Blue | Protect - Defend

Windows

Disable/stop services

:: Get a list of services and disable or stop
sc query
sc config "<SERVICE NAME>" start= disabled
sc stop "<SERVICE NAME>"
wmic service where name='<SERVICE NAME>' call ChangeStartmode Disabled

Host system firewalls

:: Show all rules
netsh advfirewall firewall show rule name=all

:: Set firewall on/off
netsh advfirewall set currentprofile state on
netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutbound
netsh advfirewall set publicprofile state on
netsh advfirewall set privateprofile state on
netsh advfirewall set domainprofile state on
netsh advfirewall set allprofile state on
netsh advfirewall set allprofile state off

: Set firewall rules examples
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes

netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnetprofile=domain

netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnetprofile=private

netsh advfirewall firewall delete rule name=rule name program="C:\MyApp\MyApp.exe"

netsh advfirewall firewall delete rule name=rule name protocol=udp localport=500

netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=domain

netsh advfirewall firewall set rule group="remote desktop" new enable=No profile=public

:: Setup togging location

netsh advfirewall set currentprofile logging C:\<LOCATION>\<FILE NAME>

:: Windows firewall log location and settings
more %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set allprofile logging maxfilesize 4096
netsh advfirewall set allprofile logging droppedconnections enable
netsh advfirewall set allprofile logging allowedconnections enable

:: Display firewall logs
Get-Content $env:systemroot\system32\LogFiles\Firewall\pfirewall.log

Passwords

:: Change password
net user <USER NAME> * /domain
net user <USER NAME> <NEW PASSWORD>

:: Change password remotely
:: Ref. https://technet.microsoft.com/en-us/sysinternals/bb897543
pspasswd.exe \\<IP ADDRESS or NAME OF REMOTE COMPUTER> -u <REMOTE USER NAME> -p <NEW PASSWORD>

:: Change password remotely
pspasswd.exe \\<IP ADDRESS or NAME OF REMOTE COMPUTER>

Host file

:: Flush DNS of malicious domain/IP
ipconfig /flushdns

:: Flush NetBios cache of host/IP
nbtstat -R

:: Add new malicious domain to hosts file, 
:: and route to localhost
echo 127.0.0.1 <MALICIOUS DOMAIN> >> C:\Windows\System32\drivers\etc\hosts

:: Check if hosts file is working,
:: by sending ping to 127.0.0.1
ping <MALICIOUS DOMAIN> -n 1

Allowlist

Use a Proxy Auto Config (PAC) file to create bad URL or IP list (IE, Firefox, Chrome):

function FindProxyForURL(url, host) {
    // Send bad DNS name to the proxy
    if (dnsDomainIs(host, ".badsite.com"))
        return "PROXY http://127.0.0.1:8080";
    // Send bad IPs to the proxy
    if (isInNet(myipAddress(), "222.222.222.222","255.255.255.0"))
        return "PROXY http://127.0.0.1:8080";
    // All other traffic bypass proxy
    return "DIRECT";
}

Application restrictions

For Applocker - Server 2008 R2 or Windows 7 or higher.

Using GUI Wizard configure:

Executable Rules (.exe, .com)
DLL Rules (.dll, .ocx)
Script Rules (.ps1, .bat, .cmd, .vbs, .js)
Windows Install Rules (.msi, .msp, .mst)

Steps to employ Applocker (GUI is needed for digital signed app restrictions):

Create a new GPO.
Right-click on it to edit, and then navigate through Computer Configuration, Policies, Windows Settings, Security Settings, Application Control Policies and Applocker. Click Configure Rule Enforcement.
Under Executable Rules, check the Configured box and then make sure Enforce Rules is selected from the drop-down box. Click OK.
In the left pane, click Executable Rules.
Right-click in the right pane and select Create New Rule.
On the Before You Begin screen, click Next.
On the Permissions screen, click Next.
On the Conditions screen, select the Publisher condition and click Next.
Click the Browse button and browse to any executable file on your system. It doesn’t matter which.
Drag the slider up to Any Publisher and then click Next.
Click Next on the Exceptions screen.
Name policy, Example uonly run executables that are signed" and click Create.
If this is your first time creating an Applocker policy, Windows will prompt you to create default rule, click Yes.
Ensure Application Identity Service is Running.

net start AppIDSvc
REG add "HKLM\SYSTEM\CurrentControlSet\services\AppIDSvc" /v Start /t REG_DWORD /d 2 /f

Changes require reboot.

shutdown.exe /r
shutdown.exe /r /m \\<IP ADDRESS OR COMPUTER NAME> /f

Further PowerShell commands:

# Add the Applocker cmdlets into PowerShell
import-module AppLocker

# Gets the file information for all of the executable 
# files and scripts in the directory C:\Windows\System32
Get-AppLockerFileInformation -Directory C:\Windows\System32\ -Recurse -FileType Exe, Script

