Questions tagged [windows]
Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].
2,215
questions
0
votes
0
answers
7k
views
security certificate does not specify Subject Alternative Names
We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
- 101
2
votes
2
answers
5k
views
Microsoft Defender flagged Surfshark.exe as "Misleading:Win32/Lodi"
Can this be safely ignored?
VirusTotal shows that Microsoft is the only security vendor that flagged this file as malicious. I did not modify my Surfshark installation in any way, except for an update ...
6
votes
1
answer
2k
views
How can a .exe be modified and still keep a valid digital signature?
When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true.
...
- 81
1
vote
2
answers
195
views
Does adding a new user (instead of just using root) help WSL2 security?
Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux ...
- 1,326
0
votes
0
answers
831
views
lsass.exe spawning lsass.exe
In logs, I found lsass.exe spawning lsass.exe.
C:\Windows\System32\smss.exe
C:\Windows\System32\smss.exe
C:\Windows\System32\wininit.exe
C:\Windows\System32\lsass.exe
C:\WINDOWS\system32\...
0
votes
2
answers
64
views
How do AV interact with malicious executables in remote shares?
I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish.
Say I'm attacking a Windows machine and host an SMB share from my Linux machine with ...
- 3,482
2
votes
2
answers
7k
views
What can prevent Mimikatz from accessing LSA?
I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully.
.#####. mimikatz 2.2.0 (x64) #...
- 476
0
votes
0
answers
160
views
Hash-Based Technique to Detect Ransomware Corruption on the Fly?
I have developed an Excel spreadsheet to compare lists of SHA-512 hashes from two separate drives. One drive is the source data drive on a Windows machine. The other is a backup of that drive, ...
- 123
3
votes
1
answer
389
views
What is the Print Nightmare threat vector?
I've researched this topic a few times and have not been able to come up with a definitive answer. It appears the threat may be multi-faceted.
I ask in the context of a standard Server/Client Windows ...
- 493
-1
votes
2
answers
528
views
connecting to Windows Admin Center using port 443
I want to use Windows Admin Center, but I don't want to install a SSL certificate.
If I were to forward packets from 80 to 443 using firewall rules would they automatically be encrypted?
- 1
1
vote
4
answers
296
views
Is doc file really modifying registry in Windows?
Been given a .docx file to check whether it has a virus or something, ran McAfee and SuperAntiSpyware on it and results came back negative so I though it was good and proceeded to open it, just a file ...
- 11
1
vote
1
answer
886
views
What's suspicious about this event log?
I got an event that something is wrong with, but I don't understand what exactly.
{
"EventTime":"2021-11-22 21:05:45",
"Hostname":"pc2",
"...
1
vote
1
answer
218
views
How exactly does Windows Bitlocker work?
I wonder how Windows Bitlocker and other similar software works.
I know they differ in terms of security level as some software does not fully encrypt locked files, but I'm speaking of unauthorized ...
- 113
0
votes
0
answers
75
views
Most Secure ways to to authorize clients on their devices that are remotely connected by (AnyDesk, TeamViewer, etc...) without knowing the password
My case is I'm designing an app based on chromium browser powered by Electron .
And I need sometimes to log the clients in with some web apps. The password is only visible as dots in browsers by ...
- 1
1
vote
2
answers
418
views
Is Windows 10 Home more secure than Windows 10 Pro in some way?
I'm planning to do a fresh install of Windows 10 on my mother's computer. Despite it has Pro version right now, I wonder if I should use Home version instead, which is also called Single Language.
...
- 758
0
votes
1
answer
5k
views
Is the Windows service "Session Detection" (SessionService.exe) safe?
I was restarting a service and happened to notice that I had one service running that had no description. This struck me as curious. It's called "Session Detection" and is located at c:\...
user76064
0
votes
0
answers
32
views
How to permanently remove DDE Exploit:O97M/DDEDownloader.C? Do I need to nuke my computer? Is it safe to not do so? [duplicate]
1Starting yesterday windows defender has found and quarantined 5 copies (pic 1) of the following threat (pic2) Exploit:O97M/DDEDownloader.C see here.
