Questions tagged [windows]
Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].
2,215
questions
0
votes
0
answers
8
views
Local Machine certificate (certlm.msc) - choosing "Microsoft Software Key Storage Provider" on import [migrated]
When importing a device certificate/private key through CERTLM, the GUI seems to choose a deprecated Cryptography Service Provider (CSP) called "Microsoft Strong Cryptographic Provider"; I'm ...
- 101
0
votes
0
answers
42
views
Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS?
Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS?
Such as:
blocking (or entirely hiding) the option to connect to open networks
...
- 6,661
0
votes
0
answers
26
views
ZeroLogon possible false positive events 5827? (CVE-2020-1472)
ZeroLogon checklist:
August 11, 2020 updates have been deployed on all domain controllers.
February 9, 2021 updates have been deployed on all domain controllers.
All devices are running Windows 10.
...
- 369
1
vote
1
answer
68
views
How to tell if BlackByte NT ransomware is on my computer?
The company I work at sadly fell victim to BlackByte NT ransomware this week. It ransomed many of the Windows machines on our factory floor.
I have used my personal laptop (Windows 10 Home, version ...
0
votes
0
answers
84
views
I need help properly encrypting my computer SSD
My main laptop recently broke down and i've been forced to use an older laptop I had in storage.
This machine was encrypted years ago with veracrypt and only has an SSD. It's around 250 GB of storage.
...
1
vote
0
answers
233
views
Security risks in using ‘no @thankyou.com’ to bypass Microsoft account login when installing Windows 11
One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended ...
- 111
0
votes
1
answer
54
views
How to mitigate spoofing, keylogging password, stealing public key with smart card with external/internal smart card reader?
Here is my thought process:
I want to use smartcards without passwords for my setup. We don't want to use Iris or fingerprint or voice. I only want to put in the card whenever something needs to ...
0
votes
0
answers
23
views
How do I check if my PowerShell is connected on SSH?
I know how to check but command line cmd or powershell can be altered to make it look clean with disguised hash codes (which they show like they are not tempered but actually commands are altered and ...
0
votes
0
answers
11
views
Feeding Bitlocker with a startup key from a network service [migrated]
I am trying to bind Bitlocker operations (specifically booting Windows) with some form of network presence. In other words, I want to set-up some form of 2FA (via the network) to allow booting Windows....
- 1
0
votes
0
answers
9
views
How to restore Microsoft root certificates after moving them to untrusted list? [migrated]
I have been experimenting with security options on m my Windows 10 and moved all Microsoft root certificates from trusted into untrusted position. Not sure if that was the problem but my admin ...
0
votes
0
answers
36
views
Can already opened event logs of PowerShell's event properties screens on Windows be hacked by hackers in milliseconds?
I am wondering some issues about event log safety of powershell. I think is it possible to alter the powershell itself. But theorically the event log should show us every attempt made in powershell ...
0
votes
0
answers
23
views
W-Firewall blocks Port 135 if using IPsec Kerberos V5 User Authentication
i am about to implement IPsec to achive a zero trust environment, in order to do so i am using the Windows Firewall with IPsec Rules (Allow the Connection if it is secure).
Everything works fine, but ...
- 1
1
vote
0
answers
53
views
Windows decrypting TC volume without passphrase?
I remember having read a blog post or a forum post, some years ago, about a TrueCrypt user whose Windows machine sometimes, at boot, did not ask for the TC passphrase and decrypted automatically the ...
- 5,168
0
votes
1
answer
88
views
Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access
My partner recently got given work laptop and if you try and put in a USB mass storage device you get an error saying it is not allowed. Without having administrator access I assume this is via the ...
- 71
1
vote
0
answers
67
views
Is having no driver installed better than having old driver?
How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates?
On older PCs and laptops where some components are no ...
0
votes
2
answers
183
views
Implications of enabling Developer Mode in Windows 11
Windows 11 appears to have a Developer Mode. I was playing around with Flutter and got prompted to enable it. The setting looks like this:
When I enable it, I get the following confirmation prompt:
...
- 1,319
1
vote
2
answers
140
views
Does a database with pre-calculated SHA256 values exist for Windows EXEs?
