Dredge

Detailed View

MEDIUM DR-AD-001 — Active Directory: Kerberoastable Accounts

Description: {...} user account(s) have Service Principal Names (SPNs) set, making them vulnerable to Kerberoasting attacks. An attacker with any domain user credential can request TGS tickets for these accounts and crack them offline.

Impact: Kerberoasting allows any authenticated domain user to request service tickets for SPN-bearing accounts and attempt offline password cracking. If the account password is weak, the attacker obtains the cleartext credential. Privileged service accounts (e.g., SQL service accounts in Domain Admins) are especially high-value targets.

Remediation: Set strong, complex passwords (25+ characters) on all accounts with SPNs. Migrate service accounts to Group Managed Service Accounts (gMSA) which rotate passwords automatically. Remove unnecessary SPNs. Monitor for anomalous TGS-REQ activity (Event ID 4769).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1558.003 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 8.3.1, 8.3.6

HIGH DR-AD-002 — Active Directory: AS-REP Roastable Accounts

Description: {...} account(s) have Kerberos pre-authentication disabled (DONT_REQUIRE_PREAUTH flag). These accounts are vulnerable to AS-REP roasting, allowing offline password cracking without any prior authentication.

Impact: AS-REP roasting is more dangerous than Kerberoasting because it does not require any valid domain credentials to execute. An attacker can request encrypted AS-REP messages for these accounts from outside the domain and crack them offline. This is a common initial access technique in Active Directory attacks.

Remediation: Enable Kerberos pre-authentication on all accounts: clear the 'Do not require Kerberos preauthentication' checkbox in account properties. No legitimate scenario requires this flag for standard user accounts. Audit accounts regularly for this flag. Monitor for anomalous AS-REQ traffic (Event ID 4768 with pre-auth type 0).

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1558.004 (Credential Access)

NIST 800-53: IA-2, IA-5

PCI DSS 4: 8.3.1, 8.3.6

HIGH DR-AD-003 — Active Directory: Unconstrained Delegation

Description: {...} non-domain-controller account(s) are configured for unconstrained Kerberos delegation. These systems can impersonate any user that authenticates to them, including domain administrators.

Impact: Unconstrained delegation allows a compromised server to reuse any user's Kerberos TGT that was forwarded during authentication. An attacker who compromises a server with unconstrained delegation can capture domain admin TGTs and use them to fully compromise the domain. This is a critical privilege escalation path in Active Directory environments.

Remediation: Replace unconstrained delegation with constrained delegation or resource-based constrained delegation (RBCD). Add privileged accounts to the Protected Users group or mark them as 'Account is sensitive and cannot be delegated'. Only Domain Controllers should have unconstrained delegation.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1558 (Credential Access), T1550.003 (Lateral Movement)

NIST 800-53: AC-6, AC-17

PCI DSS 4: 7.1.1, 7.2.1

HIGH DR-AD-004 — Policy: Weak Domain Password Policy

Description: The domain password policy does not meet security best practices. Minimum password length, complexity requirements, or password history may be insufficient, allowing users to set weak or commonly guessed passwords.

Impact: A weak domain password policy applies to all domain user accounts. Short passwords without complexity requirements can be cracked rapidly via offline attacks against NTDS.dit or captured hashes. The domain password policy is the single most impactful password control in the environment.

Remediation: Increase minimum password length to 12+ characters (14+ for privileged accounts). Enable complexity requirements. Set maximum password age to 60-90 days. Enforce at least 12 passwords of history. Deploy Fine-Grained Password Policies (PSOs) for privileged tiers. Implement Azure AD Password Protection for banned password lists.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1110 (Credential Access), T1110.001 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 8.3.6

MEDIUM DR-AD-005 — Active Directory: LDAP Signing Not Enforced

Description: LDAP signing is set to '{...}' instead of 'Require signing'. This allows LDAP traffic to be transmitted unsigned, enabling man-in-the-middle attacks.

Impact: Without enforced LDAP signing, an attacker can perform LDAP relay attacks, intercepting and modifying LDAP queries and responses. This can be used to escalate privileges, modify group memberships, or reset passwords via LDAP relay combined with NTLM relay techniques (e.g., ntlmrelayx).

Remediation: Set 'Domain controller: LDAP server signing requirements' to 'Require signing' via Group Policy. Also enable LDAP channel binding. Test thoroughly before enforcement as it may break legacy applications using simple LDAP binds.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8, SC-23

PCI DSS 4: 4.2.1, 4.2.2

MEDIUM DR-AD-006 — Authentication: Kerberos DES Encryption Enabled

Description: The domain supports weak Kerberos encryption types: {...}. DES and RC4 are cryptographically broken and should not be used for Kerberos authentication.

Impact: DES-encrypted Kerberos tickets can be cracked trivially. RC4-HMAC (NTLM-based) is vulnerable to Kerberoasting offline cracking and overpass-the-hash attacks. Allowing weak encryption types downgrades the security of the entire Kerberos infrastructure.

Remediation: Disable DES and RC4 encryption types in the domain. Set msDS-SupportedEncryptionTypes to support only AES128 (0x08) and AES256 (0x10). Test thoroughly — legacy systems (especially pre-2008 R2) may require RC4. Migrate legacy systems before disabling.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1558 (Credential Access)

NIST 800-53: SC-12, SC-13

PCI DSS 4: 2.2.7, 4.2.1

MEDIUM DR-AD-008 — Active Directory: RBCD Configured

Description: {...} account(s) have Resource-Based Constrained Delegation configured (msDS-AllowedToActOnBehalfOfOtherIdentity). RBCD allows specified principals to impersonate users to the target service.

Impact: RBCD is a common privilege escalation vector. If an attacker can write to the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of a target (via WRITE permission on the computer object), they can configure RBCD to impersonate any user (including Domain Admin) to that target's services. This is the basis of the RBCD/S4U2Self/S4U2Proxy attack chain.

Remediation: Review all RBCD configurations for legitimacy. Ensure that only authorized principals have WRITE access to computer objects' msDS-AllowedToActOnBehalfOfOtherIdentity attribute. Monitor changes to this attribute via Event ID 5136. Remove unnecessary RBCD configurations.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1558 (Credential Access), T1134.001 (Privilege Escalation)

NIST 800-53: AC-6, AC-17

PCI DSS 4: 7.1.1, 7.2.1

MEDIUM DR-AD-009 — Active Directory: Domain Functional Level Outdated

Description: The Active Directory domain or forest functional level is below the current recommended level for the installed domain controller OS version. Outdated functional levels prevent the use of modern security features such as Protected Users group, Authentication Policies, and Kerberos armoring.

Impact: Outdated functional levels prevent the use of modern Active Directory security features including: Protected Users group (2012 R2+), Authentication Policies and Silos (2012 R2+), gMSA improvements, Kerberos armoring (FAST), and AES-only Kerberos enforcement. Older levels also correspond to operating systems that may be end-of-life.

