{"id":13497585,"url":"https://github.com/PaulSec/awesome-windows-domain-hardening","last_synced_at":"2025-03-28T22:31:48.568Z","repository":{"id":40581961,"uuid":"82483313","full_name":"PaulSec/awesome-windows-domain-hardening","owner":"PaulSec","description":"A curated list of awesome Security Hardening techniques for Windows.","archived":false,"fork":false,"pushed_at":"2020-01-07T19:56:18.000Z","size":40,"stargazers_count":1762,"open_issues_count":1,"forks_count":267,"subscribers_count":119,"default_branch":"master","last_synced_at":"2025-03-22T09:01:46.607Z","etag":null,"topics":["hardening","security","windows"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PaulSec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-02-19T19:20:38.000Z","updated_at":"2025-03-21T00:32:22.000Z","dependencies_parsed_at":"2022-07-13T19:30:37.471Z","dependency_job_id":null,"html_url":"https://github.com/PaulSec/awesome-windows-domain-hardening","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PaulSec%2Fawesome-windows-domain-hardening","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PaulSec%2Fawesome-windows-domain-hardening/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PaulSec%2Fawesome-windows-domain-hardening/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PaulSec%2Fawesome-windows-domain-hardening/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PaulSec","download_url":"https://codeload.github.com/PaulSec/awesome-windows-domain-hardening/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246110246,"owners_count":20725021,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hardening","security","windows"],"created_at":"2024-07-31T20:00:34.135Z","updated_at":"2025-03-28T22:31:48.545Z","avatar_url":"https://github.com/PaulSec.png","language":null,"funding_links":[],"categories":["Windows","\u003ca id=\"a4ee2f4d4a944b54b2246c72c037cd2e\"\u003e\u003c/a\u003e收集\u0026\u0026集合","Others","Security","\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集","[↑](#table-of-contents) Defense","Others (1002)","Bug Bounty","Other Lists","\u003ca id=\"e97d183e67fa3f530e7d0e7e8c33ee62\"\u003e\u003c/a\u003e未分类","Operating Systems","Hardening","System","Defence Topics"],"sub_categories":["Ubuntu","\u003ca id=\"e97d183e67fa3f530e7d0e7e8c33ee62\"\u003e\u003c/a\u003e未分类","Hardening","[T1102 - Web Service](https://attack.mitre.org/techniques/T1102/)","Defence Topics","TeX Lists","\u003ca id=\"f110da0bf67359d3abc62b27d717e55e\"\u003e\u003c/a\u003e新添加的","Windows Defences","Ghidra","Tools"],"readme":"# Awesome Windows Domain Hardening [![Awesome](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/PaulSec/Windows-domain-hardening)\n\nA curated list of awesome Security Hardening techniques for Windows.\n\nCreated by [gepeto42](https://twitter.com/gepeto42) and [PaulWebSec](https://twitter.com/PaulWebSec) but highly inspired from [PyroTek3](https://twitter.com/PyroTek3) research!\n\n\n### Summary\n\nThis document summarizes the information related to Pyrotek and Harmj0y's DerbyCon talk called \"111 Attacking EvilCorp Anatomy of a Corporate Hack\". Video and slides are available below. \n\nIt also incorporates hardening techniques necessary to prevent other attacks, including techniques discussed by [gepeto42](https://twitter.com/gepeto42) and [joeynoname](https://twitter.com/joeynoname) during their [THOTCON 0x7 talk](https://evil.plumbing/).\n\nSomething's missing? Create a Pull Request and add it.\n\n### Initial foothold\n\n- No hardening effort should come at the expense of upgrading operating systems.\n- Deploy [EMET](https://support.microsoft.com/en-us/help/2458544/the-enhanced-mitigation-experience-toolkit) to Workstations (End of line in July 2018 - Consider keeping EMET for Windows 7 but prioritize upgrades to Windows 10 and Edge). \n- Use [AppLocker](https://technet.microsoft.com/en-us/library/dd759117(v=ws.11).aspx) to block exec content from running in user locations (home dir, profile path, temp, etc).