Background: At my place of work, we're trying to block all unapproved browsers on all Windows machines and the IT Security guys did a search on our internal infrastructure and came up with a list of ...
- 123
0
votes
1
answer
103
views
Windows 98 hacked just by visiting a website? [duplicate]
I am wondering how this was possible. I remember my cousin used to use the family computer and it was infected with viruses just by browsing the internet. I recall a bunch of our desktop icons turned ...
- 101
0
votes
0
answers
54
views
Using rainbow tables to obtain the first 7 characters of a windows password(LM/NTLMv1)
I am trying to understand how an attacker is able to use the halflm challenge rainbow table to obtain the first 7 characters of a windows password that was used to authenticate a user using LM/NTLMv1. ...
- 195
1
vote
1
answer
60
views
What information is contained in the local SAM in an Active Directory network
I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine?
I understand (and correct me if I'm wrong) that when logging in to ...
- 71
1
vote
1
answer
108
views
Is it worth it to force UAC to ask for a password?
I've tried to harden my Windows 10 by using an unprivileged account, which I know reduces the attack surface a lot. I'm running Ableton (a music program) which is running after UAC has given admin ...
- 35
0
votes
0
answers
42
views
Is hashdeep deprecated?
The other day corporate or the vendor used their cloud deployment tool to replace some of our DLLs, and it got me wondering; does anyone still use hashdeep when they initially roll out a server or ...
- 1,399
1
vote
0
answers
61
views
Cannot `qwinsta` during WinRM, but it works when run under `NewCredentials` logon type
When I try to WinRM into a Windows host (with a tool like evil-winrm) into the and when I do qwinsta, it says "No sessions exists for *", however, when I do RunasCs.exe x x "qwinsta&...
- 111
0
votes
1
answer
69
views
Port scanning but Windows firewall isn't logging the connection
We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular.
Scans always follow the same ...
- 1
0
votes
1
answer
66
views
Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway
Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway.
One person says to that VMware Remote Console is more secure than using ...
- 101
0
votes
1
answer
69
views
Is DPAPI usable when only being able to read the file directory?
DPAPI: Windows Data Protection API
Say I would be able to read a Windows system file system, including all files.
Say there would be a DPAPI encrypted value somewhere in this system that I want to ...
1
vote
0
answers
57
views
How to detect/trace if a Windows Live/PE used on a system?
Is it possible to detect/trace if a Windows Live/PE is used on a system?
Like with logs or dumps etc.
0
votes
0
answers
62
views
What does an exported BitLocker key package contain?
I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks.
I've also ...
- 181
0
votes
0
answers
88
views
Why would Jenkins want to read the memory of lsass.exe?
Is there any legitimate reason why Jenkins would ever need to request the memory of c:\windows\system32\lsass.exe (Local Security Authority Subsystem Service)?
The endpoint protection (Carbon Black) ...
- 369
0
votes
0
answers
117
views
Is UAC an overestimated protection measure in Windows? Does Linux do it better?
Windows is an API-based operating system, whereas Linux is file-based. Hence in my opinion, any operating system API security measures alone aren't effective in Windows. One of such examples would be ...
- 1,554
0
votes
0
answers
15
views
Dump Windows 11 PIN hash [duplicate]
Can anyone tell me how to dump the Windows 11 PIN? I tried dumping SAM and SYSTEM but the PIN hash is not there. What mode we can use in hashcat to crack it?
0
votes
0
answers
52
views
Are domain admin credentials cached when entered for approving a software installation?
From what I know, it's a bad practice to login to any workstation or server except domain controllers as a domain admin. I read that mimikatz or other malware can extract the hash of the password from ...
- 13
2
votes
1
answer
1k
views
Is it possible for a Virus to "leave" the Windows Sandbox (VM) and infect the host system?
Im using Windows 11 Pro. It has a feature called "Windows Sandbox", which is basically a virtual machine.
If im getting a Virus inside of this sandbox, is it possible for that Virus to ...
- 43
0
votes
0
answers
48
views
Is there a way to find the devices my SSD was plugged in?