Remediation: Raise the domain and forest functional levels after ensuring all Domain Controllers are running a supported Windows Server version. This is a one-way operation — test in a lab environment first. Target at minimum Windows Server 2016 functional level.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

NIST 800-53: SA-22, CM-6

PCI DSS 4: 6.3.2, 2.2.1

LOW DR-AD-010 — Active Directory: AdminSDHolder Orphaned Accounts

Description: {...} account(s) have AdminCount=1 set but are not current members of any privileged group. These are orphaned AdminSDHolder protections from former privilege.

Impact: Orphaned AdminSDHolder flags indicate accounts that were previously in privileged groups. The AdminCount flag persists after removal, and the AdminSDHolder ACL propagation may have left non-standard permissions. Attackers target these accounts as they may retain residual privileges or weaker ACLs.

Remediation: Clear the AdminCount attribute on accounts no longer in privileged groups. Reset the ACL on these accounts to inherit from the parent OU. Use the AdminSDHolder cleanup script to automate this process. Monitor AdminCount changes with Event ID 5136.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A01:2021 - Broken Access Control

NIST 800-53: AC-6

PCI DSS 4: 7.1.1, 7.2.1

HIGH DR-AD-011 — Active Directory: LAPS Not Deployed

Description: Local Administrator Password Solution (LAPS) is not deployed on this system or in the domain. Without LAPS, local administrator passwords are typically identical across all machines in the domain, or are never rotated, or both.

Impact: Shared local administrator passwords are the single most common lateral movement enabler in Active Directory environments. If one machine is compromised and its local admin password is recovered (via SAM dump, mimikatz, or other means), the same password grants admin access to every other machine in the domain. LAPS solves this by setting a unique, randomly generated password on each machine and rotating it automatically.

Remediation: Deploy LAPS (or Windows LAPS in Server 2025/Windows 11). Steps: 1) Extend the AD schema for LAPS attributes (ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime or Windows LAPS equivalents), 2) Install the LAPS CSE (Client-Side Extension) via GPO or SCCM, 3) Configure the LAPS GPO with password complexity, length (14+ chars), and age (30 days), 4) Set ACLs on the OU to restrict who can read the LAPS password (authorized helpdesk/admin groups only).

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1078.002 (Persistence)

NIST 800-53: IA-5, AC-2, CM-6

PCI DSS 4: 8.3.1, 8.3.5, 8.3.6

MEDIUM DR-AD-012 — Active Directory: krbtgt Key Not Rotated

Description: The krbtgt account password has not been changed in an extended period (typically 180+ days). The krbtgt account is used to encrypt all Kerberos Ticket Granting Tickets (TGTs) in the domain. If its key material is compromised, an attacker can forge Golden Tickets.

Impact: A compromised krbtgt key enables Golden Ticket attacks, granting the attacker unrestricted access to any resource in the domain for the lifetime of the key. Kerberos maintains two most-recent krbtgt key versions — rotating the password invalidates the oldest one. Microsoft recommends rotating the krbtgt password at least every 180 days, and immediately after any suspected domain compromise.

Remediation: Rotate the krbtgt password using the Microsoft krbtgt reset script or manually via PowerShell (Reset-KrbtgtPassword). IMPORTANT: The krbtgt password must be reset TWICE (with a sufficient interval between resets, at least equal to the maximum ticket lifetime — typically 10 hours) to invalidate all existing TGTs. Schedule regular rotation every 180 days. After a suspected compromise, reset immediately (twice).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1558.001 (Credential Access)

NIST 800-53: IA-5, SC-12

PCI DSS 4: 8.3.5, 8.3.9

CISA KEV

LOW DR-AD-013 — Account Management: Stale Domain Accounts

Description: Domain user accounts were found that have not logged in for an extended period (90+ days) and are still enabled. Stale accounts represent dormant attack surface that attackers can target without triggering alerts tied to active users.

Impact: Stale accounts are attractive targets for attackers because their compromise is less likely to be noticed — no legitimate user will report unexpected activity. These accounts may retain their original (potentially weak) passwords, group memberships, and access permissions. If any stale account has privileged access, it presents an unmonitored path to escalation.

Remediation: Implement a regular account review process (at least quarterly). Disable accounts inactive for 90+ days. Delete accounts inactive for 180+ days after confirming they are no longer needed. Automate with PowerShell: Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | Disable-ADAccount. Audit disabled accounts for sensitive group memberships before deletion.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1078.002 (Defense Evasion)

NIST 800-53: AC-2, AC-2(3)

PCI DSS 4: 8.1.4, 8.2.5

MEDIUM DR-AD-014 — Active Directory: SID History Abuse Risk

Description: User or group accounts with non-empty SID History attributes were found. SID History is a legitimate migration feature that preserves access to resources in a source domain after migration. However, SID History can be abused to inject arbitrary SIDs (including Domain Admins) into a user's token.

Impact: An attacker who can modify the SID History attribute can inject the SID of a privileged group (e.g., Domain Admins, Enterprise Admins) into their own or another account's SID History. The injected SID is included in the user's Kerberos tickets and PAC, granting access to all resources the injected SID has permission to. This is a stealthy persistence technique because the user's group memberships appear normal.

Remediation: Audit all accounts with SID History: Get-ADUser -Filter 'SIDHistory -like "*"' -Properties SIDHistory | Select Name,SIDHistory. Remove SID History entries after domain migration is complete and verified: Set-ADUser -Identity <user> -Remove @{SIDHistory=<SID>}. Enable SID filtering on all trusts to prevent cross-domain SID History abuse. Monitor Event ID 4765 (SID History added) and Event ID 4766 (SID History add attempt failed).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1134.005 (Defense Evasion)

NIST 800-53: AC-6, AU-6, SI-4

PCI DSS 4: 7.1.1, 10.6.1

CRITICAL DR-ADCS-001 — ADCS: ESC1 - Misconfigured Certificate Template

Description: A certificate template allows enrollees to specify a Subject Alternative Name (SAN) in the certificate request, AND low-privileged users can enroll, AND the template has an EKU that permits authentication (Client Authentication, PKINIT, Smart Card Logon, or any purpose). This is the ESC1 attack vector identified by SpecterOps.

Impact: Any low-privileged domain user can request a certificate with an arbitrary SAN (e.g., specifying a Domain Admin UPN). This certificate can then be used for Kerberos authentication as the impersonated user, achieving complete domain compromise without needing to know the target user's password. This is the most commonly exploited ADCS vulnerability.

Remediation: Disable 'Supply in the request' option on the Subject Name tab of vulnerable certificate templates. Instead, configure 'Build from Active Directory information'. Restrict enrollment permissions to only the users/groups that require the template. Remove unnecessary EKUs (especially 'Any Purpose'). Consider removing the template entirely if not operationally required. Audit with: certutil -v -template | findstr /i 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT'.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1649 (Credential Access)

NIST 800-53: IA-5, AC-6, SC-17

PCI DSS 4: 4.2.1, 7.1.1, 8.3.1

CISA KEV

HIGH DR-ADCS-002 — ADCS: ESC2 - Overly Permissive Template

Description: A certificate template has an Extended Key Usage (EKU) of 'Any Purpose' (OID 2.5.29.37.0) or no EKU at all (which is equivalent to any purpose), AND low-privileged users can enroll. Certificates with Any Purpose or no EKU restrictions can be used for any purpose including client authentication, code signing, and subordinate CA issuance.

