How to Protect Windows Endpoints From Cyberattacks

In Part I of the blog series, Hardening Windows Endpoints Against Cyberattack, I covered the first three steps of an ethical hack:

Step 0: Pre-Engagement

Step 1: Passive Recon

Step 2: Active Recon (Read about Active Recon for Linux in Part III)

Now the run really begins.

In this blog post, you’ll learn how to put all the knowledge you gained during the planning and reconnaissance steps into action. Let’s walk through the next steps:

Step 3: Service Enumeration

Step 4: Access Exploitation

Step 5: Privilege Escalation

For each step, I’ll cover the goals, strategies, and resources I use in an ethical hacking exercise. Then, I’ll share recommendations for endpoint security activities to block attackers and mitigate your risk.

The response shows the version is IIS/10.0, which confirms this is a Windows 10 endpoint. The response is also typical of the default IIS web page, which can be shown below. This indicates that:

• the system has been just provisioned and is due to be a web server but hasn’t yet been set up;
• it was misconfigured;
• a website has been removed; or
• it could be running on another port.

Some of the most common service enumeration tools include:

• rpcclient – Tool for executing client-side MS-RPC functions
• netcat – Powerful network utility
• nbtscan – Tool to scan NetBIOS to find open shares
• smbclient – Client to talk to SMB / CIFS servers
• Metasploit – Penetration Testing Framework
• WFUZZ – Web Application Fuzzer
• DIRB – Web Content Scanner
• GOBUSTER – Web Object Scanner
• NIKTO – Web Vulnerability Scanner

Exploitation Research

Next, I determine the attack path. I use my own algorithms to determine the best options, based on:

• Do No Harm
• Speed
• Stealth
• Resources
• Time
• Cost
• Availability

I research the possible exploits along the attack path. Some of the tools I use during this process are:

• Google-Fu
• exploit-db
• Common Vulnerabilities and Exposures (CVE)
• Searchsploit
• MITRE ATT&CK®

I determine my path to the initial access, such as:

• Exploiting public-facing hardware, OS, or applications
• Phishing
• USB drops
• Supply chain and third parties
• Weak or default credentials 
• Through the Wi-Fi

How to reduce your attack surface

• Set up antivirus and malware protection. This can protect users from known threats.
  
  
• Run vulnerability scans. Periodic scans help find misconfigured applications, systems, and unpatched software. Integrate your vulnerability scanner into a PAM solution to ensure it has credentials to scan systems fully and provide a complete view of your attack surface. Ensure all USB devices are properly scanned.
  
  
• Create multiple network layers and segmentation. Defense-in-depth strategies limit an attacker’s ability to move around. Create blockers between different networks for public-facing applications, services, production servers, data vaults, operations systems, managed employee devices, and bring your own devices. BYOD, which today is more like bring your own office (BYOO), is sometimes referred to as “Bring Your Own Disaster.”
  
  
• Train users. Document and share security policies. Hold periodic security training focused on specific threats.
  
  
• Secure passwords. Get employees into the habit of using a PAM solution. Reduce one of the biggest causes of cyber fatigue by automating password creation and rotation. Ensure password complexity and integration with SSO and MFA.
  
  
• Control access for supply chain and third parties. Take a least privilege and zero-trust approach to your third-party access. Force third parties to access via a PAM solution so you know who they are, what they’ll be doing, and what approvals are required before they’re permitted access.

Related Reading: Download our free eBook, Least Privilege Cybersecurity for Dummies, and see how you can limit user and application access to privileged accounts—especially on endpoints.

The worst-case scenario is when users are running as a Local Administrator on their Windows endpoints. Then, the game is almost over.

How to protect against access exploitation

Don’t make it easy for attackers. The following Windows hardening practices reduce risk.

• Patch and update Windows endpoints and applications regularly. Remove unused software and get rid of your legacy operating systems and applications. If you can’t get rid of legacy systems, put a strong lock around them via network access and privileged access controls.
• Use antivirus and malware protection. Give users a chance by protecting them from known threats.
• Secure passwords. Use password managers and PAM solutions.
• Practice the principle of least privilege. Ensure users aren’t overprivileged. Don’t let users run as local admins on Windows endpoints.
• Use application control. Only permit trusted applications to execute. Prevent unwanted software from running with elevated privileges.

BloodHound. BloodHound is a single-page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a C# data collector. It uses graph theory to reveal hidden and often unintended relationships within an Active Directory environment.

Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to find. Defenders can use BloodHound to identify and eliminate those same paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory environment.

Windows Exploit Suggester – Next Generation (WES-NG). WES-NG is a tool based on the output of Windows’ systeminfo utility. It provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 10, including their Windows Server counterparts, is supported.