\n- Hardening against DMA Attacks? [Here you go](http://docshare02.docshare.tips/files/17344/173447840.pdf) and an interesting article from [Synacktiv about DMA attacks](https://www.synacktiv.com/posts/pentest/practical-dma-attack-on-windows-10.html)\n- Manage PowerShell execution via Applocker or constrained language mode.\n- Enable [PowerShell logging](https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html) (v3+) \u0026 command process logging.\n- [Block Office macros](https://blogs.technet.microsoft.com/mmpc/2016/03/22/new-feature-in-office-2016-can-block-macros-and-help-prevent-infection/) (Windows \u0026 Mac) on content downloaded from the Internet.\n- Deploy security tooling that monitors for suspicious behavior. Consider using [WEF](https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem/) to forward only interesting events to your SIEM or logging system.\n- Limit capability by blocking/restricting attachments via email/download:\n\t-  Executables extensions:\n\t-  (ade, adp, ani, bas, bat, chm, cmd, com, cpl,\ncrt, hlp, ht, hta, inf, ins, isp, job, js, jse, lnk, mda, mdb,\nmde, mdz, msc, msi, msp, mst, pcd, pif, reg, scr, sct, shs,\nurl, vb, vbe, vbs, wsc, wsf, wsh, exe, pif, etc.)\n\t- Office files that support macros (docm, xlsm, pptm, etc.)\n\t-  Ensure [these file types](https://support.office.com/en-us/article/blocked-attachments-in-outlook-434752e1-02d3-4e90-9124-8b81e49a8519) are blocked.\n\t-  Block forgotten/unused [Excel file extensions](https://www.vmray.com/cyber-security-blog/forgotten-ms-office-features-used-deliver-malware/): IQY, SLK\n-  Change default program for anything that opens with Windows scripting to notepad (test first!)\n\t- bat, js, jse, vbe, vbs, wsf, wsh, hta, vbs, etc.\n\t-  GPO: User Configuration -\u003e Preferences -\u003e Control Panel Settings -\u003e Folder Options -\u003e Open With\n\t-  Action: Replace\n\t-  File Extension: (extension)\n\t-  Associated Program: %windir%\\system32\\notepad.exe\n\t-  Set as default: Enabled.\n- [Preventing activation of OLE packages](https://cloudblogs.microsoft.com/microsoftsecure/2016/06/14/wheres-the-macro-malware-author-are-now-using-ole-embedding-to-deliver-malicious-files/?source=mmpc) in Office with the PackagerPrompt registry setting\n\n### Reconnaissance\n\n- Deploy Windows 10 and limit local group enumeration.\n- Limit workstation to workstation communication.\n- Increase security on sensitive [GPO](https://msdn.microsoft.com/en-us/library/bb742376.aspx)s.\n-  Evaluate deployment of behavior analytics [(Microsoft ATA)](https://www.microsoft.com/en-us/cloud-platform/advanced-threat-analytics).\n\nBloodHound \"prevention\":\n- Use [NetCease](https://gallery.technet.microsoft.com/Net-Cease-Blocking-Net-1e8dcb5b)  to prevent unprivileged session enumeration.\n- Use [Samri10](https://gallery.technet.microsoft.com/SAMRi10-Hardening-Remote-48d94b5b)  to prevent unprivileged local admin collection (this fix already exists in Windows 10 1607 and above).\n\n### Lateral Movement\n\n-  Configure GPO to prevent local accounts from network authentication [(KB2871997)](https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13,-2014).\nIn addition to this KB, [Countercept article](https://www.countercept.com/our-thinking/notpetya-ransomware-frequently-asked-questions/) is recommending two other changes in the registry: \n1. Set ```HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\TokenLeakDetectDelaySecs``` = 30. This will clear credentials of logged off users after 30 seconds (mimicking the behavior of Windows 8.1+) \n2. Set ```HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\UseLogonCredential``` = 0. This will prevent Wdigest credentials being stored in memory, again as is the default for Windows 8.1+. \n- Ensure local administrator account passwords are automatically changed [(Microsoft LAPS)](https://www.microsoft.com/en-us/download/details.aspx?id=46899) \u0026 remove extra local admin accounts.\n- Limit workstation to workstation communication [(Windows Firewall)](https://technet.microsoft.com/en-us/network/bb545423.aspx).\n  - Test psexec with good credentials between two workstations. If it works, you have a lateral movement problem.