Impact: A certificate with 'Any Purpose' or no EKU can be used for client authentication (impersonating any user), code signing (creating trusted malicious software), or even as a subordinate CA certificate (issuing arbitrary certificates). The combination of unrestricted EKU and broad enrollment permissions creates a powerful attack vector for domain compromise.

Remediation: Replace 'Any Purpose' EKU with specific, required EKUs only (e.g., Client Authentication only if that is the purpose). Remove templates with no EKU unless operationally justified. Restrict enrollment permissions to the minimum required groups. Audit all templates for overly broad EKU settings using certipy or Certutil.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1649 (Credential Access)

NIST 800-53: AC-6, SC-17, CM-6

PCI DSS 4: 4.2.1, 7.1.1

HIGH DR-ADCS-003 — ADCS: ESC3 - Enrollment Agent Template

Description: A certificate template with the Certificate Request Agent EKU (OID 1.3.6.1.4.1.311.20.2.1) allows low-privileged users to enroll. An Enrollment Agent certificate enables the holder to request certificates on behalf of other users, including privileged accounts.

Impact: An attacker can first obtain an Enrollment Agent certificate, then use it to request certificates for any other user in the domain (e.g., Domain Admins) using a second template that allows enrollment by enrollment agents. This two-step attack achieves domain compromise by impersonating any user via certificate-based authentication.

Remediation: Restrict enrollment permissions on Enrollment Agent templates to only authorized Certificate Enrollment administrators. Configure enrollment restrictions on the CA: right-click CA > Properties > Enrollment Agents tab to restrict which enrollment agents can enroll for which templates and users. Consider disabling the Enrollment Agent template if not operationally required.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1649 (Credential Access)

NIST 800-53: AC-6, SC-17, IA-5

PCI DSS 4: 7.1.1, 8.3.1

HIGH DR-ADCS-004 — ADCS: ESC4 - Vulnerable Template ACL

Description: A certificate template's access control list (ACL) grants write permissions (WriteDACL, WriteOwner, WriteProperty, or GenericWrite) to low-privileged users or groups. This allows an attacker to modify the template configuration to introduce ESC1-ESC3 conditions.

Impact: An attacker with write access to a certificate template can modify it to enable ESC1 (add CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT), change EKUs to 'Any Purpose', or enable enrollment for their own account. After modification, they exploit the newly created ESC1/ESC2/ESC3 condition for domain compromise. The template modification itself may go unnoticed without specific ADCS auditing.

Remediation: Audit all certificate template ACLs and remove write permissions for non-administrative groups. Only Enterprise Admins, Domain Admins, and designated PKI administrators should have write access to templates. Use: certutil -v -template | Select-String 'Allow.*Write'. Review and tighten ACLs via certtmpl.msc. Enable ADCS auditing to detect template modifications.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1649 (Credential Access)

NIST 800-53: AC-3, AC-6, CM-5

PCI DSS 4: 7.1.1, 7.2.1

CRITICAL DR-ADCS-005 — ADCS: ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2

Description: The Certificate Authority has the EDITF_ATTRIBUTESUBJECTALTNAME2 flag enabled. This CA-level configuration allows ANY certificate requester to specify an arbitrary Subject Alternative Name (SAN) in their request, regardless of template settings. This effectively makes every authentication template on this CA vulnerable to ESC1.

Impact: With this flag enabled, any domain user who can enroll in any template with an authentication EKU can specify an arbitrary SAN, impersonating any user in the domain including Domain Admins. This is a CA-wide misconfiguration that bypasses per-template SAN controls — fixing individual templates does not mitigate this issue. A single CA with this flag compromises the entire domain.

Remediation: Disable the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the CA: certutil -config "CA\CAName" -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2. Restart the CA service: net stop certsvc && net start certsvc. Verify: certutil -config "CA\CAName" -getreg policy\EditFlags — the output should NOT include EDITF_ATTRIBUTESUBJECTALTNAME2. After disabling, audit all recently issued certificates for suspicious SAN values.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1649 (Credential Access)

NIST 800-53: IA-5, AC-6, SC-17, CM-6

PCI DSS 4: 4.2.1, 7.1.1

HIGH DR-ADCS-006 — ADCS: ESC8 - NTLM Relay to HTTP Enrollment

Description: The AD Certificate Services web enrollment endpoint is accessible over HTTP (not HTTPS) and/or does not enforce Extended Protection for Authentication (EPA). This allows NTLM relay attacks where a coerced machine account authentication (e.g., via PetitPotam, PrinterBug) can be relayed to the enrollment endpoint to request a certificate as the machine.

Impact: An attacker can coerce a domain controller to authenticate to their machine (using PetitPotam, PrinterBug, or similar), then relay that authentication to the ADCS HTTP enrollment endpoint to obtain a certificate as the DC's machine account. This certificate allows the attacker to authenticate as the DC, enabling DCSync to extract all domain credentials. This is a full domain compromise path.

Remediation: Enable HTTPS on all ADCS web enrollment endpoints and disable HTTP. Enable Extended Protection for Authentication (EPA) in IIS: IIS Manager > Authentication > Windows Authentication > Advanced Settings > Extended Protection = Required. Alternatively, disable the web enrollment role entirely if not required and use certreq or autoenrollment instead. Install patches for PetitPotam (CVE-2021-36942). Enable NTLM relay mitigations: enable SMB signing, LDAP signing, and channel binding.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1187 (Credential Access), T1557.001 (Credential Access)

NIST 800-53: IA-2, SC-8, SC-23

PCI DSS 4: 4.2.1, 8.3.1

CISA KEV

HIGH DR-BRW-001 — Browser: Malicious Extension Detected ({browser})

Description: One or more browser extensions match known malicious extensions in the threat intelligence database. These extensions may be stealing credentials, injecting ads, or exfiltrating browsing data.

Impact: Malicious browser extensions can intercept all web traffic including passwords, session tokens, banking credentials, and form data. They can inject content into pages, redirect searches, cryptomine, and exfiltrate browsing history. They persist across browser restarts and are often difficult for users to identify.

Remediation: Remove the malicious extension(s) immediately. Check other browsers on the system for the same extensions. Review browsing history for credential exposure. Force password resets for any accounts accessed while the extension was installed. Deploy browser extension whitelisting via Group Policy.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 - Vulnerable and Outdated Components

MITRE ATT&CK: T1176 (Persistence)

NIST 800-53: SI-3, CM-7

PCI DSS 4: 5.2.1

MEDIUM DR-BRW-002 — Browser: Proxy Configured ({browser})

Description: A browser-level proxy configuration was detected, separate from system proxy settings. This proxy intercepts all browser traffic and may route it through an unintended intermediary.

Impact: A browser-level proxy can intercept all HTTP/HTTPS traffic from the browser, including login credentials, session tokens, and sensitive data. Browser-level proxies may bypass system proxy settings, making them harder to detect. If the proxy is malicious, it enables credential theft and traffic manipulation.

