Microsoft Windows Security

Reconnaissance

WEB

Understands and can identify the different types of domain trusts, including: • One-way and two-way trusts • Explicit and transitive trusts

Industry Roles:

Assessment Methods:

Can identify and analyse Service Principal Names

Industry Roles:

Assessment Methods:

Can identify and analyse internal browse lists

Industry Roles:

Assessment Methods:

Can enumerate accessible Windows shares

Industry Roles:

Assessment Methods:

Can identify forests, domains, domain controllers, domain members and work groups

Industry Roles:

Assessment Methods:

Can identify Windows hosts on a target network

Industry Roles:

Assessment Methods:

Common Windows Applications

WEB

Can identify and leverage significant vulnerabilities in common windows applications for which there is public exploit code available

Industry Roles:

Assessment Methods:

Exchange

WEB

Understands and can perform common attack vectors for Microsoft Exchange Server

Industry Roles:

Assessment Methods:

Can identify and analyse Microsoft Exchange servers

Industry Roles:

Assessment Methods:

Patch Management

WEB

Understands common windows patch management strategies, including: • SMS • SUS • WSUS

Industry Roles:

Assessment Methods:

Understands patching in air-gapped environments

Industry Roles:

Assessment Methods:

Understands OS lifecycle management

Industry Roles:

Assessment Methods:

Desktop Lockdown

WEB

Can perform privilege escalation techniques from a desktop environment

Industry Roles:

Assessment Methods:

Understands and can demonstrate techniques to break out of a locked down Windows desktop or Citrix environment

Industry Roles:

Assessment Methods:

Post Exploitation

WEB

Understands and can perform common post exploitation activities, including: • Obtaining password hashes, both from the local SAM and cached credentials • Obtaining locally stored clear-text passwords • Cracking password hashes • Obtaining patch levels• deriving a list of missing security patches • Reverting to a previous state • Lateral and horizontal movement

Industry Roles:

Assessment Methods:

Local Vulnerabilities

WEB

Demonstrate the ability to extract service credentials from LSA secrets

Industry Roles:

Assessment Methods:

Understand the difference between “Local Service”, “Network Service and “Local System”

Industry Roles:

Assessment Methods:

Understands and can demonstrate local privilege escalation techniques,e.g. through the manipulation of insecure file system or service permissions

Industry Roles:

Assessment Methods:

Understands the techniques used to develop exploit code for existing and new vulnerabilities

Industry Roles:

Assessment Methods:

Understands and can demonstrate the remote exploitation of Windows operating system and third-party software application vulnerabilities

Industry Roles:

Assessment Methods:

Understands the use of tools and techniques to identify new OS and software vulnerabilities

Industry Roles:

Assessment Methods:

Remote Vulnerabilities

WEB

Understands the techniques used to develop exploit code for existing and new vulnerabilities

Industry Roles:

Assessment Methods:

Understands and can demonstrate the remote exploitation of Windows operating system and third-party software application vulnerabilities

Industry Roles:

Assessment Methods:

Understands the use of tools and techniques to identify new OS and software vulnerabilities

Industry Roles:

Assessment Methods:

Passwords

WEB

Understands how passwords are stored and protected and can demonstrate how they can be recovered

Industry Roles:

Assessment Methods:

Understands how to avoid causing a denial of service by locking-out accounts

Industry Roles:

Assessment Methods:

Can demonstrate the recovery of password hashes when given physical access to a Windows host

Industry Roles:

Assessment Methods:

Understands Windows password hashing algorithms and their associated security attributes

Industry Roles:

Assessment Methods:

Understands the security attributes of the above protocols and technologies

Industry Roles:

Assessment Methods:

Understands password policies, including complexity requirements and lock-out

Industry Roles:

Assessment Methods:

Understands and can demonstrate off-line password cracking using dictionary and brute-force attacks, including the use of rainbow tables

Industry Roles:

Assessment Methods:

Active Directory

WEB

Can demonstrate the recovery of password hashes when given physical access to a Windows host

Industry Roles:

Assessment Methods:

Understands Active Directory roles (Global Catalogue, Master Browser, FSMO)

Industry Roles:

Assessment Methods:

Identify inappropriate or dangerous Group Policies or permissions

Industry Roles:

Assessment Methods:

Perform more advanced Kerberos attacks (golden/silver tickets/etc)

Industry Roles:

Assessment Methods:

Obtain passwords from Group Policy Preferences

Industry Roles:

Assessment Methods:

Exploit shared local administrative accounts by passing-the-hash

Industry Roles:

Assessment Methods:

Perform basic SPN/kerberoasting

Industry Roles:

Assessment Methods:

Identify inappropriate accounts or group memberships

Industry Roles:

Assessment Methods:

Understands and can demonstrate off-line password cracking using dictionary and brute-force attacks, including the use of rainbow tables

Industry Roles:

Assessment Methods:

Understands user accounts and can manipulate these accountsto gain further access to a target system, e.g. by escalating privileges from a domain user to a domain admin

Industry Roles:

Assessment Methods:

Understands Local Security Policy

Industry Roles:

Assessment Methods:

Understands Group Policy

Industry Roles:

Assessment Methods:

Understand the security weaknesses of shared local administrative accounts

Industry Roles:

Assessment Methods:

Understand difference between local and domain users

Industry Roles:

Assessment Methods:

Understands the reliance of Active Directory on DNS and LDAP

Industry Roles:

Assessment Methods:

Understands Active Directory structure

Industry Roles:

Assessment Methods:

Please wait...