I tried contacting Microsoft tech support but they ...
- 1
2
votes
2
answers
396
views
How to create a safe environment in Windows 10 for high-performance programs?
My friend handed me a .exe file of an old game we want to play together. My laptop has important files, so I do not want to install it immediately. I am still sceptical that he might not know it ...
- 21
1
vote
1
answer
446
views
Detect bruteforce attempts on Windows 10 (without event log)
I'm currently working on a software project as part of a course on Operating Systems Security and one of the features in my project is to detect bruteforce attacks on Windows hosts.
I know that I can ...
- 11
4
votes
1
answer
3k
views
What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?
I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
- 63
3
votes
1
answer
188
views
Child processes vs microservices for communication between components
This is a question for operating system security experts.
We have an application using one platform/language, and it has to integrate with a library that uses another platform/language. There is no ...
- 254
0
votes
1
answer
119
views
Is Sysmon.exe modifying root certificate legit activity
Today I got an alert on my Elastic SIEM that sysmon.exe has modified or created a root certificate.
I tried to look for the certificate thumbprint in the Microsoft trusted root program and could not ...
- 31
1
vote
1
answer
152
views
Fresh OS install after Ransomware, but it’s still coming back. What’s the correct procedure for a fresh install to protect myself?
I’ve been hit by Ransomware several times this year, and I’m going nuts trying to stop it. About a month ago I got hit, and I did a complete rebuild of my Windows 10 machine. Fresh OS and installed ...
- 111
2
votes
1
answer
251
views
Does Windows use Bluetooth Authenticated pairing with encryption automatically?
Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
- 21
1
vote
1
answer
303
views
Why does Microsoft SmartScreen require OV certificates to be signed by a trusted CA?
Signing your applications with an OV code signing certificate enables them to build reputation together in Microsoft SmartScreen, rather than each binary building reputation separately. This allows ...
- 243
1
vote
0
answers
257
views
Is there any safe way to use Windows Credential Manager's generic credentials?
(note: VS Code is just an example, question is not specific to VS Code)
I would like to use Windows Credential Manager's generic credentials, say store git passwords when using VS Code, so I have not ...
- 220
0
votes
1
answer
246
views
Can malicious binaries run from Program Files?
I've been seeing a few false positives from our AV Carbon Black pertaining to wordpad (wordpad.exe) use.
The alert I'd see is The application wordpad.exe injected code into another process. Upon doing ...
- 133
1
vote
0
answers
123
views
Why doesn't Defender get suspicious if a program adds exceptions to the Defender?
One can simply add exceptions to the Windows Defender by running this command in Powershell:
Add-MpPreference -ExclusionPath <your_path>
Why does Windows Defender not immediately flag programs ...
- 41
0
votes
1
answer
167
views
Windows Defender Exclusions
If a virus added itself to windows defender exclusions, it will never be scanned.
However would windows defender still remove its startup registry keys and scheduled tasks?
Windows defender is the ...
0
votes
0
answers
98
views
How to show someone that offline Windows app I'll send is not malicious?
I want to send someone an offline app (but would be streamed online by other app like OBS) to use, while wanting to show him that his PC won't be infected (or similar) by that app.
App will rely on ...
2
votes
1
answer
211
views
How to make sure my laptop (Ubuntu 20.04) is secure with a Windows 7 VM?
I have an old laptop which is running Ubuntu 20.04 and I am planning to use a virtual machine of Windows 7 Pro (using VirtualBox maybe). As its an old laptop and not my primary source of using the ...
- 23
0
votes
0
answers
114
views
Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?
Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
- 41
0
votes
1
answer
210
views
Authorization Controls for Offline Windows C# Application
I've been looking into trying to see if there are any authorization controls that can be implemented for a local, and offline, .NET application that are tied to the Windows local authentication. The ...