Remediation: Verify the proxy configuration is authorized and expected. Compare with system proxy settings. If a browser-specific proxy is not required, remove it. Investigate whether malware or a malicious extension configured the proxy.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1090 (Command and Control)

NIST 800-53: CM-11, SI-3

PCI DSS 4: 6.3.2

MEDIUM DR-BRW-003 — Browser: Suspicious Bookmark Detected ({browser})

Description: One or more browser bookmarks link to domains or IPs associated with known malicious infrastructure in the threat intelligence database.

Impact: Bookmarks to malicious domains may indicate the user regularly visits compromised or phishing sites. This could be a watering hole attack vector, a phishing landing page saved by a targeted user, or a bookmark planted by malware for persistence or redirection.

Remediation: Investigate each suspicious bookmark. Check if the user intentionally saved it or if it was created by malware. Review browser history for visits to the bookmarked URLs. Remove the bookmarks and block the domains at the DNS/proxy level. Scan the system for malware.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1189 (Initial Access)

NIST 800-53: SI-3, SC-7

PCI DSS 4: 6.3.3

MEDIUM DR-CERT-001 — Certificate: Expired Certificate

Description: One or more certificates in the local machine or current user certificate store have expired.

Impact: Expired certificates cause service disruptions, authentication failures, and trust warnings. They may also indicate neglected systems or processes. Expired certificates used for code signing or SSL/TLS expose users to man-in-the-middle and substitution attacks.

Remediation: Renew or replace all expired certificates. Remove expired certificates that are no longer needed. Implement certificate lifecycle management with automated renewal alerts at 30, 14, and 7 days before expiry.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

OWASP Web: A02:2021 - Cryptographic Failures

NIST 800-53: SC-17

PCI DSS 4: 4.2.1

MEDIUM DR-CERT-002 — Certificate: Expiring Soon

Description: One or more certificates will expire within the next 30 days.

Impact: Certificates expiring soon risk service disruptions if not renewed in time. SSL/TLS certificate expiry causes browser warnings and connection failures. Authentication certificate expiry can lock out users.

Remediation: Renew expiring certificates before their expiry date. Use automated certificate management tools (ACME, internal CA auto-enrollment) where possible. Verify new certificates are properly installed and tested before the old ones expire.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

OWASP Web: A02:2021 - Cryptographic Failures

NIST 800-53: SC-17

PCI DSS 4: 4.2.1

MEDIUM DR-CERT-003 — Certificate: Self-Signed in Trust Store

Description: Certificates using deprecated signature algorithms (SHA1) or insufficient key lengths (RSA < 2048 bits) were detected.

Impact: SHA1 signatures are vulnerable to collision attacks, enabling certificate forgery. RSA keys shorter than 2048 bits can be factored with sufficient computational resources, compromising the certificate's security.

Remediation: Replace weak certificates with ones using SHA-256 or stronger signature algorithms and RSA 2048-bit or longer keys (or ECDSA P-256+). Update internal CA templates to enforce modern cryptographic standards.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1553.004 (Defense Evasion)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

MEDIUM DR-CERT-004 — Certificate: Weak Signature Algorithm

Description: A self-signed certificate that is not from a well-known Certificate Authority was found in the Trusted Root Certification Authorities store.

Impact: Unknown root certificates in the trusted store could enable man-in-the-middle attacks by allowing an attacker's CA to issue trusted certificates for any domain. This could be from legitimate enterprise CA deployment or from malware installing rogue roots.

Remediation: Review all non-standard root certificates. Verify each against the organization's internal CA infrastructure. Remove any certificates that cannot be accounted for. If a rogue root is found, investigate how it was installed and treat the system as potentially compromised.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1553.004 (Defense Evasion)

NIST 800-53: SC-13

PCI DSS 4: 4.2.1

MEDIUM DR-CERT-005 — Certificate: Weak Key Size

Description: A certificate using a key size shorter than 2048 bits was detected. Keys shorter than 2048 bits are considered weak and can be factored with modern computing resources, compromising all protections the certificate provides.

Impact: A weak key can be factored using distributed computing or cloud resources. 1024-bit RSA keys have been publicly factored, and NIST deprecated keys shorter than 2048 bits since 2013. An attacker who factors the key can forge signatures, decrypt traffic, and impersonate the certificate holder.

Remediation: Replace the certificate with one using at least a 2048-bit RSA key (3072-bit or 4096-bit recommended for long-lived certificates). For new deployments, consider ECDSA P-256 or P-384 keys which provide equivalent security at smaller sizes. Update the certificate on all services and endpoints.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

NIST 800-53: SC-12, SC-13

PCI DSS 4: 4.2.1

MEDIUM DR-CMP-001 — Firewall: Profile Disabled

Description: One or more Windows Firewall profiles (Domain, Private, or Public) are disabled, leaving network traffic unfiltered for those network types.

Impact: With a firewall profile disabled, the system accepts all inbound connections on that network type, exposing services and ports that should be restricted. Attackers on the same network can directly reach services without firewall filtering.

Remediation: Develop a system hardening plan based on the CIS Benchmark for the specific Windows version. Prioritize Level 1 controls first as they have minimal operational impact. Implement changes through Group Policy for consistent deployment across endpoints.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1562.004 (Defense Evasion)

NIST 800-53: SC-7

PCI DSS 4: 1.4.1

MEDIUM DR-CMP-002 — Policy: Screen Lock Timeout Not Configured

Description: The screen lock timeout (ScreenSaverGracePeriod or equivalent) is not configured or is set to a value greater than 15 minutes, allowing unattended sessions to remain accessible.

Impact: Unattended workstations without automatic screen lock allow physical attackers to access active sessions with the authenticated user's full privileges, including domain credentials and cached tokens.

Remediation: Address the specific failing CIS controls, prioritizing those related to authentication, access control, and network security. Focus on Level 1 controls that have not been implemented. Use Group Policy to enforce configurations across the organization.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: AC-11

PCI DSS 4: 8.2.8

HIGH DR-CMP-003 — Network Hardening: NetBIOS over TCP/IP Enabled

Description: NetBIOS over TCP/IP (NBT) is enabled on one or more network interfaces, exposing the legacy name resolution and session services on ports 137-139.

Impact: NetBIOS enables name-squatting, NBNS poisoning, and session enumeration. Attackers on the local network can intercept name resolution queries to redirect traffic, harvest credentials via NTLM relay, and enumerate shares, users, and sessions.

Remediation: Remediate all DISA STIG Category I findings immediately. These represent the highest priority security issues. Apply STIG fixes via Group Policy or SCAP compliance tools. Document any findings requiring a Plan of Action and Milestones (POA&M) if immediate remediation is not possible.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1557.001 (Credential Access)

NIST 800-53: CM-7, SC-7

PCI DSS 4: 2.2.1

MEDIUM DR-CMP-004 — Network Hardening: IPv6 Transition Technologies

Description: IPv6 transition technologies (Teredo, ISATAP, 6to4) are enabled, creating encapsulated IPv6-over-IPv4 tunnels that may bypass network security controls.

Impact: IPv6 transition protocols can tunnel traffic past IPv4-only firewalls and IDS/IPS systems. Attackers can use these tunnels for covert command-and-control channels or to bypass network segmentation. Teredo in particular operates over UDP and can traverse NAT.