I gave my laptop for repair to a technician now I suspect he might have copied my files to another pc by probably plugging in my SSD to other devices. I already tried checking the properties but idk ...
- 1
1
vote
1
answer
112
views
Which algorithm does CryptGenRandom use on my laptop?
I have an Ideapad Gaming laptop by Lenovo, with an Intel(R) Core(TM) i5-10300H processor. On this laptop I have Windows 10 installed. To generate random numbers, I use the CryptGenRandom function. ...
- 113
0
votes
0
answers
66
views
How to double hop pivot?
I have a networking routing problem which I am unable to find a solution for:
I have a first machine, 192.168.51.103 (Windows), which is linked to subnet 172.16.51.0/24. To access this subnet, I first ...
0
votes
0
answers
22
views
How to analyze code files (Java, PHP, Python) for malicious code? [duplicate]
How can we analyze files like .jar or .php or .py files for malicious code?
I need to automate the analysis process using machine learning. What should be the features in these cases?
0
votes
0
answers
106
views
Is it possible to disable screenshare if someone's got meterpreter shell on your PC?
If hypothetically there was a meterpreter shell installed on your pc, are there security features or ways to harden a Windows laptop to prevent the hacker from using the screen share command to spy on ...
- 1
0
votes
0
answers
34
views
OriginalFirstThunk in memory
I understand the point of IAT/IDT/ INT and dynamically loaded DLLs at runtime. The OriginalFirstThunk in the Import Directory table refers to the function names stored (in the case of an ordinal) in ...
0
votes
1
answer
64
views
Static malware analysis using machine learning
As you know, using machine learning we can detect malware.
We can use dynamic analysis based on WinAPI function calls and their arguments.
But what about static analysis using machine learning? In ...
0
votes
1
answer
93
views
What are all ways to run code at Windows startup?
I'm the attacker. What are all the options to run code at the Windows startup:
If I have administrator rights?
If I have normal user rights?
Can someone put any program (or script) in this method or ...
- 21
0
votes
0
answers
258
views
How to prevent WPAD attack
We had a pentration test in our company. One of the recommendations was to disable WPAD (Windows Proxy Auto Discovery), LLMNR, NetBIOS.
We have successfully disabled LLMNR by GPO, NetBIOS on DHCP as ...
- 1
2
votes
1
answer
586
views
Windows Update installs yandex.ru browser hijacker
I recently created a Windows 10 installation stick via the official media creation tool. Presumably, there was no malware on my host system on which I created the stick. It's a pretty fresh install as ...
1
vote
0
answers
93
views
IAT/IDT in memory PE file
Can anyone please explain me this:
First, we look at the last value of the Optional Header, Data
Directories, the Import Directory RVA value. This value gives us the
address of the Import table when ...
0
votes
0
answers
53
views
Check BadUSB or similar threats via software [duplicate]
I recently purchased a fake USB flash drive for its cool and beautiful case. I know that the seller modified the firmware so that it shows a different capacity to the operating system, but I am not ...
0
votes
0
answers
36
views
simulating a domain user logon on machine startup
I'm currently working on a lab for AD penetration testing and want some of the machines to have a logon, including the TGT, for a specific domain user cached. So far I couldn't come up with anything ...
- 1
0
votes
0
answers
362
views
Encryption of NTDS.dit (BOOTKEY)
Looking around I found some information regarding NTDS.dit encryption and I wanted to learn a little bit more around the BOOTKEY and whether this is rotated each boot up sequence or is just held ...
- 153
3
votes
1
answer
193
views
NULL dereference - Why does it work?
I know that exploiting NULL dereferences is a thing of the past and that modern systems prohibit user processes from mapping NULL page, but I also know that back in the day, a NULL dereference in the ...
- 31
1
vote
1
answer
311
views
What does Windows do to prevent dll hijacking?
DLL hijacking (I believe) is when a dll with a name identical to a system dll is placed higher up in the search directory precedence: like placing a malicious dll named secur32.dll or winsock.dll next ...
- 35
2
votes
1
answer
332
views
How does the AV inject their own DLL in each new process?
I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread.
But how can they do that? Because from what ...
- 171