Workaround for Windows 10 SeriousSAM vulnerability

This vulnerability can let attackers gain admin rights on vulnerable systems and execute arbitrary code with SYSTEM privileges. Affected Systems are all OS released since October 2018, starting with Windows 10 1809 and Windows Server 2019.

Restrict access to the contents of %windir%\system32\config:

1. Open Command Prompt or PowerShell as an administrator.
2. Run this command:
• Command Prompt: icacls %windir%\system32\config\*.* /inheritance:e
•  Windows PowerShell: icacls $env:windir\system32\config\*.* /inheritance:en

And deleting Volume Shadow Copies!

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934

Azure Security link collection

Hi guys,

find attached a link collection, with useful information regarding Azure Security.

• Azure Security Documentation https://docs.microsoft.com/en-us/azure/security/ 
• Azure Security Announcements https://azure.microsoft.com/en-us/blog/topics/security/ 
• Azure Security Experts Series https://www.youtube.com/playlist?list=PLLasX02E8BPA0ZNzg-BsHio7yTciN-UVu 
• Azure Blog RSS Feed https://azure.microsoft.com/blog/feed/ 
• Azure Reference Architectures https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/ 
• PDF: Azure Security Center Security Alerts Playbook https://gallery.technet.microsoft.com/Azure-Security-Center-f621a046 
• PDF: Azure Security Center Playbook: Hunting Threats https://gallery.technet.microsoft.com/Azure-Security-Center-549aa7a4 
• PDF: Azure Security Response https://gallery.technet.microsoft.com/Azure-Security-Response-in-dd18c678 
• Performance and Productivity: Your Guide to Managing Cloud Sprawl https://azure.microsoft.com/en-us/resources/your-guide-to-managing-cloud-sprawl/ 
• Microsoft Azure infographics https://azure.microsoft.com/en-us/resources/infographics/

HF

Tim

Protect your AD DNS Zones from additional deletion using Powershell

You have two types of zones, the forest and domain DNS zones.

To get Forest DNS zones that are not protected from additional deletion, you can use the following PS command (change the -Searchbase to your forest in both commands):

FOREST:
Get-ADObject -Filter 'ObjectClass -like "dnszone"' -SearchScope Subtree -SearchBase "DC=ForestDnsZones,DC=domain,DC=com" -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Select name,protectedfromaccidentaldeletion | out-gridview


To set protection use the following command:

Get-ADObject -Filter 'ObjectClass -like "dnszone"' -SearchScope Subtree -SearchBase "DC=ForestDnsZones,DC=domain,DC=com" -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Set-ADObject –ProtectedFromAccidentalDeletion $true


DOMAIN:
To get Domain DNS zones that are not protected from additional deletion, you can use the following PS command (change the -Searchbase to your domain in both commands):

Get-ADObject -Filter 'ObjectClass -like "dnszone"' -SearchScope Subtree -SearchBase "DC=DomainDnsZones,DC=subdomain,DC=domain,DC=com" -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Select name,protectedfromaccidentaldeletion | out-gridview


To set protection use the following command:

Get-ADObject -Filter 'ObjectClass -like "dnszone"' -SearchScope Subtree -SearchBase "DC=DomainDnsZones,DC=subdomain,DC=domain,DC=com" -properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $False} | Set-ADObject –ProtectedFromAccidentalDeletion $true

Protect your Windows Fileserver against Ransomware by using FSRM and Powershell

Check out my post on technet:
https://gallery.technet.microsoft.com/Protect-your-File-Server-f3722fce