Enkel og effektiv herding av windows
Feb. 4, 2021•0 likes•143 views
Download to read offline
Report
Technology
Foredrag for Bergen Microsoft Community den 4. februar 2021.
Oddvar MoeFollow
Recommended
Maksym Chernenko «Building Standalone Desktop Applications» LogeekNightUkraine
Bronson quick how to client-proof your word press themeWordCamp New Zealand
Service bus to build BridgesAbhishek Sur
What is VPS HostingVPS web hosting services
RocketJS Nodejs rapid development framework for production web appswavome
JavaScript: the who, what, when, where, why, & howMonty Dickerson
More Related Content
Similar to Enkel og effektiv herding av windows
Defining DevSecOpsUchit Vyas ☁
MS LAPS protection: portal for secure access to local admin passwordsNikolay Klendar
0-Day Up Your Sleeve - Attacking macOS EnvironmentsSecuRing
Molajo - J and Beyond 2011Molajo
Microsoft 365 Security & Compliance User Group - Microsoft Teams compliance Albert Hoitingh
SeaBeyond 2011 ProcessOne - David Banes: Cleartext microbloggingProcessOne
More from Oddvar Moe
Hva avanserte hackere gjør for å få tilgang - Publisert.pptxOddvar Moe
Red teaming and war storiesOddvar Moe
Phishing past mail protection controls using azure informationOddvar Moe
App-o-Lockalypse now!Oddvar Moe
#Lolbins - Nothing to LOL about!Oddvar Moe
Windows binærfilerOddvar Moe
Recently uploaded
Understanding Wireguard, TLS and Workload IdentityChristian Posta
Scaling out with WordPressKonstantin Kovshenin
Cloud Composer workshop at Airflow Summit 2023.pdfLeah Cole
Nymity Framework: Privacy & Data Protection Update in 7 StatesTrustArc
Need for Speed: Removing speed bumps in API ProjectsŁukasz Chruściel
Elevate Your Enterprise with FME 23.1Safe Software
Enkel og effektiv herding av windows
- 1. Enkel og effektiv herding av Windows
- 2. ODDVAR MOE - Red teamer @TrustedSec - Security geek / Blogger / Speaker - Microsoft MVP 5 years - Working with IT since 2000 - Security Research ❤ Memes @oddvarmoe - https://oddvar.moe
- 3. Enkle herdinger • Makroer • HTA/JS/JSE • LAPS / Prevent Local Admin Lateral Movement • SMB Signing • LSASS Protection
- 7. Deaktivere Makroer • Kan også gjøres gjennom Intune https://helgeklein.com/blog/2019/07/blocking-office-macros- managing-windows-macos-via-intune/
- 8. HTA/JS/JSE filer • Ofte en link i epost • Eksekverer kode
- 9. HTA/JS/JSE filer • Ofte en link i epost • Eksekverer kode
- 10. Endre oppførsel til HTA/JS/JSE filer
- 11. LAPS • Unikt administrator passord • https://Aka.ms/laps • Forhindrer klassisk lateral movement med Pass-the-Hash • Enkelt å implementere (15m) Guide på Norsk: https://channel9.msdn.com/Blogs/MVP-Cloud- DataCenter/Gjennomgang-av-Local-Administrator-Password-Solution- LAPS
- 12. LAPS High level: • Schema extension • MSI/DLL fil installeres I miljøet • En GPO lages med riktige innstillinger for ønsket passord policy
- 13. Forhindre Lateral Movement Et annet enkelt og effektivt triks:
- 14. SMB Signing • Forhindrer Man-in-The-Middle / Replay • Kan påvirke ytelse • Ingen grunn til ikke å slå på
- 15. SMB Signing
- 16. LSASS Protection • Gjør det vanskeligere å dumpe LSASS • Krever mer innsats av angriper
- 17. LSASS Protection
- 18. LSASS Protection
- 19. LSASS Protection
- 20. Andre tips • Lokal administrator • AppLocker / Device Guard • BitLocker • Logging / Windows Event forwarding • Microsoft Defender Advanced Threat Protection • Baselines • https://adsecurity.org/?p=3299
- 21. Andre tips • https://docs.microsoft.com/en-us/windows/security/threat- protection/windows-security-baselines • https://www.trustedsec.com/blog/4-free-easy-wins-that-make- red-teams-harder/ • https://docs.microsoft.com/en-us/windows/security/threat- protection/windows-defender-application- control/applocker/applocker-overview
- 22. TAKK FOR MEG Mail: Oddvar.moe@trustedsec.com Twitter: @oddvarmoe