Questions tagged [windows]
Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].
2,215
questions
1
vote
1
answer
1k
views
Windows Defender's MsMpEng.exe Access lsass.exe
I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then ...
- 11
2
votes
2
answers
2k
views
Why doesn't Windows send all enabled cipher suites during TLS handshake?
I have a system with custom cipher suites specified in this registry key
HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002!Functions
TLS_AES_256_GCM_SHA384
...
- 143
0
votes
0
answers
200
views
No User SID in the sysmon event with id 1 (process creation)
Extend version of the question
I'm trying to figure out how to detect the launch of unwanted processes based on regular logging in Windows and sysmon. Sysmon event 1 allows you to get a significant ...
- 13
0
votes
1
answer
126
views
WMI commandline utility, console window host, and windows command processor all opening for a split second
Basically these 3 processes open for about 1/3 of a second and then instantly close on my task manager. I don't know what it is and I wasn't able to find anything on google about it. I am a little ...
- 1
2
votes
1
answer
978
views
Private IPC between two processes
I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
- 23
0
votes
3
answers
437
views
USB with partition that runs .exe program. - How to remove it
I have receive a USB, but I noticed that as soon as I connected it to my computer, a video of an organization is shown.
Its like an informative video, it makes me think about nothing dangerous.
But...
...
- 111
5
votes
1
answer
3k
views
Any legitimate reason for notepad.exe to make network connections
Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
- 265
1
vote
1
answer
1k
views
Are Credentials used in RDP cached on Client?
When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash?
Example:
Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
- 11
10
votes
2
answers
14k
views
Is WSL 2 secure for commercial work?
Windows Subsystem for Linux (version 2) is getting more and more traction lately with new features being added such as GUI mode over Wayland (WSLg). It seems to me Microsoft really pushes for WSL ...
- 201
0
votes
0
answers
337
views
What are security risks of a domain user accounts with denied interactive logon?
When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password?
http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
18
votes
4
answers
5k
views
What are the risks of desktop personalization on Windows?
I've worked on places where the admins have disabled desktop personalization on Windows for settings like:
changing desktop background and lock screen images
local themes - no high contrast for ...
- 293
11
votes
7
answers
7k
views
Can you create a fake (malicious) Ubuntu iso
Recently I got into an exchange with someone on social media about the security of Linux versus OSX and Windows. I stated that it is possible (and probable) that someone could code a low level back ...
- 137
4
votes
2
answers
2k
views
Are buffer overflow and similar attacks still possible?
The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
- 191
0
votes
0
answers
114
views
Secure Registry Keys
Is it possible to restrict access to the registry keys, just like Microsoft does on some of the keys(ex. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend)?
I was able to get a similar ...
1
vote
1
answer
283
views
What physical damage can a user mode windows driver do?
If a driver runs in kernel mode it obviously can manipulate everything (well everything in ring 0), so manipulating the file system or devices is a possibility. Potentially devices can be destroyed, ...
- 552
-1
votes
1
answer
275
views
PowerShell - privilege escalation [closed]
In the past, I have used the Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.
However, I am looking for a similar script, but I ...
1
vote
1
answer
348
views
Does a virus (malware) ever expire?
There's a possibility that my old USB stick (which I haven't used in over a year) got a virus-infected audio file (AAC) among other trusted files. Can I safely open the trusted files bypassing the ...
- 25
1
vote
0
answers
237
views
How to go about checking if Windows is running any untrusted drivers (programatically)
I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
- 111
1
vote
1
answer
972
views
Why does Windows not enable TPM 2.0 parameter encryption to protect against bus sniffing of Bitlocker key?
Comes from Bitlocker, does additional authentication at startup with TPM device provide any extra security?
You can sniff the key right from the bus currently:
As the decryption happens automatically,...
- 141
0
votes
2
answers
1k
views
Windows directory that is only accessible by SYSTEM user
I am developing a .NET Windows Service using C# that needs to download an executable file and run it.
I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...
- 3
0
votes
1
answer
812
views
Windows/NTFS: do files have any unique, immutable properties?
I want to detect if a file on disk was edited since last access, or restored since last deletion. Let's assume this isn't on a VM.
Basic scheme:
Somewhere in the file is a cryptographic hash of the ...
- 143
0
votes
1
answer
117
views
Securing and storing Active Directory logs
If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
- 21
0
votes
0
answers
101
views
What OS do I focus on when learning Cyber Defense?
After some time in the Cyber Defense field, I am noticing that there are different learning paths to take depending on the OS you choose (for example you can learn how to use PowerShelll and lots of ...
- 23
9
votes
2
answers
297
views
Who is at risk from the PrintNightmare RCE?
Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
- 440
0
votes
2
answers
410
views
Shellcode not executing despite EIP being overwritten properly
Here is my exploit:
junk = b'A' * 1032
eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives
shellcode = b""
shellcode += b"\x33\xc0" # xor eax, ...
- 121
2
votes
1
answer
276
views
How are vulnerabilities like PrintNightmare CVE-2021-34527 discovered?
Regarding the newly discovered vulnerability PrintNightmare CVE-2021-34527 that has existed for years without being discovered, currently affecting almost all versions of Windows, server and ...
