Skip to main content

Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0 votes
1 answer
141 views

Is Git Bash Safe to Use on Windows?

I've recently downloaded and installed Git Bash for Windows https://git-scm.com/downloads, my primary goal is to use it for pushing code to GitHub. I already connect Gitbash with Github in browser ...
1 vote
0 answers
26 views

How to limit the Wireless CA can only use in wireless connection on Windows?

My school require me to install a CA to do connect to the school Wi-Fi network. In android, I can install it into Wireless CA list, and based on my understanding, that won't give the CA owner ...
6 votes
1 answer
2k views

Does CrowdStrike Falcon get validated by the Windows kernel as being crash-free?

With Linux, eBPF programs are validated as not causing crashes. Apparently that validation has had errors previously because of bugs in the Linux kernel. How is CrowdStrike Falcon implemented on ...
1 vote
1 answer
120 views

Can NTLM pass-through authentication be done without NetLogon?

In any "recent" documentation regarding NTLM (Microsoft) I see it stated that the mechanism of pass-through authentication is done over a NetLogon channel, which should be secure. This ...
4 votes
2 answers
223 views

How safe are my app's keys inside the TPM against other apps trying to impersonate mine?

This is a follow-up of these two questions about using the TPM to store application's keys. While both have great answers, there is a specific aspect I am missing: How safe are the keys inside the TPM ...
6 votes
2 answers
153 views

Use of TPM to encrypt data of my application in practice

I am not very familiar with TPMs, but from what I can tell their main benefit for the user is to make the system as a whole more secure, if you take the appropriate measures, e.g. by checking the boot ...
1 vote
0 answers
16 views

Windows 10 - Block File Transfer [migrated]

I would like to disable file transfer via Bluetooth while allowing other Bluetooth services to function normally such as mouse, keyboard, audio, etc. The devices are not on a domain and are not ...
1 vote
1 answer
85 views

How can Bitlocker do this?

Im about to upgrade my CPU that has TPM in it. Bitlocker is TPM+PIN+Keyfile. Now, naturally when upgrading CPU I will suspend Bitlocker, shutdown, change CPU and reboot. OK, I can understand that ...
5 votes
3 answers
4k views

What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?

Note: This is not a question about how to preserve data on a device that is returned for warranty. Rather, this is a question about how to ensure that the encrypted remnant data on the device is not ...
0 votes
1 answer
272 views

Is the Bitlocker encryption key used on HD same for USB?

With Bitlocker, is there only one "master key" that is used to encrypt/decrypt for both HD and USB data? I saw this article today which talks about sniffing the encryption key to get access ...
3 votes
3 answers
11k views

What can prevent Mimikatz from accessing LSA?

I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully. .#####. mimikatz 2.2.0 (x64) #...
2 votes
1 answer
473 views

What information is contained in the local SAM in an Active Directory network

I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine? I understand (and correct me if I'm wrong) that when logging in to ...
0 votes
1 answer
404 views

Rogue login to Google account after Windows clean install

Yesterday I downloaded a sketchy .exe on my Windows desktop and executed it. A command prompt window appeared then nothing abnormal happened. I tried running MalwareBytes but it didn't display any ...
0 votes
1 answer
483 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
1 vote
1 answer
403 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
1 vote
1 answer
446 views

Is persistence via scheduled tasks possible if the user is not elevated?

As far as I can tell, scheduled tasks may only be created by those in the Administrators group by default. Does that mean that persistence can't be achieved via this method without gaining elevated ...
1 vote
2 answers
521 views

What is a secure way to log onto the domain controller?

On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
1 vote
2 answers
256 views

ModSecurity Command Injection not working

I am testing web application firewall and I have installed ModSecurity 2.9 runs Core ModSecurity Rule Set ver.2.2.9 and to test on Web application I also install DVWA Platform: Windows and trying ...
9 votes
1 answer
23k views

What is the effect of the arguments in the following: conhost.exe 0xffffffff -ForceV1

I'm fairly well acquainted with the role of conhost in Windows. I am aware of conhostV1.dll and conhostV2.dll so I assume force V1 would force the legacy mode of conhost (as in Pre Win 7 mode when it ...
1 vote
3 answers
4k views

How exactly is a fingerprint stored in Windows Hello? Why is it claimed to be more secure than a password?

Microsoft's claim that it is more secure. I can't quite imagine a scenario where fingerprints can be stored in a way that defeats the weaknesses of password storage (i.e. pass the hash attacks or ...
21 votes
9 answers
10k views

Need to leave computer in repair shop. How can I secure solid state drive contents?

I need to take my desktop into a PC repair shop and leave it for a few days. It would be easy for them to copy the drives without me knowing. I am running Windows 10 with a password but this doesn't ...
1 vote
2 answers
129 views

Isolating encrypted and unecnrypted Windows installations and protecting the boot loader

I want to use my PC both for gaming and for stuff like keeping cryptocurrency wallets, online banking, etc. I need to install games as admin but of course I don't want them to be able to access my ...
1 vote
1 answer
389 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
1 vote
1 answer
589 views

Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?

