Category: Windows – Security

Please, don’t turn your firewall off…

𝗗𝗲𝗳𝗮𝘂𝗹𝘁 → 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱 Real configs. Real fixes. Windows & AD security. 𝗣𝗹𝗲𝗮𝘀𝗲, 𝗱𝗼𝗻’𝘁 𝘁𝘂𝗿𝗻 𝘆𝗼𝘂𝗿 𝗳𝗶𝗿𝗲𝘄𝗮𝗹𝗹 𝗼𝗳𝗳… It might sound surprising, but I still see this way too often: ⚠️ Windows Firewall completely disabled for no real reason. Sometimes it almost feels like the deployment process is: ➡️ Install Windows Server ➡️ sign in ➡️ […]

Does your RDP send your credentials to the target computer?

𝗗𝗲𝗳𝗮𝘂𝗹𝘁 → 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱 Real configs. Real fixes. Windows & AD security. 𝗗𝗼𝗲𝘀 𝘆𝗼𝘂𝗿 𝗥𝗗𝗣 𝘀𝗲𝗻𝗱 𝘆𝗼𝘂𝗿 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀 𝘁𝗼 𝘁𝗵𝗲 𝘁𝗮𝗿𝗴𝗲𝘁 𝗰𝗼𝗺𝗽𝘂𝘁𝗲𝗿? ⚠️ By default, yes. When you authenticate using a standard RDP session, your credentials are sent to the target machine. If that machine is compromised, an attacker can potentially recover them from LSASS. ✅ […]

Do you RDP to your Domain Controllers from your workstation?

⏱️ 60-Second Bits 🔒 𝗗𝗼 𝘆𝗼𝘂 𝗥𝗗𝗣 𝘁𝗼 𝘆𝗼𝘂𝗿 𝗗𝗼𝗺𝗮𝗶𝗻 𝗖𝗼𝗻𝘁𝗿𝗼𝗹𝗹𝗲𝗿𝘀 𝗳𝗿𝗼𝗺 𝘆𝗼𝘂𝗿 𝘄𝗼𝗿𝗸𝘀𝘁𝗮𝘁𝗶𝗼𝗻? Even with 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗚𝘂𝗮𝗿𝗱 enabled, your 𝗗𝗼𝗺𝗮𝗶𝗻 𝗔𝗱𝗺𝗶𝗻 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀 can still end up in the 𝗠𝗦𝗧𝗦𝗖 process memory on your workstation. Credential Guard protects 𝗟𝗦𝗔𝗦𝗦. It does 𝗻𝗼𝘁 protect credentials handled by the 𝗥𝗗𝗣 client. If your workstation is compromised, an […]

What does your local administrator password look like?

𝗗𝗲𝗳𝗮𝘂𝗹𝘁 → 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱 Real configs. Real fixes. Windows & AD security. 𝗪𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 𝘆𝗼𝘂𝗿 𝗹𝗼𝗰𝗮𝗹 𝗮𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗼𝗿 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗹𝗼𝗼𝗸 𝗹𝗶𝗸𝗲? And is it the same on all Windows servers or workstations? Because I still see this 𝗮𝗹𝗹 𝘁𝗵𝗲 𝘁𝗶𝗺𝗲. ⚠️ One local admin password for all servers. ⚠️ One local admin password for all workstations. ⚠️ […]

What does your local group membership look like?

𝗗𝗲𝗳𝗮𝘂𝗹𝘁 → 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱 Real configs. Real fixes. Windows & AD security. 𝗪𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 𝘆𝗼𝘂𝗿 𝗹𝗼𝗰𝗮𝗹 𝗴𝗿𝗼𝘂𝗽 𝗺𝗲𝗺𝗯𝗲𝗿𝘀𝗵𝗶𝗽 𝗹𝗼𝗼𝗸 𝗹𝗶𝗸𝗲? During my security assessments, I unfortunately often see the “left side”. 🔸 Messy local group membership. 🔸 No clear ownership. 🔸 No defined state. 🔸 No real control over who can access the device interactively or […]

“Just enable MFA. It’s easy.”