- 1,132
1
vote
1
answer
750
views
Error with Metasploit when attempting to exploit netapi in Windows XP [duplicate]
I am a beginner in hacking. I have been trying to hack Windows XP using the netapi exploit in metasploit, but every time, in the end, I get an error:
Exploit failed [unreachable]: Rex::...
3
votes
0
answers
199
views
Process Injection and Process Isolation by OS
If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
- 31
0
votes
1
answer
176
views
Memory Forensics on exited process
I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
1
vote
1
answer
1k
views
Tricking a windows 10 computer into thinking a USB being plugged in is a mouse for code execution [closed]
Is it possible to "trick" a Windows 10 PC into thinking a flash drive is a mouse to execute code on the machine? If so, how?
Note: I'm not trying to do anything malicious. All of this is ...
- 21
3
votes
0
answers
860
views
How does local pass-the-hash (mimikatz's sekurlsa::pth) work?
Mimikatz's sekurlsa::pth documentation states:
mimikatz can perform the well-known operation 'Pass-The-Hash' to run a
process under another credentials with NTLM hash of the user's
password, instead ...
- 95
0
votes
1
answer
126
views
Is it possible to identify a financial fraud on a Windows machine? How?
How do forensics identify a banking/financial fraud in a Windows system? Malware usually uses real-time TCP sockets to complete their deeds, infecting and compromising the PC it runs on (not the ...
1
vote
1
answer
970
views
Remove all traces of files used in Veracrypt container... is this enough?
Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container.
Then I run CCleaner to ...
0
votes
1
answer
357
views
How can a program remove the menu in Control-Alt-Delete (Secure desktop) in Windows?
In reference to another post about the Respondus Lockdown Browser, I was wondering how can a program edit and remove parts of the "Secure Desktop" Ctrl+Alt+Del menu in Windows, as well as ...
- 31
0
votes
2
answers
230
views
Haven't updated my Windows 10 for more than a year
Almost a year ago, I dual-booted Windows 10 and Linux Mint. And since then, I haven't booted into my Windows 10 OS.
I still remember that the Wi-Fi adapter was off when I shut my Windows 10 down.
Now, ...
0
votes
1
answer
195
views
Is it possible for a compressed file to contain malicious code?
I recently downloaded 2 compressed files (.zip and .rar) from a really unreliable and untrusted source while using a browser integrated VPN. My antivirus didn't notice anything but I am curious if it ...
0
votes
1
answer
851
views
Can a video file contain code that shares your identity? [duplicate]
Could a video file contain code that reveals and sends your ip/mac address or give access to personal files to somebody else? Would normal video players (like VLC) be able to notice that kind of ...
- 1
0
votes
1
answer
4k
views
RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)
I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
- 15
10
votes
2
answers
746
views
How effective is Windows KDP for exploit mitigation in practice?
Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at ...
- 66.5k
4
votes
1
answer
383
views
Is Sleep mode safe?
If a PC has rootkit, when it goes into sleep mode, can rootkit do anything to it while it’s in state of sleeping? Meaning steal data, open programs and basically do anything. Assuming it’s not BIOS ...
- 41
1
vote
1
answer
997
views
Downgrade of NTLM Authentication
I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings.
In my understanding:
NTLM auth starts with a negotiation packet sent by the client. In this ...
- 33
0
votes
0
answers
47
views
Could just downloading (not opening) .tgz file infect Windows 10? [duplicate]
Today I received some e-mail to Thunderbird. It had image attached that I clicked:
Which sent me to onedrive.live.com/download?... and automatically downloaded .tgz file. I am not even sure if the ...
- 101
1
vote
1
answer
311
views
Watering Hole Website NTLM Steal Attack
I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif.
Causing forced authentication which passes the NTLM hash....
2
votes
2
answers
596
views
What's the point of Empire if all payloads get flagged?
I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something.
Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
- 23
8
votes
1
answer
629
views
Is Windows+L a secure attention sequence?
Ctrl+Alt+Del is a secure attention sequence (Microsoft) (or secure attention key (Wikipedia), but it's more a Linux term).
As we can read,
A key sequence that begins the process of logging on or off. ...
- 3,376
26
votes
5
answers
6k
views
How can a non-admin program cover your entire screen with a window?
This year, since many students are online, College Board (the company that administers AP Exams in the US, along with the SAT) recently released its Digital Testing App. Once installed, and going ...
- 361
1
vote
1
answer
95
views
Is an outdated library in a Windows user mode desktop application an actual security risk?
I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet".
As an example:
This ...
- 1,247
1
vote
0
answers
377
views
Windows X.509 certificate private keys lost
Have the same certificates installed on several machines, but this happens on only one of them.
The certificates are self-signed certificates.
The certificates are used for WCF message security.
...
- 135
2
votes
1
answer
1k
views
Is docker for desktop secure for non-admins?
I manage a multi-user workstation (Windows) server for a small student organisation. One of the students asked me to install docker, as it would simplify his workflow. As this is on a shared ...
- 121
1
vote
1
answer
524
views
How NTLM SSO is preformed on smartcard Kerberos logon?
I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved.
After an interactive logon with kerberos, you will have in the cached credentials both ...
- 33