Windows Security Reconnaissance

Host Security Solutions

1. Antivirus (AV) Enumeration

Check AutoLogon credentials (registry — quick win):

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select DefaultUserName, DefaultPassword, AutoAdminLogon

wmic (built-in, works on workstations):

wmic /namespace:\\root\securitycenter2 path antivirusproduct

PowerShell (alternative):

Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct

⚠️ Windows Server poate să nu aibă namespace-ul SecurityCenter2. Merge doar pe workstations.

---

2. Windows Defender

Check service state:

Get-Service WinDefend

Check protection status:

Get-MpComputerStatus | select RealTimeProtectionEnabled

MS Defender modes:
| Mode | Description |
|---|---|
| Active | Primary AV — provides protection & remediation |
| Passive | Secondary AV (when 3rd party AV installed) — scans only, no remediation |
| Disabled | Uninstalled or turned off |

---

3. Host-based Firewall

Check profile status:

Get-NetFirewallProfile | Format-Table Name, Enabled

Disable all profiles (admin req.):

Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled False

List firewall rules:

Get-NetFirewallRule | select DisplayName, Enabled, Description

Test inbound connection:

Test-NetConnection -ComputerName 127.0.0.1 -Port 80
(New-Object System.Net.Sockets.TcpClient("127.0.0.1", "80")).Connected

---

4. Detection Techniques (AV)

Technique	How it works
Signature-based	Compară fișierul cu baza de semnături cunoscute
Heuristic-based	ML + analiză statică a codului (API calls neobișnuite)
Behavior-based	Monitorizează execuția — registry, procese, etc.

---

5. Security Event Logging & Monitoring

List available event logs

Get-EventLog -List

Lista de event logs poate dezvălui ce servicii sînt instalate (AD, DNS, etc.).

---

6. Sysmon (System Monitor)

Sysmon e un driver + service din Sysinternals, nu e instalat by default. Loghează:
- Process creation / termination
- Network connections
- File modifications
- Remote threats
- Process & memory access

Detect Sysmon

ByName (process):

Get-Process | Where-Object { $_.ProcessName -eq "Sysmon" }

By service:

Get-CimInstance win32_service -Filter "Description = 'System Monitor service'"
Get-Service | where-object {$_.DisplayName -like "*sysm*"}

By registry:

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational

Find Sysmon config file (if readable)

findstr /si '<ProcessCreate onmatch="exclude">' C:\tools\*

---

7. HIDS / HIPS

Type	Function
HIDS (Host-based Intrusion Detection System)	Monitorizează și detectează activități anormale / malicioase. Nu previne activ — doar detectează.
HIPS (Host-based Intrusion Prevention System)	Detectează și previne atacuri. Audit logs, monitorizare procese, protecție resurse.

Detection methods:
- Signature-based IDS — checksum-uri, autenticitate mesaje
- Anomaly-based IDS — comportament neobișnuit (bandwidth, protocoale, porturi)

---

8. Endpoint Detection & Response (EDR)

EDR e next-gen AV. Detectează în timp real:
- Malware (virus, trojan, adware, keylogger)
- Exploit chains
- Ransomware

Common EDR solutions

Product
Cylance
CrowdStrike
Symantec
SentinelOne

EDR Enumeration Tools

# Invoke-EDRChecker — https://github.com/PwnDexter/Invoke-EDRChecker
# SharpEDRChecker — https://github.com/PwnDexter/SharpEDRChecker

Verifică: metadate fișiere, procese, DLL-uri încărcate, servicii, drivere, directoare.

⚠️ Chiar dacă ai payload bypass la EDR, EDR încă rulează și monitorizează. Poate bloca acțiuni ulterioare.