4 views

Where is Windows 10 PIN stored? [migrated]

I know that Windows 10 stores passwords in NTLM hash in SAM file. Where is windows 10 pin hash stored?
0
votes
0answers
32 views

Exploit Development on windows environments

I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?...
2
votes
0answers
31 views

Eventviewer empty logs with English written in Cyrillic Greek

So a while ago I entered my event viewer on windows 10 and I noticed a bunch of weird entries. They look like they where written in English but with the use of Cyrillic and Greek alphabets. I am ...
0
votes
0answers
15 views

how to get the date a file was copied into a folder [migrated]

In Windows 7, how to get the datetime that a file was copied into a folder? I keep getting create date but that's not what I want. I want the time the file arrived in the folder. I need to use code to ...
0
votes
0answers
16 views

How to run a snort rule over PCAP file in Windows? [duplicate]

I have a PCAP file from CICIDS, and what I'd like to know is how can I apply the Snortrule in Windows? I've not written any custom rules myself but want to run the rules already available. For now, ...
1
vote
2answers
86 views

Windows 10 User Profile name - is it ever visible outside network or on internet?

Taking this to the extreme just to make it clear. What if I named a Local Windows 10 user name the user's social security number, or full name? Not concerned about local threats, just regular network ...
0
votes
0answers
50 views

One line .vbs windows reverse shell [on hold]

I used msfvenom to generate cmd reverse shell, but I need to run without creating .vbs file on the disk. How can I do that with mshta? mshta vbscript:Execute("MsgBox(""amessage"",64,""atitle"")(...
25
votes
4answers
5k views

Do my Windows system binaries contain sensitive information?

I have a dataset from a malware detection project that others want to use. Part of that dataset is system binaries that I had retrieved from my PC by searching for *.exe files (to serve as a benign ...
0
votes
1answer
137 views

Can a Windows 10 Local Account password be retrieved

I have heard that Windows (10) local accounts are not that secure. I am however particularly wondering whether the password can be retrieved using any tools. So I am not talking about resetting it ...
-1
votes
0answers
19 views

“Remove files and clean hard drive” on Windows 10 [duplicate]

In Windows 10, when choosing Reset this PC, there's the option to Remove files and clean the drive. How secure is this option? Is it good enough to use before handing off a laptop? Anyone know what ...
0
votes
2answers
90 views

How To Secure a Computer Stick that Runs a TV

I purchased an Intel compute stick to turn a TV into a display. I have it set up so that I can VNC into the computer to change what shows up (Open windows, show movies, etc...). It works great in ...
0
votes
1answer
44 views

How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host

(Forgive me, I don't know whether to post this here for in the "Tor" community) I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (...
1
vote
1answer
47 views

Why Bitlocker requires partition on some computers but not all

We have HP desktop computers all identical. I setup Bitlocker encryption on one, no partition was required and the computer was fully encrypted. Second computer gave me a different result, Bitlocker ...
0
votes
0answers
39 views

Veracrypt system encryption cloning properly [migrated]

I own a Windows laptop. I encrypted it with the Veracrypt system encryption. When the laptop boots, there is a black screen and it asks for the encryption password. There are four partitions on the ...
2
votes
0answers
52 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
2
votes
0answers
58 views

How to force employees to complete security awareness quiz? [closed]

The idea is that when a user logs in PC (Windows 10) he should be forced to complete a quiz before he could start work. These are company owned laptops. The quiz will be few questions short, shown ...
1
vote
0answers
30 views

Does Local API Hooks trigger Anti-Virus Flags? [closed]

If I do API hooking on my local Address Space (without doing dll injection on other process), will the AVs be triggered?
0
votes
1answer
25 views

Can I track delete action in event viewer?

Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
1
vote
2answers
68 views

How safe is it to disable DEP for a program?

I've been playing a game and there is a private server (with around 2k population) that asks us to turn off DEP for their game, I read about what it does but I don't understand what the consequences ...
0
votes
1answer
101 views

Cmd shuts down computer immediately after windows boots up and logs into the default account/user

as the title suggests, after I login to default/main account which has administration privileges, after desktop loads almost instantly CMD opens and shuts down the computer, only way I found to stop ...
0
votes
1answer
56 views

Monitoring of Logging

I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation. What all features could I ...
0
votes
0answers
28 views

Recovering local administrator password after passing the hash

I have a Windows PC (Windows 7/Windows 10, no additional defenses/mitigations in place) that I've created a local administrator account on after 'konbooting' or similar and logged on with. This ...
0
votes
1answer
70 views

What tools can recover or do forensic analysis on deleted registry entry?