Remediation: Plan remediation of DISA STIG Category II findings within 90 days. Prioritize those related to authentication and access control. Apply STIG fixes via Group Policy where possible for consistent deployment.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1572 (Command and Control)

NIST 800-53: CM-7, SC-7

PCI DSS 4: 2.2.1

MEDIUM DR-CMP-005 — Service Hardening: Remote Registry Enabled

Description: The Remote Registry service (RemoteRegistry) is enabled and/or running, allowing remote systems to read and modify the local Windows registry.

Impact: Remote Registry access enables attackers with valid credentials to remotely query and modify registry keys for reconnaissance, persistence, and configuration changes. Attackers can read stored credentials, enumerate installed software, and plant persistence mechanisms without interactive logon.

Remediation: Use the hardening score as a baseline measurement and track improvements over time. Prioritize remediation of findings that contribute most to the score deficit. Establish a target hardening score and implement a continuous improvement program.

Effort: Easy

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1012 (Discovery)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 11.3.1

MEDIUM DR-CRED-001 — Credential Exposure: WiFi Passwords in Cleartext

Description: Wireless network profiles on this system store passwords in cleartext. The 'netsh wlan show profiles key=clear' command can extract these credentials without elevated privileges on some Windows versions, or with local admin on others.

Impact: An attacker with local access can extract stored WiFi passwords for all previously connected networks. These credentials may grant access to corporate wireless networks, enabling lateral movement or unauthorized network access from outside the physical premises.

Remediation: Configure WiFi profiles to not store passwords locally where possible. Use 802.1X/EAP certificate-based authentication instead of PSK. For WPA2-Personal/WPA3-Personal networks, limit local admin access and implement endpoint detection for credential harvesting tools. Remove saved profiles for networks no longer in use.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: IA-5, SC-28

PCI DSS 4: 8.3.1, 8.3.2

MEDIUM DR-CRED-002 — Credential Exposure: Saved Remote Sessions

Description: Saved remote access session configurations were found on this system, potentially containing stored credentials. This includes PuTTY sessions (registry), WinSCP sessions (registry/ini), FileZilla sitemanager.xml entries, and/or saved .rdp files with password hashes.

Impact: Stored remote session credentials provide an attacker with ready-made access paths to other systems. PuTTY and WinSCP may store passwords in reversible formats, FileZilla historically stored passwords in base64 (trivially decoded), and .rdp files may contain password hashes. Compromising these sessions enables lateral movement to additional hosts.

Remediation: Remove saved credentials from remote access tools. Configure PuTTY and WinSCP to use SSH key authentication instead of passwords. Delete FileZilla sitemanager.xml entries that contain passwords. Remove .rdp files with embedded credentials. Use a secrets manager or enterprise password vault for remote access credentials.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: IA-5, SC-28, AC-3

PCI DSS 4: 8.3.1, 8.3.2, 8.6.3

HIGH DR-CRED-003 — Credential Exposure: Credential Files on Disk

Description: Files containing plaintext or easily reversible credentials were found on disk. This includes unattend.xml/autounattend.xml (deployment passwords), sysprep.xml/sysprep.inf files, web.config connection strings, applicationHost.config bindings, and/or McAfee SiteList.xml files.

Impact: These files often contain local administrator passwords, database connection strings, service account credentials, or encryption keys in cleartext or trivially reversible formats. An attacker can use these credentials for privilege escalation, database access, or lateral movement. Deployment files (unattend.xml) frequently contain the initial administrator password used during Windows installation.

Remediation: Remove or securely delete all deployment files (unattend.xml, sysprep.xml) after provisioning. Encrypt connection strings in web.config using aspnet_regiis -pe. Replace cleartext passwords in applicationHost.config with encrypted alternatives. Audit the file system for credential remnants periodically using endpoint detection rules.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: IA-5, SC-28, CM-6

PCI DSS 4: 2.2.1, 8.3.1, 8.3.2

CRITICAL DR-CRED-004 — Credential Exposure: GPP cpassword Exposure

Description: Group Policy Preferences (GPP) XML files containing the 'cpassword' attribute were found in SYSVOL. Microsoft published the AES-256 key used to encrypt these passwords in MSDN documentation, making all cpassword values trivially decryptable by any domain user.

Impact: Any authenticated domain user can read SYSVOL and decrypt GPP passwords using the publicly known AES key. These passwords typically belong to local administrator accounts, service accounts, or scheduled task accounts configured via Group Policy. This is a well-known, trivially exploitable vulnerability that provides immediate privilege escalation in most Active Directory environments.

Remediation: Install MS14-025 (KB2962486) which prevents creation of new GPP passwords. Delete all existing GPP XML files in SYSVOL that contain cpassword attributes. Rotate all passwords that were stored in GPP. Migrate to LAPS or gMSA for local administrator password management. Search SYSVOL: Get-ChildItem -Path '\\domain\SYSVOL' -Recurse -Include Groups.xml,Services.xml,Scheduledtasks.xml,DataSources.xml,Printers.xml,Drives.xml | Select-String 'cpassword'.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1552.006 (Credential Access)

NIST 800-53: IA-5, SC-28, CM-6

PCI DSS 4: 2.2.1, 8.3.1, 8.3.2

CISA KEV

HIGH DR-CRED-005 — Credential Exposure: Cloud Credential Files

Description: Cloud provider credential files were found on this system. This includes AWS credentials (~/.aws/credentials), Azure profiles (~/.azure/), and/or GCP service account key JSON files. These files contain access keys, tokens, or private keys that authenticate to cloud services.

Impact: Compromised cloud credentials can grant an attacker access to cloud infrastructure, including compute instances, storage buckets, databases, and IAM controls. Depending on the permissions associated with the credentials, this can lead to data exfiltration, resource hijacking (cryptomining), or full cloud account compromise. Cloud credentials are frequently over-provisioned with excessive permissions.

Remediation: Remove long-lived cloud credential files from endpoints. Use short-lived tokens via IAM roles, instance profiles, or managed identities instead. For development machines, use aws-vault, Azure CLI managed identity, or workload identity federation. Rotate any credentials that were stored on disk. Implement cloud credential scanning in CI/CD pipelines.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: IA-5, SC-28, AC-2

PCI DSS 4: 8.3.1, 8.6.3

INFO DR-CRED-006 — Credential Exposure: Credential Manager Entries

Description: Windows Credential Manager (Vault) contains stored credential entries. These may include web credentials, Windows credentials for network shares, and application-specific credentials protected by DPAPI.

Impact: While Credential Manager entries are protected by DPAPI (tied to the user's logon session), they can be decrypted by any process running as that user. If an attacker gains user-level access, they can extract all Vault credentials using tools like mimikatz or built-in vaultcmd commands. This finding is informational — the presence of stored credentials is expected behavior.

Remediation: Review stored credentials periodically and remove entries for systems or services no longer accessed. Educate users not to save domain credentials in Credential Manager for sensitive systems. Implement Credential Guard to protect LSASS-derived credentials from extraction.