\n\n\n### Privilege Escalation\n\n- Remove files with passwords in SYSVOL [(including GPP)](https://adsecurity.org/?p=2288).\n- Ensure admins don’t log onto untrusted systems (regular workstations) by configuring **DENY** user right assignments with GPOs.\n- Provide Privileged Access Workstations or [PAWs](https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/privileged-access-workstations) for all highly privileged work. Those should never have access to the Internet.\n- Use Managed Service Accounts for SAs when possible [(FGPP)](https://technet.microsoft.com/en-us/library/cc770842%28v=ws.10%29.aspx)\n- For systems that do not support Managed Service Accounts, deploy a [Fine-Grained Password Policy](https://technet.microsoft.com/en-us/library/cc770842(v=ws.10).aspx) to ensure the passwords are \u003e32 characters.\n- Ensure all computers are talking NTLMv2 \u0026 Kerberos, deny [LM/NTLMv1](https://support.microsoft.com/en-us/help/2793313/security-guidance-for-ntlmv1-and-lm-network-authentication).\n\n### Protect Administration Credentials\n \n- Ensure all admins only log onto approved admin workstations \u0026 servers. (See PAW in Privilege Escalation section)\n- Ensure all built-in groups but Administrator are denied from logging on to Domain Controllers user User Right Assignments. By default, Backup operators, Account operators can login to Domain Controllers, which is dangerous.\n- Add all admin accounts to [Protected Users group](https://technet.microsoft.com/en-us/library/dn466518%28v=ws.11%29.aspx) (requires Windows 2012 R2 DCs).\n- Admin workstations \u0026 servers:\n\t- Control \u0026 limit access to admin workstations \u0026 servers.\n\t- Remove NetBIOS over TCP/IP\n\t- Disable [LLMNR](https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution).\n\t- Disable [WPAD](https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol).\n \n### Strengthen/Remove Legacy\n\n- **Start now by using [PingCastle](https://www.pingcastle.com/) which performs incredible AD audit**\n- Audit/Restrict NTLM.\n- Enforce [LDAP signing](https://technet.microsoft.com/en-us/library/dd941832%28v=ws.10%29.aspx).\n- Enable [SMB signing](https://blogs.technet.microsoft.com/josebda/2010/12/01/the-basics-of-smb-signing-covering-both-smb1-and-smb2/) (\u0026 encryption where poss.).\n- Disable WPAD \u0026 LLMNR \u0026 work to disable NetBIOS.\n- Windows 10, remove:\n\t- SMB 1.0/CIFS\n\t- Windows PowerShell 2.0\n- Use [shims](https://technet.microsoft.com/en-ca/library/dd837644(v=ws.10).aspx) to enable old applications that require admin privileges to work by believing they have them.\n \n### Tools\n\n- [PingCastle](https://www.pingcastle.com/) - an Active Directory audit tool (and free!) with pretty good metrics.\n- [Responder](https://github.com/lgandx/Responder) - A LLMNR, NBT-NS and MDNS poisoner\n- [BloodHound](https://github.com/BloodHoundAD/BloodHound) - Six Degrees of Domain Admin\n- [AD Control Path](https://github.com/ANSSI-FR/AD-control-paths) - Active Directory Control Paths auditing and graphing tools  \n- [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/) - A PowerShell Post-Exploitation Framework\n- [PowerView](https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon) - Situational Awareness PowerShell framework\n- [Empire](https://github.com/EmpireProject/Empire) - PowerShell and Python post-exploitation agent\n- [Mimikatz](https://github.com/gentilkiwi/mimikatz) - Utility to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets\n- [Tools Cheatsheets](https://github.com/HarmJ0y/CheatSheets) - (Beacon, PowerView, PowerUp, Empire, ...)\n- [UACME](https://github.com/hfiref0x/UACME) - Defeating Windows User Account Control\n- [Windows System Internals](https://technet.microsoft.com/en-us/sysinternals/bb545021.aspx) - (Including Sysmon etc.)