I'm reading this article, in the Deleted Recovery Example it has the following picture, Figure 8 shows an example of a data recovery error by a popular registry forensics tool I have two questions ...
0
votes
2answers
129 views

Determine if helloworld.msi is malicious

Recently, while checking the windows application logs, I found that an application communicates with a certain website. The process starts and ends in about a minute. It does not appear in my search ...
1
vote
1answer
55 views

Truly Disabling Session Tickets in Windows 10 Schannel

In windows 7, session tickets were disabled by disabling schannel cache, example: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL] "EventLogging"=dword:00000004 "...
1
vote
2answers
49 views

What program can Decrypt specific a Folder/Files during Windows Boot/Loading? (Windows)

I've been looking into Encryption of my data for some time now; I've decided to move ahead with VeraCrypt for encryption all of my partitions (I have 2 disks in 1 laptop) except for the OS (C:) ...
0
votes
0answers
86 views

Unable to write to C:\ folder when logged in through BUILTIN\Users account | Windows Privilege Escalation | Unquoted Service Path

I have made an auto-start service from user (who is only in Administrators group and not Users) command prompt which is vulnerable to Unquoted Service Path. Executable path: C:\Program Files\A ...
0
votes
2answers
129 views

How to hide a process in Windows?

Is there a way to make a process hidden without using any Administrator-level priviledges? I am building an antivirus which I want to protect from malware's actions, such as ending the process, or ...
0
votes
1answer
70 views

Knowledge Base about Windows Defender

I am trying to find more information on the alerts that come up from Windows Defender and include one of the following: Remediation Status: What is it?, what are all the different types? and what ...
3
votes
1answer
150 views

Is storing information in RAM more secure than on Disk?

I realize neither is foolproof, of course. I would just like to confirm my thought that it's harder for an attacker to get a memory dump than to copy from disk/flash-storage or that malware just tends ...
1
vote
1answer
113 views

Windows server 2016 Remote Desktop username leaked

One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
1
vote
1answer
72 views

Can an unprivileged program modify an HTTP request response on the local machine?

Imagine you have a simple GET request going to server 123.456.111.222. Your client executable creates a winsock on the server IP (TCP) and sends the HTTP request (unencrypted) to the server. If a ...
0
votes
1answer
39 views

What considerations are there for using USB WiFI adapters and how to protect against them?

Often with older machines, the built-in WiFi adapters have failed. These in turn drive a demand to procure USB WiFi adapters since ethernet connectivity is not a choice. Since the devices will be ...
1
vote
1answer
115 views

Why does windows defender scan my computer multiple times [closed]

Occasionally, Windows Defender sends me a notification that my device was scanned. This occurrence is quite ordinary and boring, but I actually devoted two seconds to reading the entire message once, ...
0
votes
0answers
42 views

Threat Hunting Observations : Basic Scoring Jupyter Notebook for Running processes on Windows Operating Systems

I am trying to create a scoring Jupyter Notebook created for Windows Processes and I was wondering about what information would I exactly need to generate a basic Score for each process running on a ...
0
votes
1answer
30 views

How to track network file share accesses on workstations

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID ...
1
vote
2answers
127 views

Windows process documentation for tuning Sysmon

I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
0
votes
1answer
49 views

'Continue experiences on this device' group policy

In an enterprise or office setting, should I set 'Continue experiences on this device' under the group policy to be disabled? Why should I set it to be disabled, or why shouldn't I set it to be ...
1
vote
1answer
225 views

How to (temporarily) disable McAfee Endpoint Security on an enterprise workstation?

I need to temporarily disable McAfee Endpoint Security on an enterprise workstation after having obtained local administrative privileges. The McAfee Endpoint Security settings are protected by a ...
2
votes
0answers
38 views

Active Directory Server and Mimikatz

Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
2
votes
1answer
31 views

How to control program permissions and resources in Windows

Is it possible to set specific restrictions/permissions for a program(s) by using any software/feature on Windows? Preferably set before launch and preferably set using a single software/interface, ...
0
votes
0answers
12 views

Backup information with Disk2vhd?

To make a backup of a partition along with its metadata (dates of access, modification, etc) can Disk2vhd be used or is it necessary to make a copy sector by sector? I need to copy the information ...
0
votes
1answer
56 views

Fool SAML authentication

My company's has given a corporate membership to Udemy, which is accessible from company's laptop only. I tried to look into it and it uses SAML. If I open my company's Udemy website on any other ...
0
votes
1answer
125 views

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks?

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks? I understand that RC4 HMAC encryption is dangerous in Windows Active Directory, since it relies on the ...
0
votes
1answer
47 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...