New answers tagged windows
-2
votes
How to restrict access to someone who has local, physical to my computer?
I suggest to get a good door lock and don't hand over the key. In that way you are the only one to access your computer.
You can also hire a security guard that checks what files is the guest ...
- 117
4
votes
How do EDR prevent you from uninstalling even as local admin?
As previously mentioned most EDRs have use kernel-level hooks.
This text is from CrowdStrike's patent "Anomaly-based malicious-behavior detection"
In some examples, the kernel-level ...
- 806
1
vote
Accepted
Export ECDSA certificate from Windows Store
After days of analysis and discussions, finally I was able to identify the root cause. It is related to privileges. If I run with Admin privilege, I can extract keys for ECDSA certificate as well from ...
- 61
4
votes
How do EDR prevent you from uninstalling even as local admin?
Most EDRs (worth their salt) implement a driver which runs in the kernel, this driver performs a number of functions but one of the most notable functions can be categorised as "anti-tamper"....
- 307
0
votes
What can prevent Mimikatz from accessing LSA?
I've tried both Mimikatz latest and 2.1.1, both doesnt seem to work. Apparently, you need a cmd as NT AUTHORITY\SYSTEM via running cmd as Administrator then ".\PsExec64.exe -i -s cmd.exe", ...
0
votes
is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?
If you mistakenly enter a password into the username field and press return with a blank password, that will be recorded in the Windows Security log as a failed login attempt. The username (actually ...
- 81
0
votes
File sharing with compromised Windows machine
If the machine is untrusted, it should not be connected to the network. If you know that it could have malware on it and are unsure of the actual malwares, connecting it to the network could open ...
- 25.5k
2
votes
Accepted
Is there any way to disable/not allow unquoted service paths in Windows?
No you cannot "disable" unquoted service paths. I am not exactly sure what your threat model is here but the best advice I can give in response to your question is to check your system(s) ...
- 307
-1
votes
Decrypt TLS 1.2 traffic between .NET Windows applications
It is relativly simple to decrypt TLS/SSL traffic using Fiddler from Telerik. It works for any app running on Windows. Here are steps:
Download Fiddler from https://www.telerik.com/download/fiddler .
...
- 99
Top 50 recent answers are included