Effort: Easy

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1555.004 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 8.3.1

MEDIUM DR-CRED-007 — Credential Exposure: DPAPI Master Key Accessible

Description: DPAPI (Data Protection API) master key material was found to be accessible on this system. DPAPI protects user credentials, browser passwords, WiFi keys, and other sensitive data. If an attacker can access the master key or derive it from the user's password, all DPAPI-protected secrets can be decrypted.

Impact: DPAPI is the underlying encryption mechanism for Windows Credential Manager, browser saved passwords (Chrome, Edge), WiFi passwords, and many application secrets. An attacker with access to the DPAPI master key (stored in %APPDATA%\Microsoft\Protect\) and knowledge of the user's password can decrypt all DPAPI-protected data, providing access to a wide range of stored credentials.

Remediation: Implement Credential Guard to protect DPAPI master keys with virtualization-based security. Enforce strong passwords to make DPAPI key derivation computationally expensive. Restrict local admin access to limit offline DPAPI attacks. Use hardware-backed credential storage (TPM, smart cards) for the most sensitive credentials.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1555.004 (Credential Access)

NIST 800-53: SC-28, SC-12, IA-5

PCI DSS 4: 3.5.1, 8.3.1

INFO DR-CRED-008 — Credential Exposure: KeePass Database Found

Description: KeePass password database files (.kdbx) were found on this system. While KeePass databases are encrypted, their presence indicates this system stores a password vault that may be targeted by attackers for credential harvesting.

Impact: KeePass databases, if protected by a weak master password, can be cracked offline. CVE-2023-32784 demonstrated that KeePass master passwords could be recovered from process memory. Additionally, KeePass plugin loading, trigger mechanisms, and configuration file manipulation have been used for credential theft. The database itself is a high-value target for exfiltration.

Remediation: Ensure KeePass databases use strong master passwords (20+ characters) combined with key files. Keep KeePass updated to the latest version. Restrict KeePass plugin loading to signed/approved plugins. Consider migrating to an enterprise password manager with centralized audit logging and MFA enforcement.

Effort: Easy

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1555.005 (Credential Access)

NIST 800-53: SC-28, IA-5

PCI DSS 4: 8.3.1

MEDIUM DR-CRED-009 — Credential Exposure: SSH Private Keys Found

Description: SSH private key files were found on this system. These keys may provide passwordless authentication to remote systems (Linux servers, network devices, cloud instances). Keys without passphrases are immediately usable by anyone who can read them.

Impact: SSH private keys provide direct authentication to remote systems without requiring a password. If a key has no passphrase (or a weak one), an attacker can immediately use it for lateral movement. Keys in authorized_keys on target systems often have broad permissions. A single compromised SSH key can provide access to many systems in the environment.

Remediation: Ensure all SSH private keys are protected with strong passphrases. Use ssh-agent for key caching rather than storing unprotected keys. Implement SSH certificate-based authentication for managed environments. Audit and rotate SSH keys regularly. Remove keys for systems no longer accessed. Consider hardware-backed keys (FIDO2/PIV).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: IA-5, SC-12, SC-28

PCI DSS 4: 8.3.1, 8.6.1

HIGH DR-EVT-001 — Event Log: Brute Force Attack Detected

Description: Brute-force login activity detected with multiple failed authentication attempts from the same source within the past 7 days. Sources with more than 10 failures indicate automated credential guessing attacks targeting the system.

Impact: Sustained brute-force attacks may eventually succeed, especially against accounts with weak or reused passwords. Successful compromise grants the attacker interactive access to the system and may lead to lateral movement, privilege escalation, and data exfiltration.

Remediation: Implement account lockout policies (5-10 attempts), enable multi-factor authentication, and block offending source IPs at the firewall. Investigate targeted accounts for compromise indicators. Consider implementing Azure AD Smart Lockout for adaptive protection.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1110 (Credential Access)

NIST 800-53: AC-7, SI-4

PCI DSS 4: 10.3.1

MEDIUM DR-EVT-002 — Event Log: Account Lockouts Detected

Description: Account lockout events (Event ID 4740) were detected in the security event log, indicating accounts are being locked due to repeated failed authentication. Lockouts may be caused by brute-force attacks, misconfigured services, or stale cached credentials.

Impact: Account lockouts from brute-force attempts confirm active credential attacks against the system. Service account lockouts can cause application outages and business disruption.

Remediation: Investigate the source of lockouts for each affected account. For user accounts, verify no credential compromise occurred. For service accounts, check for stale cached credentials in scheduled tasks, services, or mapped drives. Consider migrating to Group Managed Service Accounts (gMSA).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1110 (Credential Access)

NIST 800-53: AC-7, SI-4

PCI DSS 4: 10.2.1, 11.4.1

CRITICAL DR-EVT-003 — Event Log: Security Log Cleared

Description: Event log clearing events detected (Event ID 1102/104). Clearing security logs destroys forensic evidence and is a strong indicator of attacker activity or insider threat attempting to cover their tracks.

Impact: Cleared security logs eliminate the audit trail of authentication events, privilege escalation, and policy changes, preventing incident investigation and regulatory compliance verification. This is a common anti-forensics technique.

Remediation: Investigate the account that cleared the logs for compromise. Configure event log forwarding to a SIEM to preserve logs centrally. Restrict log management permissions to dedicated admin accounts. Enable alerting on Event ID 1102.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A09:2021 - Security Logging and Monitoring Failures

MITRE ATT&CK: T1070.001 (Defense Evasion)

NIST 800-53: AU-9, SI-4

PCI DSS 4: 10.2.1

HIGH DR-EVT-004 — Event Log: Suspicious PowerShell Activity

Description: PowerShell events contain suspicious patterns including encoded commands (-EncodedCommand), download cradles (Invoke-WebRequest/IEX), AMSI bypass attempts, or known offensive tool invocations such as Mimikatz or PowerView.

Impact: Suspicious PowerShell activity may indicate post-exploitation activity, malware execution, or attacker reconnaissance. PowerShell is the most commonly abused living-off-the-land tool on Windows systems.

Remediation: Investigate each suspicious PowerShell event. Check the executing user and originating process. Enable PowerShell ScriptBlock Logging, Transcription, and Constrained Language Mode. Consider deploying AppLocker or WDAC to restrict PowerShell usage to authorized administrators.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 - Injection

MITRE ATT&CK: T1059.001 (Execution)

NIST 800-53: SI-4, AU-12

PCI DSS 4: 11.4.1

MEDIUM DR-EVT-005 — Event Log: New Service Installations

Description: New service installation events (Event ID 7045/4697) recorded in event logs. Service installations are a common persistence mechanism used by malware and attackers to maintain access that survives reboots.

Impact: Attackers install malicious services to maintain persistent access. Services run with elevated privileges and can be configured to start automatically, ensuring the attacker's code runs at every boot.

Remediation: Review each new service installation for legitimacy. Verify the service executable path, signing status, and the account used for installation. Remove unauthorized services and investigate how they were installed.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A09:2021 - Security Logging and Monitoring Failures

MITRE ATT&CK: T1543.003 (Persistence)

NIST 800-53: SI-4, CM-3

PCI DSS 4: 10.2.1

MEDIUM DR-EVT-006 — Event Log: User Account Created

Description: User account creation events (Event ID 4720) detected in security event logs. Account creation outside of normal provisioning workflows may indicate persistence or unauthorized access by an attacker.