🔒 Secure Bits 💡 “𝗝𝘂𝘀𝘁 𝗲𝗻𝗮𝗯𝗹𝗲 𝗠𝗙𝗔. 𝗜𝘁’𝘀 𝗲𝗮𝘀𝘆.” Sure… if you can rely on cloud identity. A lot of environments can. But 𝗺𝗮𝗻𝘆 – often the most critical ones – 𝗰𝗮𝗻𝗻𝗼𝘁 be connected to the internet at all. And that changes everything. In fully 𝗼𝗻-𝗽𝗿𝗲𝗺 / 𝗼𝗳𝗳𝗹𝗶𝗻𝗲 Windows environments, MFA often ends up being […]

New RDP dialogs

🔒 Secure Bits 💡 𝗡𝗲𝘄 𝗥𝗗𝗣 𝗱𝗶𝗮𝗹𝗼𝗴𝘀 — 𝗵𝗮𝘃𝗲 𝘆𝗼𝘂 𝘀𝗲𝗲𝗻 𝘁𝗵𝗲𝗺? With the 𝗔𝗽𝗿𝗶𝗹 𝟮𝟬𝟮𝟲 security update, the Remote Desktop Connection app (MSTSC) shows new warnings when you open .𝗥𝗗𝗣 𝗳𝗶𝗹𝗲𝘀. The point is simple: remind people that RDP files can be used for phishing / tricking users, and force you to explicitly approve what the file is trying to […]

Capturing Network Traffic on Windows Server

🔒 Secure Bits 💡 𝗖𝗮𝗽𝘁𝘂𝗿𝗶𝗻𝗴 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝘁𝗿𝗮𝗳𝗳𝗶𝗰 𝗼𝗻 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗦𝗲𝗿𝘃𝗲𝗿 There is an issue on a Windows Server, and I need to capture network traffic to understand what is happening. The first thought is usually: ➡️ Let’s install 𝗪𝗶𝗿𝗲𝘀𝗵𝗮𝗿𝗸 🚫 But that does not always work. In many environments I work in — especially critical […]

Do you know what proper logging in Windows looks like?

🔒 Secure Bits 💡 𝗗𝗼 𝘆𝗼𝘂 𝗸𝗻𝗼𝘄 𝘄𝗵𝗮𝘁 “𝗽𝗿𝗼𝗽𝗲𝗿 𝗹𝗼𝗴𝗴𝗶𝗻𝗴” 𝗶𝗻 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗹𝗼𝗼𝗸𝘀 𝗹𝗶𝗸𝗲? Most environments I see struggle with this. Logging is often left 𝗱𝗲𝗳𝗮𝘂𝗹𝘁, 𝗻𝗼𝗶𝘀𝘆, 𝗼𝗿 𝘀𝗶𝗺𝗽𝗹𝘆 𝗺𝗶𝘀𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲𝗱 — which means you either miss real attacks… or you drown in useless events. That’s why I built 𝗧𝗵𝗿𝗲𝗮𝘁𝗟𝗼𝗴. 🎯 ThreatLog helps you 𝗱𝗲𝗽𝗹𝗼𝘆 𝗮 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝗔𝘂𝗱𝗶𝘁 𝗣𝗼𝗹𝗶𝗰𝘆 + 𝗦𝘆𝘀𝗺𝗼𝗻 […]

RDP certificate warning

𝗗𝗲𝗳𝗮𝘂𝗹𝘁 → 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱 Real configs. Real fixes. Windows & AD security. Have you ever seen this 𝗥𝗗𝗣 𝗰𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲 𝘄𝗮𝗿𝗻𝗶𝗻𝗴? Do you know 𝘄𝗵𝗮𝘁 𝗶𝘁 𝗺𝗲𝗮𝗻𝘀? It means the certificate presented by the target during RDP 𝗶𝘀𝗻’𝘁 𝘁𝗿𝘂𝘀𝘁𝗲𝗱. Often it’s just a self-signed cert—which isn’t a huge problem: you can make it trusted or distribute your […]