CSEC_PUBLIC/awesome-windows-domain-hardening
1
0
Fork 0
mirror of https://github.com/PaulSec/awesome-windows-domain-hardening.git synced 2025-12-06 01:02:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

updated some notes

Browse Source
This commit is contained in:
Drew Hjelm
2020-01-05 05:50:13 -08:00
committed by GitHub
parent b6bdc5f212
commit 3b82291499
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -30,8 +30,15 @@ crt, hlp, ht, hta, inf, ins, isp, job, js, jse, lnk, mda, mdb,
mde, mdz, msc, msi, msp, mst, pcd, pif, reg, scr, sct, shs,
url, vb, vbe, vbs, wsc, wsf, wsh, exe, pif, etc.)
- Office files that support macros (docm, xlsm, pptm, etc.)
- Ensure [these file types](https://support.office.com/en-us/article/blocked-attachments-in-outlook-434752e1-02d3-4e90-9124-8b81e49a8519) are blocked.
- Block forgotten/unused [Excel file extensions](https://www.vmray.com/cyber-security-blog/forgotten-ms-office-features-used-deliver-malware/): IQY, SLK
- Change default program for anything that opens with Windows scripting to notepad (test first!)
- bat, js, jse, vbe, vbs, wsf, wsh, etc.
- bat, js, jse, vbe, vbs, wsf, wsh, hta, vbs, etc.
- GPO: User Configuration -> Preferences -> Control Panel Settings -> Folder Options -> Open With
- Action: Replace
- File Extension: (extension)
- Associated Program: %windir%\system32\notepad.exe
- Set as default: Enabled.
- [Preventing activation of OLE packages](https://cloudblogs.microsoft.com/microsoftsecure/2016/06/14/wheres-the-macro-malware-author-are-now-using-ole-embedding-to-deliver-malicious-files/?source=mmpc) in Office with the PackagerPrompt registry setting
### Reconnaissance