Impact: Attackers create local accounts to maintain persistent access. Unauthorized accounts may be added to privileged groups to escalate privileges and maintain a foothold on the compromised system.

Remediation: Verify each account creation was authorized through the proper provisioning workflow. Remove unauthorized accounts. Monitor for group membership changes (Event ID 4732) on newly created accounts.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A09:2021 - Security Logging and Monitoring Failures

MITRE ATT&CK: T1136.001 (Persistence)

NIST 800-53: AC-2, SI-4

PCI DSS 4: 10.2.1

HIGH DR-HDN-001 — System Hardening: UAC Disabled

Description: User Account Control (UAC) is completely disabled on this endpoint. The registry value EnableLUA under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System is set to 0.

Impact: All applications run with full administrative privileges without prompting. Malware and exploit payloads execute with elevated privileges immediately upon infection, greatly increasing the severity of any compromise.

Remediation: Re-enable UAC by setting the EnableLUA registry value to 1 at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. Set ConsentPromptBehaviorAdmin to at least 2 (prompt for consent on secure desktop). Apply via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1548.002 (Defense Evasion)

NIST 800-53: AC-6, CM-6

PCI DSS 4: 7.2.1

CISA KEV

MEDIUM DR-HDN-002 — System Hardening: UAC Prompt Behavior Weak

Description: The UAC elevation prompt for administrators is configured to auto-elevate without prompting (ConsentPromptBehaviorAdmin is 0) or to prompt on a non-secure desktop.

Impact: Weak UAC prompt settings allow malware to silently elevate privileges through auto-elevation or intercept elevation prompts on the interactive desktop, enabling privilege escalation without user awareness.

Remediation: Configure ConsentPromptBehaviorAdmin to 2 (prompt for consent on the secure desktop) via Group Policy or registry. Also ensure PromptOnSecureDesktop is set to 1 to prevent interception of the elevation dialog by malicious software.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1548.002 (Privilege Escalation)

NIST 800-53: AC-6, CM-6

PCI DSS 4: 7.2.1

MEDIUM DR-HDN-003 — Network Hardening: SMBv1 Protocol Enabled

Description: The deprecated SMBv1 protocol is enabled on this endpoint, either as a server or client component.

Impact: SMBv1 has known critical vulnerabilities including EternalBlue (MS17-010) and lacks modern security features. It enables remote code execution, credential relay attacks, and was the primary propagation vector for WannaCry and NotPetya ransomware.

Remediation: Disable SMBv1 by running: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. For Server: Remove-WindowsFeature FS-SMB1. Alternatively set HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 to 0. Verify no legacy applications or devices require SMBv1 before disabling.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 - Vulnerable and Outdated Components

MITRE ATT&CK: T1210 (Lateral Movement)

NIST 800-53: CM-7, SC-8

PCI DSS 4: 2.2.4

CISA KEV

MEDIUM DR-HDN-004 — System Hardening: SMB Signing Not Required

Description: SMB message signing is not required on this endpoint, allowing unsigned SMB communications.

Impact: Without mandatory SMB signing, an attacker in a man-in-the-middle position can intercept and modify SMB traffic, perform relay attacks (NTLM relay), and hijack authenticated SMB sessions to access file shares or execute commands on other systems.

Remediation: Enable mandatory SMB signing by setting RequireSecuritySignature to 1 at HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters and LanmanWorkstation\Parameters. Apply via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Microsoft network server/client: Digitally sign communications (always).

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1557.001 (Credential Access)

NIST 800-53: SC-8, SC-23

PCI DSS 4: 4.2.1

HIGH DR-HDN-005 — Authentication: NTLMv1 Authentication Allowed

Description: The LAN Manager authentication level allows NTLMv1 responses, a weak authentication protocol that is trivially crackable.

Impact: NTLMv1 hashes can be cracked in seconds using rainbow tables or GPU-accelerated attacks, exposing user passwords. An attacker capturing NTLMv1 traffic on the network can recover plaintext credentials for lateral movement.

Remediation: Set LmCompatibilityLevel to 5 (Send NTLMv2 response only. Refuse LM & NTLM) at HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Apply via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Network security: LAN Manager authentication level. Test thoroughly as legacy devices may require NTLMv1.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1110.002 (Credential Access)

NIST 800-53: IA-5, SC-8

PCI DSS 4: 8.3.2

HIGH DR-HDN-006 — Authentication: LM Password Hashes Stored

Description: The system is configured to store LAN Manager (LM) hash values for passwords, a severely weak hash format.

Impact: LM hashes split passwords into two 7-character halves, are case-insensitive, and use DES without salt. They can be cracked in minutes even for complex passwords, giving an attacker who obtains the SAM database or captures authentication traffic immediate access to plaintext passwords.

Remediation: Set NoLMHash to 1 at HKLM\SYSTEM\CurrentControlSet\Control\Lsa to prevent storage of LM hashes. Apply via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Network security: Do not store LAN Manager hash value on next password change. Force all users to change passwords after enabling.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1003.002 (Credential Access)

NIST 800-53: IA-5, SC-28

PCI DSS 4: 8.3.2

MEDIUM DR-HDN-007 — System Hardening: AutoRun Enabled

Description: AutoRun/AutoPlay is enabled, allowing automatic execution of programs from removable media and network drives.

Impact: Malware can be automatically executed when a USB drive, CD/DVD, or network share is accessed. This is a classic initial access vector used by worms (Conficker) and targeted attacks using planted USB devices.

Remediation: Set NoDriveTypeAutoRun to 255 (0xFF) at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer to disable AutoRun on all drive types. Apply via Group Policy: Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies > Turn off Autoplay (All drives).

Effort: Easy

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1091 (Initial Access)

NIST 800-53: CM-7, MP-7

PCI DSS 4: 2.2.4

CRITICAL DR-HDN-008 — Credential Exposure: WDigest Plaintext Credentials

Description: WDigest authentication is configured to store plaintext credentials in memory (UseLogonCredential set to 1 at HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest).

Impact: An attacker who achieves local administrator access can use tools like Mimikatz to extract plaintext passwords from LSASS process memory for all currently logged-in users, including domain administrators. This enables immediate lateral movement without any cracking.

Remediation: Set UseLogonCredential to 0 at HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest. On Windows 8.1/Server 2012 R2 and later with KB2871997 installed, WDigest plaintext caching is disabled by default. Verify the registry value is explicitly set to 0 to prevent re-enablement by malware.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1003.001 (Credential Access)

NIST 800-53: IA-5, SC-28

PCI DSS 4: 8.3.2

HIGH DR-HDN-009 — System Hardening: LSA Protection Not Enabled

Description: Local Security Authority (LSA) protection is not enabled. The RunAsPPL registry value is not set to 1 at HKLM\SYSTEM\CurrentControlSet\Control\Lsa.

Impact: Without LSA protection, the LSASS process can be accessed by any process running as local administrator. Attackers can dump credentials from LSASS memory using standard tools, bypassing most endpoint security controls.