According to this page and site, small files are kept in Master File Table when filesystem is NTFS. Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user ...
1 vote
1 answer
253 views

Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway

Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway. One person says to that VMware Remote Console is more secure than using ...
2 votes
1 answer
3k views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
12 votes
1 answer
1k views

Entropy sources used by modern Windows

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
2 votes
1 answer
2k views

Windows Defender's MsMpEng.exe Access lsass.exe

I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then ...
1 vote
1 answer
692 views

Excessive logons from domain controllers

I am quite new to analyzing the windows logs. I have been seeing excessive logons with 4624 and 4625 with the Subject/account name: DomainController(actual name of the domaincontroller is different) ...
0 votes
0 answers
42 views

How to track thread termination if Invoke-Phant0m terminates a thread with no trace in Sysmon?

I recently learned about such a tool as Invoke-Phant0m, this tool has several implementations, one of which is a PowerShell script. The Invoke-Phant0m.ps1 script is a PowerShell script that uses WMI (...
1 vote
1 answer
405 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif. Causing forced authentication which passes the NTLM hash....
27 votes
4 answers
8k views

How long does malware last "in the wild"?

I watched this YouTube video where the uploader connected a Windows 2000 virtual machine directly to the internet, no NAT or firewall. Within minutes, his VM is infected with malware, the overwhelming ...
1 vote
1 answer
308 views

File sharing with compromised Windows machine

I want to connect a known to be compromised Windows machine to the network for file sharing, it has lots of pirated software installed therefor not secure. Can it be isolated so that nothing can ...
0 votes
0 answers
43 views

Multiple firewalls running on the same machine

On my machine, I have had the Bitdefender firewall and the default Windows firewall running for some time. In the past, I have set rules and exceptions such as to block ads on certain applications. ...
1 vote
2 answers
379 views

How to determine which Chrome extension is re-directing me to ad sites

Twice now, seemingly randomly, I've been redirected to an ad site. I believe it has occurred both times when I have a new tab open, type what I'm searching for (Google is my default search engine), ...
1 vote
1 answer
280 views

Would my hypothetical Opsec setup with the goal of compartmentalizing sensitive areas from an insecure sandbox be sensible?

The root cause of my problem stems from the fact that I need to run untrustworthy software on a bare metal windows machine, which means that I can't just have it in a VM because of major performance ...
0 votes
0 answers
40 views

Why is running an exe created from ADS, failing in Win-11 with incompatibility of 64-bit OS?

I'm experimenting with ADS (Alternative Data Streams), and tried to create a text file with the calc.exe embedded in an ADS. I used the following steps to do this: "Hello" >t2.txt Get-...
3 votes
1 answer
1k views

Show confirmation popup before running any downloaded program in Windows 10

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
0 votes
1 answer
174 views

Is DPAPI usable when only being able to read the file directory?

DPAPI: Windows Data Protection API Say I would be able to read a Windows system file system, including all files. Say there would be a DPAPI encrypted value somewhere in this system that I want to ...
0 votes
1 answer
954 views

Understanding port scanning with firewall enabled

My objective is to do a port scanner in windows and find the ports which are open. Suppose, I run an application which opens up a port 8000. Now I create a new inbound rule to block all incoming ...
1 vote
0 answers
33 views

SmartCard rollout for Windows RDP clients

We want to deploy a thin client architecture, where the users can sign-in into their session from every client by inserting their SmartCard into an attached reader but we have a hard time finding ...
2 votes
1 answer
358 views

Does Windows use Bluetooth Authenticated pairing with encryption automatically?

Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
0 votes
2 answers
513 views

Accidentally downloaded a Trojan.Dropper which Malwarebytes picked up, how to ensure system is clean?

So I was trying to download an arcade game, everything seemed legit and I guess I was too excited to play it I started running it - only after clicking it I decided to run a scan on both Avira and ...
0 votes
1 answer
670 views

How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?

It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
3 votes
1 answer
560 views

What is the Print Nightmare threat vector?

I've researched this topic a few times and have not been able to come up with a definitive answer. It appears the threat may be multi-faceted. I ask in the context of a standard Server/Client Windows ...
1 vote
1 answer
490 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
0 votes
1 answer
236 views

Windows Defender Exclusions

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks? Windows defender is the ...
0 votes
1 answer
2k views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
1 vote
1 answer
19k views

Hydra test with Windows RDP taking a very long time [closed]

I am using VMware and have 3 VMs all on the NAT network with DHCP. All three machines can ping each other. From one Windows to the other Windows, I can RDP into the 192.168.190.130 Windows machine ...
3 votes
2 answers
3k views

Windows Kerberos Pre-Auth Failed (4771)

Is there an easy way to distinguish 4771 events from a real attack perspective vs. someone having a stale session with an old password? If you don't get logs from all endpoints and rely on Domain ...

1
2 3 4 5
45