# Create a AppLocker Policy that allow rules for 
# all of the executable files in C:\Windows\System32
Get-ChildItem C:\Windows\System32\*.exe | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -RuleNamePrefix System32

# Sets the local AppLocker policy to the policy specified in C:\Policy.xml
Set-AppLockerPolicy -XMLPolicy C:\Policy.xml

# Uses the AppLocker policy in C:\Policy.xml to test whether
# calc.exe and notepad.exe are allowed to run for users who are 
# members of the Everyone group. If you do not specify a group, 
# the Everyone group is used by default
Test-AppLockerPolicy -XMLPolicy C:\Policy.xml -Path C:\Windows\System32\calc.exe,C:\Windows\System32\notepad.exe -User Everyone

# Review how many times a file would have been 
# blocked from running if rules were enforced
Get-AppLockerFileInformation -EventLog -Logname "Microsoft-Windows-AppLocker\EXE and DLL" -EventType Audited -Statistics

# Creates a new AppLocker policy from the audited events 
# in the local Microsoft-Windows-AppLocker/EXE and DLL event log, 
# applied to <GROUP> and current AppLocker policy will be overwritten
Get-AppLockerFileInformation -Eventlog -LogPath "Microsoft-Windows-AppLocker/EXE and DLL" -EventType Audited | New-AppLockerPolicy -RuleType Publisher,Hash -User domain\<GROUP> -IgnoreMissingFileInformation | Set-AppLockerPolicy -LDAP "LDAP://<DC>,<DOMAIN>.com/CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=<DOMAIN>,DC=com"

# Export the local AppLocker policy, comparing User's 
# explicitly denied access to run, and output text file
Get-AppLockerPolicy -Local | Test-AppLockerPolicy -Path C:\Windows\System32\*.exe -User domain\<USER NAME> -Filter Denied | Format-List -Property Path > C:\DeniedFiles.txt

# Export the results of the test to a file for analysis
Get-ChildItem <DirectoryPathtoReview> -Filter <FileExtensionFilter> -Recurse | Convert-Path | Test-AppLockerPolicy -XMLPolicy <PathToExportedPolicyFile> -User <domain\username> -Filter <TypeofRuletoFilterFor> | Export-CSV <PathToExportResultsTo.CSV>

# GridView list of any local rules applicable
Get-AppLockerPolicy -Local -Xml | Out-GridView

IPSEC

:: Create a IPSEC Local Security Policy, applied to any 
:: connection, any protocol, and using a preshared key
netsh ipsec static add filter filterlist=MyIPsecFilter srcaddr=Any dstaddr=Any protocol=ANY
netsh ipsec static add filteraction name=MyIPsecAction action=negotiate
netsh ipsec static add policy name=MyIPsecPolicy assign=yes
netsh ipsec static add rule name=MyIPsecRule policy=MyIPsecPolicy filterlist=MyIPsecFilter filteraction=MyIPsecAction conntype=all activate=yes psk=<PASSWORD>

:: Add rule to allow web browsing port 80(HTTP) 
:: and 443(HTTPS) over IPSEC
netsh ipsec static add filteraction name=Allow action=permit
netsh ipsec static add filter filterlist=WebFilter srcaddr=Any dstaddr=Any protocol=TCP dstport=80
netsh ipsec static add filter filterlist=WebFilter srcaddr=Any dstaddr=Any protocol=TCP dstport=443
netsh ipsec static add rule name=WebAllow policy=MyIPsecPolicy filterlist=WebFilter filteraction=Allow conntype=all activate=yes psk=<PASSWORD>

:: Shows the IPSEC Local Security Policy with name 'MyIPsecPolicy'
netsh ipsec static show policy name=MyIPsecPolicy

:: Stop or Unassign a IPSEC Policy
netsh ipsec static set policy name=MyIPsecPolicy

:: Create a IPSEC Advance Firewall Rule and Policy
:: and preshared key from and to any connections
netsh advfirewall consec add rule name="IPSEC" endpointl=any endpoint2=any action=requireinrequireout qmsecmethods=default

:: Require IPSEC preshared key on all outgoing requests
netsh advfirewall firewall add rule name="IPSEC_Out" dir=out action=allow enable=yes profile=any localip=any remoteip=any protocol=any interfacetype=any security=authenticate

:: Create a rule for web browsing
netsh advfirewall firewall add rule name="Allow Outbound Port 80" dir=out localport=80 protocol=TCP action=allow

:: Create a rule for DNS
netsh advfirewall firewall add rule name="Allow Outbound Port 53" dir=out localport=53 protocol=UDP action=allow

:: Delete ISPEC Rule
netsh advfirewall firewall delete rule name="IPSEC_RULE"

