diff --git a/README.md b/README.md index 60a8d00..2da97be 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ My curated list of awesome links, resources and tools - [Awesome](#awesome) - [Anti Forensics](#anti-forensics) - [Certifications](#certifications) + - [Digital Forensics and Incident Response](#digital-forensics-and-incident-response) - [Exploitation](#exploitation) - [Malware Analysis](#malware-analysis) - [Reverse Engineering](#reverse-engineering) @@ -52,6 +53,11 @@ My curated list of awesome links, resources and tools - [Offensive Security Certified Professional (OSCP) Review](https://www.jimwilbur.com/2017/07/oscp-review/) - [OSCP Course & Exam Preparation](https://411hall.github.io/OSCP-Preparation/) +### Digital Forensics and Incident Response + +- [Windows Privileged Access Reference](https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#ATLT_BM) + - Mirror copy of the table is available at [files/dfir/windows-privileged-access.md](files/dfir/windows-privileged-access.md) + ### Exploitation #### Software Exploitation diff --git a/files/dfir/windows-privileged-access-reference.md b/files/dfir/windows-privileged-access-reference.md new file mode 100644 index 0000000..9e8f62f --- /dev/null +++ b/files/dfir/windows-privileged-access-reference.md @@ -0,0 +1,183 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ConnectionmethodLogon typeReusable credentials on destinationComments
Log on at consoleInteractivevIncludes hardware remote access / lights-out cards and network KVMs.
RUNASInteractivev
RUNAS /NETWORKNewCredentialsvClones current LSA session for local access, but uses new credentials when connecting to network resources.
Remote Desktop (success)RemoteInteractivevIf the remote desktop client is configured to share local devices and resources, those may be compromised as well.
Remote Desktop (failure - logon type was denied)RemoteInteractive-By default, if RDP logon fails credentials are only stored very briefly. This may not be the case if the computer is compromised.
Net use * \\SERVERNetwork-
Net use * \\SERVER /u:userNetwork-
MMC snap-ins to remote computerNetwork-Example: Computer Management, Event Viewer, Device Manager, Services
PowerShell WinRMNetwork-Example: Enter-PSSession server
PowerShell WinRM with CredSSPNetworkClearTextvNew-PSSession server-Authentication Credssp-Credential cred
PsExec without explicit credsNetwork-Example: PsExec \\server cmd
PsExec with explicit credsNetwork + InteractivevPsExec \\server -u user -p pwd cmdCreates multiple logon sessions.
Remote RegistryNetwork-
Remote Desktop GatewayNetwork-Authenticating to Remote Desktop Gateway.
Scheduled taskBatchvPassword will also be saved as LSA secret on disk.
Run tools as a serviceServicevPassword will also be saved as LSA secret on disk.
Vulnerability scannersNetwork-Most scanners default to using network logons, though some vendors may implement non-network logons and introduce more credential theft risk.
IIS "Basic Authentication"NetworkCleartext(IIS 6.0+)Interactive(prior to IIS 6.0)v
IIS "Integrated Windows Authentication"Network-NTLM and Kerberos Providers.
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Logon type#Authenticators acceptedReusable credentials in LSA sessionExamples
Interactive (a.k.a., Logon locally)2Password, Smartcard,otherYesConsole logon;RUNAS;Hardware remote control solutions (such as Network KVM or Remote Access / Lights-Out Card in server)IIS Basic Auth (before IIS 6.0)
Network3Password,NT Hash,Kerberos ticketNo (except if delegation is enabled, then Kerberos tickets present)NET USE;RPC calls;Remote registry;IIS integrated Windows auth;SQL Windows auth;
Batch4Password (usually stored as LSA secret)YesScheduled tasks
Service5Password (usually stored as LSA secret)YesWindows services
NetworkCleartext8PasswordYesIIS Basic Auth (IIS 6.0 and newer);Windows PowerShell with CredSSP
NewCredentials9PasswordYesRUNAS /NETWORK
RemoteInteractive10Password, Smartcard,otherYesRemote Desktop (formerly known as "Terminal Services")
+ +