Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

How to permanently remove DDE Exploit:O97M/DDEDownloader.C? Do I need to nuke my computer? Is it safe to not do so? [duplicate]

1Starting yesterday windows defender has found and quarantined 5 copies (pic 1) of the following threat (pic2) Exploit:O97M/DDEDownloader.C see here. I tried contacting Microsoft tech support but they ...
user avatar
  • 1
2 votes
2 answers
167 views

How to create a safe environment in Windows 10 for high-performance programs?

My friend handed me a .exe file of an old game we want to play together. My laptop has important files, so I do not want to install it immediately. I am still sceptical that he might not know it ...
user avatar
  • 21
1 vote
1 answer
96 views

Detect bruteforce attempts on Windows 10 (without event log)

I'm currently working on a software project as part of a course on Operating Systems Security and one of the features in my project is to detect bruteforce attacks on Windows hosts. I know that I can ...
user avatar
0 votes
0 answers
28 views

How would you go about preventing a multi-threaded process from suspending? (Windows 10) [duplicate]

I have a, well, disobedient program which, as I continue exploring it, shows some very interesting, possibly dangerous programming techniques. I do not have the source for this program. One of the ...
user avatar
0 votes
1 answer
133 views

What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?

I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
user avatar
  • 23
2 votes
1 answer
78 views

Child processes vs microservices for communication between components

This is a question for operating system security experts. We have an application using one platform/language, and it has to integrate with a library that uses another platform/language. There is no ...
user avatar
  • 234
0 votes
1 answer
64 views

Is Sysmon.exe modifying root certificate legit activity

Today I got an alert on my Elastic SIEM that sysmon.exe has modified or created a root certificate. I tried to look for the certificate thumbprint in the Microsoft trusted root program and could not ...
user avatar
  • 31
1 vote
1 answer
109 views

Fresh OS install after Ransomware, but it’s still coming back. What’s the correct procedure for a fresh install to protect myself?

I’ve been hit by Ransomware several times this year, and I’m going nuts trying to stop it. About a month ago I got hit, and I did a complete rebuild of my Windows 10 machine. Fresh OS and installed ...
user avatar
0 votes
0 answers
52 views

Executing cmd command on XP with metasploit

I am pretty knew to cyber, but looking at metasploit and trying to execute arbitrary commands in cmd on an old Windows XP. I am trying to use https://www.infosecmatter.com/metasploit-module-library/?...
user avatar
  • 1
2 votes
1 answer
114 views

Does Windows use Bluetooth Authenticated pairing with encryption automatically?

Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
user avatar
1 vote
1 answer
87 views

Why does Microsoft SmartScreen require OV certificates to be signed by a trusted CA?

Signing your applications with an OV code signing certificate enables them to build reputation together in Microsoft SmartScreen, rather than each binary building reputation separately. This allows ...
user avatar
  • 233
1 vote
0 answers
79 views

Is there any safe way to use Windows Credential Manager's generic credentials?

(note: VS Code is just an example, question is not specific to VS Code) I would like to use Windows Credential Manager's generic credentials, say store git passwords when using VS Code, so I have not ...
user avatar
0 votes
1 answer
140 views

Can malicious binaries run from Program Files?

I've been seeing a few false positives from our AV Carbon Black pertaining to wordpad (wordpad.exe) use. The alert I'd see is The application wordpad.exe injected code into another process. Upon doing ...
user avatar
  • 133
2 votes
0 answers
103 views

Why doesn't Defender get suspicious if a program adds exceptions to the Defender?

One can simply add exceptions to the Windows Defender by running this command in Powershell: Add-MpPreference -ExclusionPath <your_path> Why does Windows Defender not immediately flag programs ...
user avatar
  • 53
0 votes
1 answer
95 views

Windows Defender Exclusions

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks? Windows defender is the ...
user avatar
0 votes
0 answers
91 views

How to show someone that offline Windows app I'll send is not malicious?