Active Directory (AD) - Group Policy Object (GPO)

:: Get and force new policies
gpupdate /force
gpupdate /sync

:: Audit Success and Failure for user Bob
auditpol /set /user:bob /category:"Detailed Tracking" /include /success:enable /failure:enable

:: Create an Organization Unit to move suspected 
:: or infected users and machines
dsadd OU <QUARANTINE BAD OU>

:: Move an active directory user object into NEW GROUP
Move-ADObject 'CN=<USER NAME>,CN=<OLD USER GROUP>,DC=<OLD DOMAIN>,DC=<OLD EXTENSION>' -TargetPath 'OU=<NEW USER GROUP>,DC=<OLD DOMAIN>,DC=<OLD EXTENSION>'

:: Alt Option
dsmove "CN=<USER NAME>,OU=<OLD USER OU>,DC=<OLD DOMAIN>,DC=<OLD EXTENSION>" -newparent OU=<NEW USER GROUP>,DC=<OLD DOMAIN>,DC=<OLD EXTENSION>

Stand alone system – without AD

:: Disallow running a .exe file
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d "00000001" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v badfile.exe /t REG_SZ /d <BAD FILE NAME>.exe /f

:: Disable Remote Desktop
reg add "HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer" /f /v fDenyTSConnections /t REG_DWORD /d 1

:: Send NTLMv2 response only/refuse LM and NTLM: (Windows 7 default)
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ /v lmcompatibilitylevel /t REG_DWORD /d 5 /f

:: Restrict Anonymous Access
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v restrictanonymous /t REG_DWORD /d 1 /f

:: Do not allow anonymous enumeration of SAM accounts and shares
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v restrictanonymoussam /t REG_DWORD /d 1 /f

:: Disable IPV6
reg add HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters /v DisabledComponents /t REG_DWORD /d 255 /f

:: Disable sticky keys
reg add "HKCU\ControlPanel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f

:: Disable Toggle Keys
reg add "HKCU\ControlPanel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f

:: Disable Filter Keys
reg add "HKCU\ControlPanel\Accessibility\Keyboard Response" /v Flags /t REG_SZ /d 122 /f

:: Disable On-screen Keyboard
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI /f /v ShowTabletKeyboard /t REG_DWORD /d 0

:: Disable Administrative Shares - Workstations
reg add HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /f /v AutoShareWks /t REG_DWORD /d 0

:: Disable Administrative Shares - Severs
reg add HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /f /v AutoShareServer /t REG_DWORD /d 0

:: Remove Creation of Hashes Used to Pass the Hash Attack
:: Requires password reset and reboot to purge old hashes
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /f /v NoLMHash /t REG_DWORD /d 1

:: To Disable Registry Editor (High Risk)
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f

:: Disable IE Password Cache
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings /v DisablePasswordCaching /t REG_DWORD /d 1 /f

:: Disable CMD prompt
reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f

:: Disable Admin credentials cache on host when using RDP
reg add HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f

:: Do not process the run once list
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v DisableLocalMachineRunOnce /t REG_DWORD /d 1

:: Require User Access Control (UAC) Permission
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f

:: Change password at next logon
Set-ADAccountPassword <USER> -NewPassword $newpwd -Reset -PassThru | Set-ADuser -ChangePasswordAtLogon $True

:: Change password at next logon for OU Group
Get-ADuser -filter "department -eq '<OUGROUP>' -AND enabled -eq 'True'" | Set-ADuser -ChangePasswordAtLogon $True

:: Enabled Firewall logging
netsh firewall set logging droppedpackets connections = enable

Linux

Disable/stop services

# Services information
service --status-all
ps -ef
ps -aux

# Get a list of upstart jobs
initctl list

# Example of start, stop, restarting a service in Ubuntu
/etc/init.d/apache2 start
/etc/init.d/apache2 restart
/etc/init.d/apache2 stop #(stops only until reboot)
service mysql start
service mysql restart
service mysql stop #(stops only until reboot)

# List all Upstart services
ls /etc/init/*.conf

# Show if a program is managed by upstart 
# and the process ID
status ssh

# If not managed by upstart
update-rc.d apache2 disable
service apache2 stop

Host system firewalls

# Export existing iptables firewall rules
iptables-save > firewall.out

# Edit firewall rules and chains 
# in firewall.out and save the file
vi firewall.out

# Apply iptables
iptables-restore < firewall.out

# Example iptables commands (IP, IP Range, Port Blocks)
iptables -A INPUT -s 10.10.10.10 -j DROP
iptables -A INPUT -s 10.10.10.0/24 -j DROP
iptables -A INPUT -p tcp --dport ssh -s 10.10.10.10 -j DROP
iptables -A INPUT -p tcp --dport ssh -j DROP