Windows Privilege Escalation Awesome Scripts. WinPEAS is a compilation of local Windows privilege escalation scripts to check for cached credentials, user accounts, access controls, interesting files, registry permissions, services accounts, patch levels, possible misconfigurations, and more. WinPEAS is helpful because it includes hints on where you should focus your attention.

PowerUp. PowerUp is a collection of PowerShell scripts for finding common Windows privilege escalation vectors that rely on misconfigurations. Running Invoke-All checks will look for common misconfigurations on Windows endpoints.

Seatbelt. Seatbelt is a C# project that performs a number of security-oriented host-survey “safety checks” relevant from both offensive and defensive security perspectives. Simply Seatbelt is an enumeration tool to show information that could lead to privilege escalation.

The majority of these tools and scripts are looking for the following Windows misconfigurations or weaknesses:

Cached or stored credentials

To check for cached or saved creds that could allow you executables with elevated permissions, run the following:

• Cmdkey /list = currently stored credentials
• winPEAS.exe quiet cmd windowscreds
• findstr /si password *.txt

Unquoted services

Misconfigured services or services with weak/default credentials are a top target for privilege escalation. Services that aren’t hardened, such as write access, can be abused. Service path unquoted can allow an attacker to break out and run malicious malware, registry permissions not restricted, etc.

Check for misconfigurations or weak access controls.

• tasklist /svc = list all processes and services
• sc query = service control manager query service
• net start/stop = stop and start services
• sc config = change service configuration
• winPEAS.exe quiet applicationsinfo
• accesschk.exe /accepteula -uvqc
• sc query state= all | findstr “SERVICE_NAME:” >> Servicenames.txt

Unpatched applications or OS

An attacker will look for unpatched applications and Windows operating systems.

• Systeminfo and then check it against WES-NG
• tasklist /v

Recently, Potato exploits take advantage of NTLM Relay attacks to elevate privileges. Common attacks include Hot Potato, Juicy Potato, and Rogue Potato.

Local enumeration

Attackers enumerate for local and Group privileges typically using the following commands.

• User Privileges

whoami

whoami /priv

net users

• Group Enumeration

net localgroup

net localgroup /domain

Wi-Fi profiles

Attackers may try to connect directly to your corporate Wi-Fi. If you aren’t using keys and using a WPA2 passphrase, attackers with local privileges can display the password in clear text and then connect their own devices to your Wi-Fi network.

• netsh WLAN show profile
• netsh WLAN show profile key=clear

Execute, copy, and reverse shells

Attackers will use built-in or popular security tools to gain further access and elevate privileges. Below are just a few of those:

• Certutil – Certutil.exe is a command-line program that is installed as part of Certificate Services.
• Mshta.exe – Mshta.exe runs the Microsoft HTML Application Host, the Windows OS utility responsible for running HTA( HTML Application) files.
• Powershell – PowerShell is a task automation and configuration management framework from Microsoft.
• Misexec – This provides the means to install, modify, and perform operations on Windows Installer from the command line.

Each of these tools is used for legitimate purposes for systems management and configuration but is also commonly abused by malicious actors. Attackers can use these tools to download scripts, create reverse shells, and execute applications.

Persistence

Attackers need persistence. Of course, they also need sleep, so they abuse these configurations so they can maintain persistent access to systems. When they wake up, they can regain control of a victim’s Windows endpoint. To make this possible, I use:

• Services
• AutoRuns
• User Creation
• Scheduled Tasks
  • schtasks /query /fo LIST /v = list scheduled tasks

Other common methods I use for privileged escalation are:

• Browser
• AutoRuns
• SNMP
• AlwaysInstallElevated
• Configuration Files
• Registry
• RDP
• Dll Injection
• Pass the Hash
• Impersonate Access Tokens
• Startup Apps

How to protect against privilege escalation

• Use application control on all Windows endpoints. Control which applications can execute, which known malicious applications are denied, and which require additional auditing. Application control can also help prevent enumeration scripts from running.
• Patch and update. It’s not a 100% solution but it will slow attackers down.
• Use a privileged access security solution. Ensure all services have a provisioned account with the correct security controls, including complex passwords, rotated frequently. Throw universal keys and standing privileges away and move to on-demand, just-in-time privileges.
• Restrict domain admin account usage. Rotate account passwords after every use.
• Log and audit as much privilege activity as possible. Monitor for abuse and set alerts for anomalous activity.

Hardening Windows endpoints is only one part of reducing risk

I hope blog posts part 1 and part II have given you some insights into the mind of a cyber criminal and tips to secure your Windows endpoints. Read about hardening Linux and Unix endpoints here.

There is never 100% security. No single tool can protect against cyberattacks. The better we understand how attackers operate, the more difficult we can make it for them.

Attackers will exhaust all of the methods above in their attempt to infiltrate your organization and access sensitive information. As defenders, you must discover all of these methods and harden Windows endpoints the best you can to protect against them.