\n- [Hardentools](https://github.com/securitywithoutborders/hardentools) - Collection of simple utilities designed to disable a number of \"features\" exposed by Windows\n- [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) - A swiss army knife for pentesting Windows/Active Directory environments\n- [SharpSploit](https://github.com/cobbr/SharpSploit)\n- [Rubeus](https://github.com/GhostPack/Rubeus/) - Rubeus is a C# toolset for raw Kerberos interaction and abuses\n- [Koadic](https://github.com/zerosum0x0/koadic) - Koadic, or COM Command \u0026 Control, is a Windows post-exploitation rootkit\n- [SILENTTRINITY](https://github.com/byt3bl33d3r/SILENTTRINITY) - A post-exploitation agent powered by Python, IronPython, C#/.NET\n\n### Videos\n\n- [Beyond the Mcse: Active Directory for the Security Professional](https://www.youtube.com/watch?v=2w1cesS7pGY)\n- [BSides DC 2016 - PowerShell Security: Defending the Enterprise from the Latest Attack Platform](https://www.youtube.com/watch?v=_8yBjg7bRLo\u0026feature=youtu.be\u0026t=106)\n- [Six Degrees of Domain Admin... - Andy Robbins, Will Schroeder, Rohan Vazarkar](https://www.youtube.com/watch?v=lxd2rerVsLo)\n- [111 Attacking EvilCorp Anatomy of a Corporate Hack](https://www.youtube.com/watch?v=nJSMJyRNvlM\u0026feature=youtu.be\u0026t=16)\n- [Red vs Blue: Modern Active Directory Attacks \u0026 Defense](https://www.youtube.com/watch?v=rknpKIxT7NM)\n- [Offensive Active Directory with Powershell](https://www.youtube.com/watch?v=cXWtu-qalSs)\n- [Advanced Incident Detection and Threat Hunting using Sysmon and Splunk](https://www.youtube.com/watch?v=vv_VXntQTpE)\n- [Real Solutions From Real Incidents: Save Money and Your Job!](https://www.youtube.com/watch?v=313J20uPbcw)\n- [AppLocker Bypass Techniques](https://www.youtube.com/watch?v=z04NXAkhI4k)\n\n### Slides\n\n- [From Workstation To Domain Admin - Why Secure Administration Isn't Secure](https://adsecurity.org/wp-content/uploads/2018/08/us-18-Metcalf-From-Workstation-To-Domain-Admin-Why-Secure-Administration-Isnt-Secure-Final.pdf)\n- [Exploiting AD Administrator Insecurities](https://adsecurity.org/wp-content/uploads/2018/08/2018-DEFCON-ExploitingADAdministratorInsecurities-Metcalf.pdf)\n- [How to go from Responding to Hunting with Sysinternals Sysmon](https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843\u0026ithint=file%2cpptx\u0026app=PowerPoint\u0026authkey=!AMvCRTKB_V1J5ow)\n- [111 Attacking EvilCorp Anatomy of a Corporate Hack](https://adsecurity.org/wp-content/uploads/2016/09/DerbyCon6-2016-AttackingEvilCorp-Anatomy-of-a-Corporate-Hack-Presented.pdf)\n- [Real Solutions From Real Incidents: Save Money and Your Job!](https://evil.plumbing/Current-version-June.pdf)\n\n### Additional resources\n\n- [ADSecurity](https://adsecurity.org/)\n- [Harmj0y's blog](http://blog.harmj0y.net/)\n- [Sysmon SecuriTay's configuration file](https://github.com/SwiftOnSecurity/sysmon-config) - template with default high-quality event tracing\n- [Explaining and adapting Tay’s Sysmon configuration](https://web.archive.org/web/20170531120041/https://medium.com/@lennartkoopmann/explaining-and-adapting-tays-sysmon-configuration-27d9719a89a8) and [here](https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml)\n- [Use of PSExec](https://www.toshellandback.com/2017/02/11/psexec/)\n- [Preventing Mimikatz attacks](https://medium.com/blue-team/preventing-mimikatz-attacks-ed283e7ebdd5)\n- [Useful list of Windows Security Log Events](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx)\n- [Introducing SharpSploit: A C# Post-Exploitation Library](https://posts.specterops.io/introducing-sharpsploit-a-c-post-exploitation-library-5c7be5f16c51)\n- [From Kekeo to Rubeus](http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/)\n- [Windows oneliners to download remote payload and execute arbitrary code](https://movaxbx.ru/2018/10/22/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/amp/)\n- [Configuration guidance for implementing the Windows 10 and Windows Server 2016 DoD Secure Host Baseline settings.](https://github.com/nsacyber/Windows-Secure-Host-Baseline)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPaulSec%2Fawesome-windows-domain-hardening","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FPaulSec%2Fawesome-windows-domain-hardening","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPaulSec%2Fawesome-windows-domain-hardening/lists"}