# Block all connections
iptables-policy INPUT DROP
iptables-policy OUTPUT DROP
iptables-policy FORWARD DROP

# Log all denied iptables rules
iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Save all current iptables rules

# Ubuntu
/etc/init.d/iptables save
/sbin/service iptables save

# RedHat / CentOS
/etc/init.d/iptables save
/sbin/iptables-save

# List all current iptables rules
iptables -L

# Flush all current iptables rules
iptables -F

# Start/Stop iptables service
service iptables start
service iptables stop

# Start/Stop ufw service:
ufw enable
ufw disable

# Start/Stop ufw logging
ufw logging on
ufw logging off

# Backup all current ufw rules
cp /lib/ufw/{user.rules,user6.rules} /<BACKUP LOCATION>
cp /lib/ufw/{user.rules,user6.rules} ./

# Example uncomplicated firewall (ufw) 
# commands (IP, IP range, Port blocks)
ufw status verbose
ufw delete <RULE#>
ufw allow for <IP ADDRESS>
ufw allow all 80/tcp
ufw allow all ssh
ufw deny from <BAD IP ADDRESS> proto udp to any port 443

Passwords

# Change password
passwd #(For current user)
passwd bob #(For user Bob)
sudo su passwd #(For root)

Host file

# Add new malicious domain to hosts file,
# and route to localhost
echo 127.0.0.1 <MALICIOUS DOMAIN> >> /etc/hosts

# Check if hosts file is working, 
# by sending ping to 127.0.0.1
ping -c 1 <MALICIOUS DOMAIN>

# Ubuntu/Debian DNS cache flush
/etc/init.d/dns-clean start

# Flush nscd DNS cache four ways
/etc/init.d/nscd restart
service nscd restart
service nscd reload
nscd -i hosts

# Flush dnsmasq DNS cache
/etc/init.d/dnsmasq restart

Allowlist

Use a Proxy Auto Config (PAC) file to create bad URL or IP List:

// Send bad DNS name to the proxy
if (dnsDomainIs(host, ",badsite.com"))
    return "PROXY http://127.0.0.1:8080";
// Send bad IPs to the proxy
if (isinNet(myipAddress(), "222.222.222.222","255.255.255.0"))
    return "PROXY http://127.0.0.1:8080";
// All other traffic bypass proxy
return "DIRECT";
}

IPSEC

# Allow firewall to pass IPSEC traffic
iptables -A INPUT -p esp -j ACCEPT
iptables -A INPUT -p ah -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT

Pass IPSEC traffic:

Install Racoon utility on <HOST1 IP ADDRESS> and <HOST2 IP ADDRESS> to enable IPSEC tunnel in Ubuntu.

apt-get install racoon

Choose direct then edit /etc/ipsec-tools.conf on <HOST1 IP ADDRESS> and <HOST2 IP ADDRESS>.

flush;
spdflush;
spdadd <HOST1 IP ADDRESS> <HOST2 IP ADDRESS> any -P out ipsec esp/transport//require;
spdadd <HOST2 IP ADDRESS> <HOST1 IP ADDRESS> any -P in ipsec esp/transport//require;

Edit /etc/racoon/racoon.conf on <HOST1 IP ADDRESS> and <HOST2 IP ADDRESS>.

log notify;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
remote anonymous {
    exchange_mode main,aggressive;
    proposal {
        encryption_algorithm aes_256;
        hash_algorithm sha256;
        authentication_method pre_shared_key;
        dh_group modp1024;
    }
    generate_policy off;
}
sainfo anonymous{
    pfs_group 2;
    encryption_algorithm aes_256;
    authentication_algorithm hmac_sha256;
    compression_algorithm deflate;
}

Add preshared key to both hosts.

On HOST1:

echo <HOST2 IP ADDRESS> <PRESHARED PASSWORD> >>/etc/racoon/psk.txt

On HOST2:

echo <HOST1 IP ADDRESS> <PRESHARED PASSWORD> >>/etc/racoon/psk.txt

Restart service on both systems: service setkey restart

Check security associations, configuration and polices:

setkey -D
setkey -DP

Windows#

Disable/stop services#

Host system firewalls#

Passwords#

Host file#

Allowlist#

Application restrictions#

IPSEC#

Active Directory (AD) - Group Policy Object (GPO)#

Stand alone system – without AD#

Linux#

Disable/stop services#

Host system firewalls#

Passwords#

Host file#

Allowlist#

IPSEC#

Windows

Disable/stop services

Host system firewalls

Passwords

Host file

Allowlist

Application restrictions

IPSEC

Active Directory (AD) - Group Policy Object (GPO)

Stand alone system – without AD

Linux

Disable/stop services

Host system firewalls

Passwords

Host file

Allowlist

IPSEC