5

You can execute shell commands in PL/SQL is the scenario here. These will run with the privilege of Oracle, which might be LocalSystem. Obviously you will want to secure against this by restricting privileges to create stored procedures, running Oracle as a less-privileged user, and so on. Once someone has an account then it’s the same as any other breach, ...


2

WDigest isn't a setting which disables Mimikatz, it's a form of encryption supported by Windows, which when enabled, allows Mimikatz to very easily dump plaintext passwords. Disabling WDigest removes that one type of credential from memory, but a user with Administrator-level privileges can still dump other forms of interesting credentials. Mimikatz has ...


2

No, this is not normal behavior. Most likely, the server has been compromised, and it has a backdoor installed that forwards the connection to RDP server. Probably a reverse tunnel, given that the RDP port itself is exposed to the internet and forwarding from another port wouldn't be that useful (it would just conceal the connection a bit). I would try to ...


2

Powershell transcript logging records every single thing from each powershell session. This feature is available since PS version 5 and above. Please refer: here Now, you can also use Sysmon utility from Sysinternals. Please refer: here


1

Dsquery is just a tool to query the active directory, it by itself isn't malicious or leaking personal info. What happens is that this tool queries the active directory, which is Microsoft's database to manage windows devices and users in a centralized location. Your IT administrator configured a naming policy, if that naming policy contains private ...


1

It's likly exchange is just getting the wrong config/setup wrong you can FORCE the correct settings this way without local administrator This is how I setup autodiscover the xml file is placed on your local disk some place and edit the path to your exchange XML server RedirectUrl autodiscover.xml <?xml version="1.0" encoding="utf-8" ?> <...


1

While it is a bad idea to still keep the server running such old and unsupported systems are actually often found in industrial environments where they are used to run some software only supported on such older OS or which is tied to specific hardware. The way to limit the risk in such cases is to minimize the attack surface as much as possible. This means ...


1

It's not a DDoS. It's a windows server 2008 r2 with latest updates, and the websites have an A rating on ssllabs. That's what the source of the traffic is. The SSL Labs scanner will make a large number of SSL/TLS handshakes in order to test for support of various ciphers and features.


1

Your guess about certutil is correct and certutil -repairstore should do the trick. The only requirement is that HSM middleware must be installed on a target machine and target machine can access keys on HSM. Alternatively, you may try to use CertSetCertificateContextProperty CryptoAPI function and set CERT_KEY_PROV_INFO_PROP_ID property that will include ...


1

In IIS Manager, (if the sub-feature has been installed) there is a node for IP Address and Domain Restrictions which will allow you to determine which IP addresses you want to allow and/or deny either for a specific website or for all websites on the server. If you don't see this node, it is because the sub-feature has not been installed. In that case, ...


1

Starting with Windows 10, the Windows Defender Security Center will track for the presence and configuration of antivirus, firewall, account protection, app/browser controls, and device security.


1

The file you're looking for, %systemroot%\System32\sru\SRUDB.dat, is managed by the Diagnostic Policy Service. If the file isn't present, you may find that service isn't running. Take a look in services.msc and check to see if the service is running. Diagnostic Policy Service should be able to create the missing file when run.


1

From here: Trojan.Naid is a Trojan horse that opens a back door on the compromised computer. When the Trojan is executed, it creates the following files: %UserProfile%\AppMgmt.dll %Windir%\Temp\uid.ax The Trojan creates the following registry entries: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\AppMgmt\"Start" = "2" ...


1

No if you patch Winzip frequently. Yes if you don't patch it. This answer applies to all software on a server not just Winzip. Only put software on a server that is required in order to reduce risk and attack surface.


Only top voted, non community-wiki answers of a minimum length are eligible