I want to send someone an offline app (but would be streamed online by other app like OBS) to use, while wanting to show him that his PC won't be infected (or similar) by that app. App will rely on ...
user avatar
0 votes
0 answers
48 views

Could my Windows 7 VM access my network and perhaps my host internet history or data?

I have a Windows 7 Pro VM running on an Ubuntu 20.04 host. I'm a bit new to VirtualBox and set up the VM but it was too slow to do anything so I took a snapshot and closed it. I think my Ubuntu host ...
user avatar
  • 23
2 votes
1 answer
122 views

How to make sure my laptop (Ubuntu 20.04) is secure with a Windows 7 VM?

I have an old laptop which is running Ubuntu 20.04 and I am planning to use a virtual machine of Windows 7 Pro (using VirtualBox maybe). As its an old laptop and not my primary source of using the ...
user avatar
  • 23
0 votes
0 answers
54 views

Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?

Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
user avatar
  • 41
0 votes
1 answer
93 views

Authorization Controls for Offline Windows C# Application

I've been looking into trying to see if there are any authorization controls that can be implemented for a local, and offline, .NET application that are tied to the Windows local authentication. The ...
user avatar
  • 1
4 votes
2 answers
354 views

How does Windows password protect my data?

As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
user avatar
1 vote
0 answers
94 views

Does Windows 10 log network activity?

I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about: Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
user avatar
1 vote
1 answer
107 views

Why is it advisable to capture a disk image before shutting down? [closed]

I am currently studying windows forensics and I have found that it would be advisable to image the drive while it is powered on and live. If you power it off, you likely will not be able to recover ...
user avatar
0 votes
1 answer
88 views

Security for a Windows application running in a corporate network

I know security is pretty important for the web application, but what about windows applications running in a corporate environment, network, not accessible from outside. Do we need to treat security ...
user avatar
  • 101
0 votes
0 answers
115 views

Understanding Windows Firewall question ("Windows defender firewall has blocked some features")

Sometimes I get the Windows Firewall dialog popping up, which offers me to allow an app to communicate in Local networks Workplace networks Public networks (not recommended) Is this choice about the ...
user avatar
  • 101
2 votes
1 answer
315 views

Creating and Comparing Hashing Windows certutil and external hash libraries

I have a question about checking hashes and what is the best utility for it. Seems like you can use some external programs like md5sum or sha1sum. But can't you just use (on Windows) certutil -...
user avatar
  • 21
0 votes
0 answers
117 views

Exploiting the local stack buffer overflow in cmd.exe

I have followed some online tutorials for generating shellcode payloads using Kali Linux, which I have confirmed working by performing several attacks using it. During my pursuit of knowledge, I have ...
user avatar
0 votes
0 answers
186 views

Windows / OpenVPN "kill switch" via firewall

First, not sure if this is the appropriate site or if it would be better suited for a different one, but there isn't a networking or Windows one, so this appears to be the best place. And I'm posting ...
user avatar
1 vote
0 answers
80 views

Why does Windows facial recognition not require a password on startup?

I was reading the following question: Why do mobile devices force user to type password after reboot? To find out why fingerprint authentication on my Windows 10 laptop isn't an option on startup. It ...
user avatar
0 votes
1 answer
140 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
user avatar
  • 138
0 votes
0 answers
217 views

Is it possible to prevent Kerbrute from unauthenticated user enumation Active Directory?

Currently looking for a way to prevent unauthenticated user enumeration on a Domain Controller. This is a security precaution I'd like to implement, next to the existing measures taken prevent ...
user avatar
0 votes
0 answers
128 views

Using msfvenom shellcodes on basic bof demonstration on syswow64 (win10 latest) leads to access violations and StackHash_2beb

I'm currently preparing a course on buffer overflows. The course takes place on the latest version of Windows 10 due to other constraints. Here is my experiment setup: I simulate a basic stack ...
user avatar
  • 131
0 votes
2 answers
205 views

How do I secure SQL passwords when distributing executables?

