mikes-hacks · July 25, 2022 18:26
diff --git a/Blue_Team_Hardening_Windows.csv b/Blue_Team_Hardening_Windows.csv
ID	Task	Command	Description
1	IP	cmd (as admin) > ipconfig	confirm good ip for dns/dhcp
2	Clear DNS Cache	ipconfig /flushdns	clear possible dns poison
3	Hosts	notepad C:\Windows\System32\drivers\etc\hosts	delete bad entries
4	View Hidden Files	Windows Explorer > View > Hidden/Ext/OS/Drives	good practice
5	DUO	duo.com > Signup > Weblogin > Install > Auth	Consider duo.com for Auth
6	Stopping Network Shares	net share /delete somebadshare	delete bad shares
7	User and Group Config	Control panel > System settings > Users and Groups
		New Admin PW, Disable Guest, Del Bad Users	This needs development
		Check/Remove bad users from Admin Group
8	Scheduled Tasks	Start > Task Scheduler > Delete All	Bad guys hide here. Delete all: schtasks /delete /tn * /f
9	Powershell	Get-PSSessionConfiguration	Hardening Powershell
		Disable-PSRemoting
		Disable-PSSessionConfiguration
		Disable-PSSessionConfiguration -Name *
10	Malwarebytes	D/L > Install > Update > Full Scan > Clean	https://www.malwarebytes.com
11	Removing Unwanted Software	Cpanel > Add Remove > Bad/Suspicious Apps	Consider Spybot for hidden uninstalls:
			https://www.fosshub.com/Spybot-Search-and-Destroy.html
12	Firewall	Leave it alone, for now	Better to relying on Network Firewall
13	Security Policy	After AD policy is setup: gpupdate /force.. Reboot
14	ELK Logging	D/L > Copy > Edit winlogbeat.yml	Install Winlogbeat for centralized logging
		Run in PowerShell: winlogbeat.exe -c winlogbeat.yml	https://www.elastic.co/downloads/beats/winlogbeat
15	Policies	Relying on AD Group policy mostly
16	Services	Disable unneeded
17	Remote Desktop	MyPc Prop > Remote > Adv > Check who can RDP
18	Automatic Updating	Ideal but we had to skip	Takes tooo long to update, when limited on time
19	Service Packs	Skip	Will take tooo long to run updates, and we are limited on time
20	Processes and Open Ports	To help monitor/kill connections (also: netstat -ano)	https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
			https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
21	Alternate Data Streams	Consider doing a scan with ADSSpy	https://www.bleepingcomputer.com/download/ads-spy/
22	Removing Programs from Startup	Run > msconfig.. Disable bad guys
23	Adding and Removing Components	CPanel > Programs > Windows Features on/off	Remove crap you don’t need: telnet, media, print, games, xps, snmp
			Look for SMB v1 .. (Eternal Blue exploit)… KEEP Powershell !!
24	Sticky Keys	CPanel > Ease of Access > Uncheck Sticky Keys	Will prevent an Exploit
25	User Account Control Configuration	Cpanel > System and Sec > Action > Change UAC	User Account Control Settings … All the way up!
26	TMP	System Props > Adv > Env Var	Check Path and Temp Folders
27	Anti-Virus	Consider installing AVG .. Full scan
28	Lockdown Legit Apps	Wordpress/Joomla.. Disable upload/extended features
		Login and disable other admin/users
		SQL - Locking down sysadmin
		MySql - mysql_secure_installation..for lockdowns
29	Disable Dump File Creation	Cpanel > System > Adv > Startup/Rec > Settings	Write Debugging Info: None
30	Creating a Restore Point	MyPC > Pro > System Prot > Config Turn On	Didnt need for Event - but good practice
31	Saved Windows Credentials	Cpanel > User Accts > Manage Creds > Delete	There should be NO saved entries here!! Windows/Web
32	Internet Options	Tools > Opt > Zones High > Clear SSL	Other things are optional here
33	Power Settings	Cpanel > System/Sec > Power > Require PW
34	Data Execution Prevention	Cpanel > Performance > Adjust Visual > DEP	Data Execution Prevention: Turn on for all except (leave empty)
35	Malicious and Outdated Drivers	Consider scanning for bad-drivers with Uniblue	Couldn’t find a good d/l for this.. Looks retired
36	Rootkit Scanning	Consider scanning for rootkits with GMER	http://www.gmer.net/
37	CCleaner	Consider running a cleanup/reg with Ccleaner	https://www.ccleaner.com
38	Microsoft Security Baseline Analyzer	Microsoft Baseline Security Analyzer 2.1.1 (2k-2k8r)	https://www.microsoft.com/en-us/download/details.aspx?id=19892
		Microsoft Baseline Security Analyzer 2.3	https://www.techspot.com/downloads/3886-microsoft-baseline-security-analyzer.html