Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

New answers tagged

-2 votes

How to restrict access to someone who has local, physical to my computer?

I suggest to get a good door lock and don't hand over the key. In that way you are the only one to access your computer. You can also hire a security guard that checks what files is the guest ...
user avatar
  • 117
4 votes

How do EDR prevent you from uninstalling even as local admin?

As previously mentioned most EDRs have use kernel-level hooks. This text is from CrowdStrike's patent "Anomaly-based malicious-behavior detection" In some examples, the kernel-level ...
user avatar
1 vote
Accepted

Export ECDSA certificate from Windows Store

After days of analysis and discussions, finally I was able to identify the root cause. It is related to privileges. If I run with Admin privilege, I can extract keys for ECDSA certificate as well from ...
user avatar
4 votes

How do EDR prevent you from uninstalling even as local admin?

Most EDRs (worth their salt) implement a driver which runs in the kernel, this driver performs a number of functions but one of the most notable functions can be categorised as "anti-tamper"....
user avatar
  • 307
0 votes

What can prevent Mimikatz from accessing LSA?

I've tried both Mimikatz latest and 2.1.1, both doesnt seem to work. Apparently, you need a cmd as NT AUTHORITY\SYSTEM via running cmd as Administrator then ".\PsExec64.exe -i -s cmd.exe", ...
user avatar
0 votes

is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?

If you mistakenly enter a password into the username field and press return with a blank password, that will be recorded in the Windows Security log as a failed login attempt. The username (actually ...
user avatar
  • 81
0 votes

File sharing with compromised Windows machine

If the machine is untrusted, it should not be connected to the network. If you know that it could have malware on it and are unsure of the actual malwares, connecting it to the network could open ...
user avatar
2 votes
Accepted

Is there any way to disable/not allow unquoted service paths in Windows?

No you cannot "disable" unquoted service paths. I am not exactly sure what your threat model is here but the best advice I can give in response to your question is to check your system(s) ...
user avatar
  • 307
-1 votes

Decrypt TLS 1.2 traffic between .NET Windows applications

It is relativly simple to decrypt TLS/SSL traffic using Fiddler from Telerik. It works for any app running on Windows. Here are steps: Download Fiddler from https://www.telerik.com/download/fiddler . ...
user avatar

Top 50 recent answers are included