- 1
4
votes
2
answers
755
views
How does Windows password protect my data?
As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
1
vote
0
answers
156
views
Does Windows 10 log network activity?
I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about:
Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
1
vote
1
answer
142
views
Why is it advisable to capture a disk image before shutting down? [closed]
I am currently studying windows forensics and I have found that it would be advisable to image the drive while it is powered on and live. If you power it off, you likely will not be able to recover ...
1
vote
1
answer
103
views
Security for a Windows application running in a corporate network
I know security is pretty important for the web application, but what about windows applications running in a corporate environment, network, not accessible from outside.
Do we need to treat security ...
- 111
2
votes
1
answer
1k
views
Creating and Comparing Hashing Windows certutil and external hash libraries
I have a question about checking hashes and what is the best utility for it.
Seems like you can use some external programs like md5sum or sha1sum. But can't you just use (on Windows) certutil -...
- 21
1
vote
0
answers
107
views
Why does Windows facial recognition not require a password on startup?
I was reading the following question:
Why do mobile devices force user to type password after reboot?
To find out why fingerprint authentication on my Windows 10 laptop isn't an option on startup. It ...
- 671
1
vote
1
answer
315
views
How can an ELF binary call a Windows API from WSL(2) to deploy a payload?
In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was:
written in Python
compiled to an ELF exe using PyInstaller in Debian in WSL
and "injected into ...
- 138
0
votes
2
answers
319
views
How do I secure SQL passwords when distributing executables?
Environment
I am creating a python application which writes to SQL.
It is compiled into an .exe and distributed to other computers in the business.
(Edit: The SQL server is hosted by our business, ...
0
votes
1
answer
449
views
Hacked list of AD logins and passwords
An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
- 101
2
votes
0
answers
977
views
How/when does Windows link private key to imported certificate?
When creating CSR on Windows (using built-in certificate store), I found some weird behaviors:
When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate ...
- 173
2
votes
2
answers
2k
views
Is it safe to give away a computer with a hard drive previously encrypted with BitLocker?
Assuming the hard drive is encrypted with BitLocker and it is on a laptop with a TPM module. Then the hard drive is formatted and Windows is completely reinstalled. Is it still possible to recover the ...
- 71
0
votes
2
answers
322
views
How to securely encrypt my computer and protect it from thieves and others
I did enabled Bitlocker encryption on my Windows 10 Pro Laptop. but it has TPM 2.0 chip installed and Because of that it DOES NOT actually Protecting me as someone JUST NEED TO CRACK 1 PASSWORD (...
0
votes
1
answer
169
views
Risk Assessment of Windows Cert Store
We all know that SmartCards protect private keys much better than any software-based solution. However, when it comes to the Windows Cert Store to be compared to SmartCards: how difficult is it for ...
- 3
1
vote
1
answer
377
views
How is using the standard Windows account more secure than using the administrator Windows account with highest UAC settings?
If someone uses the administrator Windows account for everyday work while having the default UAC settings they will be prompted by UAC whenever an application other than certain predefined system apps ...
- 5,747
0
votes
1
answer
259
views
Can a file extension be spoofed in windows?
For example, can an .exe file be spoofed in .txt or .mp3 in Windows and still be executed as an executable?
I know some basic methods like:
using right-to-left override character (U+202E)
winrar 4 ...
1
vote
2
answers
208
views
Is using a windows user account password necessary on a PC with bitlocker and a complex pin?
Is there a security risk to disabling the windows user account password, since my PC is already unlocked with a complex pin at boot time? I have my PC configured with sleep disabled. I'm running ...
- 135
1
vote
2
answers
784
views
Multiple Established TCP Connections on Port 3389 - Is my server compromised?
If i run
netstat -an
on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP)
The first IP Adress is mine, however i cant explain the other two connections. They both ...
- 41