Environment I am creating a python application which writes to SQL. It is compiled into an .exe and distributed to other computers in the business. (Edit: The SQL server is hosted by our business, ...
user avatar
0 votes
1 answer
229 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
user avatar
  • 101
2 votes
0 answers
252 views

How/when does Windows link private key to imported certificate?

When creating CSR on Windows (using built-in certificate store), I found some weird behaviors: When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate ...
user avatar
1 vote
2 answers
467 views

Is it safe to give away a computer with a hard drive previously encrypted with BitLocker?

Assuming the hard drive is encrypted with BitLocker and it is on a laptop with a TPM module. Then the hard drive is formatted and Windows is completely reinstalled. Is it still possible to recover the ...
user avatar
  • 21
0 votes
2 answers
167 views

How to securely encrypt my computer and protect it from thieves and others

I did enabled Bitlocker encryption on my Windows 10 Pro Laptop. but it has TPM 2.0 chip installed and Because of that it DOES NOT actually Protecting me as someone JUST NEED TO CRACK 1 PASSWORD (...
user avatar
0 votes
1 answer
94 views

Risk Assessment of Windows Cert Store

We all know that SmartCards protect private keys much better than any software-based solution. However, when it comes to the Windows Cert Store to be compared to SmartCards: how difficult is it for ...
user avatar
  • 3
1 vote
1 answer
194 views

How is using the standard Windows account more secure than using the administrator Windows account with highest UAC settings?

If someone uses the administrator Windows account for everyday work while having the default UAC settings they will be prompted by UAC whenever an application other than certain predefined system apps ...
user avatar
  • 5,587
0 votes
1 answer
193 views

Can a file extension be spoofed in windows?

For example, can an .exe file be spoofed in .txt or .mp3 in Windows and still be executed as an executable? I know some basic methods like: using right-to-left override character (U+202E) winrar 4 ...
user avatar
1 vote
2 answers
112 views

Is using a windows user account password necessary on a PC with bitlocker and a complex pin?

Is there a security risk to disabling the windows user account password, since my PC is already unlocked with a complex pin at boot time? I have my PC configured with sleep disabled. I'm running ...
user avatar
  • 113
1 vote
2 answers
177 views

Multiple Established TCP Connections on Port 3389 - Is my server compromised?

If i run netstat -an on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP) The first IP Adress is mine, however i cant explain the other two connections. They both ...
user avatar
  • 53
0 votes
1 answer
300 views

Windows Defender's MsMpEng.exe Access lsass.exe

I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then ...
user avatar
  • 1
1 vote
2 answers
433 views

Why doesn't Windows send all enabled cipher suites during TLS handshake?

I have a system with custom cipher suites specified in this registry key HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002!Functions TLS_AES_256_GCM_SHA384 ...
user avatar
  • 133
0 votes
0 answers
77 views

No User SID in the sysmon event with id 1 (process creation)

Extend version of the question I'm trying to figure out how to detect the launch of unwanted processes based on regular logging in Windows and sysmon. Sysmon event 1 allows you to get a significant ...
user avatar
  • 13
0 votes
1 answer
103 views

WMI commandline utility, console window host, and windows command processor all opening for a split second

Basically these 3 processes open for about 1/3 of a second and then instantly close on my task manager. I don't know what it is and I wasn't able to find anything on google about it. I am a little ...
user avatar
1 vote
1 answer
229 views

Private IPC between two processes

I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
user avatar
0 votes
3 answers
184 views

USB with partition that runs .exe program. - How to remove it

I have receive a USB, but I noticed that as soon as I connected it to my computer, a video of an organization is shown. Its like an informative video, it makes me think about nothing dangerous. But... ...
user avatar
5 votes
1 answer
1k views

Any legitimate reason for notepad.exe to make network connections

Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
user avatar
1 vote
1 answer
135 views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
user avatar

1
2
3 4 5
43