Remediation: Enable LSA protection by setting RunAsPPL to 1 at HKLM\SYSTEM\CurrentControlSet\Control\Lsa. A system restart is required. Test application compatibility first as some security products may not function with PPL enabled. On Windows 11 22H2+, LSA protection is enabled by default.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1003.001 (Credential Access)

NIST 800-53: AC-6, SI-7

PCI DSS 4: 8.3.1

MEDIUM DR-HDN-010 — System Hardening: Credential Guard Not Enabled

Description: Windows Defender Credential Guard (Virtualization Based Security for credential isolation) is not enabled on this endpoint.

Impact: Without Credential Guard, NTLM hashes and Kerberos TGTs stored in LSASS memory can be extracted by tools running as local administrator. Credential Guard isolates these secrets in a hardware-backed virtual enclave that even kernel-level attackers cannot access.

Remediation: Enable Credential Guard by setting EnableVirtualizationBasedSecurity to 1 at HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard and RequirePlatformSecurityFeatures to 1 or 3. Prerequisites: UEFI firmware, Secure Boot, TPM 2.0, and 64-bit Windows 10/11 Enterprise or Server 2016+. Apply via Group Policy: Computer Configuration > Administrative Templates > System > Device Guard.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1003.001 (Credential Access)

NIST 800-53: SC-39, SC-28

PCI DSS 4: 8.3.1

HIGH DR-HDN-011 — Network Hardening: LLMNR Enabled

Description: Link-Local Multicast Name Resolution (LLMNR) is enabled, allowing unauthenticated name resolution on the local network.

Impact: An attacker on the local network can respond to LLMNR queries to capture NTLMv2 hashes from connecting clients using tools like Responder. These hashes can be cracked offline or relayed to other services for unauthorized access.

Remediation: Disable LLMNR via Group Policy: Computer Configuration > Administrative Templates > Network > DNS Client > Turn off multicast name resolution. Set EnableMulticast to 0 at HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient. Ensure proper DNS infrastructure is in place as a replacement.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1557.001 (Credential Access)

NIST 800-53: SC-8, CM-7

PCI DSS 4: 2.2.4

MEDIUM DR-HDN-012 — Network Hardening: WPAD Enabled

Description: Web Proxy Auto-Discovery (WPAD) protocol is enabled, allowing automatic proxy configuration via DNS or DHCP.

Impact: An attacker can poison WPAD queries via LLMNR/NBNS or rogue DHCP to redirect all HTTP traffic through a malicious proxy, enabling credential interception, session hijacking, and man-in-the-middle attacks on all web traffic.

Remediation: Disable the WinHTTP Auto-Proxy Service (WinHttpAutoProxySvc) and set its startup to Disabled. In Internet Options, uncheck 'Automatically detect settings'. If proxy auto-configuration is needed, use explicit PAC file URLs rather than WPAD discovery.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1557.001 (Credential Access)

NIST 800-53: SC-8, CM-7

PCI DSS 4: 4.2.1

MEDIUM DR-HDN-013 — Monitoring: PowerShell Script Block Logging Disabled

Description: PowerShell script block logging is not enabled, preventing the recording of PowerShell script content in Windows Event Logs.

Impact: Without script block logging, PowerShell-based attacks (obfuscated download cradles, in-memory execution, AMSI bypasses) leave no forensic evidence. Incident response teams cannot determine what malicious PowerShell commands were executed.

Remediation: Enable PowerShell script block logging via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging. Set EnableScriptBlockLogging to 1 at HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A09:2021 - Security Logging and Monitoring Failures

MITRE ATT&CK: T1059.001 (Execution)

NIST 800-53: AU-2, AU-3, AU-12

PCI DSS 4: 10.2.1

LOW DR-HDN-014 — Monitoring: PowerShell Module Logging Disabled

Description: PowerShell module logging is not enabled, which would record pipeline execution details for specified modules.

Impact: Module logging provides a detailed record of which PowerShell cmdlets and functions were invoked. Without it, forensic investigators have reduced visibility into the specific operations performed during an attack.

Remediation: Enable PowerShell module logging via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on Module Logging. Configure the module names to log (use * for all modules).

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A09:2021 - Security Logging and Monitoring Failures

MITRE ATT&CK: T1059.001 (Execution)

NIST 800-53: AU-2, AU-12

PCI DSS 4: 10.2.1

LOW DR-HDN-015 — Monitoring: PowerShell Transcription Disabled

Description: PowerShell transcription (recording of all PowerShell input and output to text files) is not enabled.

Impact: Transcription provides a complete record of interactive and scripted PowerShell sessions including output. Without it, defenders lose a valuable forensic data source for investigating PowerShell-based attacks.

Remediation: Enable PowerShell transcription via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Transcription. Configure the output directory to a secured file share for centralized collection. Ensure adequate disk space and proper NTFS permissions on the transcript directory.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A09:2021 - Security Logging and Monitoring Failures

MITRE ATT&CK: T1059.001 (Execution)

NIST 800-53: AU-2, AU-12

PCI DSS 4: 10.2.1

MEDIUM DR-HDN-016 — System Hardening: PowerShell v2 Engine Available

Description: The PowerShell v2 engine is still installed as a Windows feature, providing a downgrade path that bypasses modern logging and security controls.

Impact: Attackers can invoke PowerShell v2 (powershell -version 2) to bypass AMSI, script block logging, constrained language mode, and other security features that only exist in PowerShell v5+. This is a well-documented defense evasion technique.

Remediation: Remove the PowerShell v2 engine: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root. For Server: Remove-WindowsFeature PowerShell-V2. Verify no applications depend on PowerShell v2 before removal.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1059.001 (Execution)

NIST 800-53: CM-7, SI-16

PCI DSS 4: 2.2.4

HIGH DR-HDN-017 — Endpoint Protection: Windows Defender Disabled

Description: Windows Defender Antivirus is completely disabled or not running on this endpoint with no alternative antimalware solution detected.

Impact: Without antimalware protection, all known malware including commodity threats, ransomware, and trojans can execute without detection. The system has no real-time file scanning, web filtering, or behavior monitoring.

Remediation: Re-enable Windows Defender by removing any Group Policy that disables it (DisableAntiSpyware registry key), starting the WinDefend service, and ensuring real-time protection is turned on. If a third-party antivirus is intended, verify it is properly installed and running. Ensure at minimum one antimalware solution is active at all times.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1562.001 (Defense Evasion)

NIST 800-53: SI-3, SC-7

PCI DSS 4: 5.2.1

MEDIUM DR-HDN-018 — Endpoint Protection: Defender Exclusions Present

Description: Windows Defender has file, folder, process, or extension exclusions configured that exempt certain paths or processes from scanning.

Impact: Attackers frequently target known exclusion paths to stage and execute malware. Common exclusion paths like temp directories, development folders, or application paths become safe havens for malicious payloads that will never be scanned.

Remediation: Review all Windows Defender exclusions and remove any that are not strictly necessary for application compatibility. Document the business justification for each remaining exclusion. Avoid broad exclusions (entire drives, common directories). Monitor excluded paths for suspicious file creation via separate detection mechanisms.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1562.001 (Defense Evasion)

NIST 800-53: SI-3

PCI DSS 4: 5.2.1

HIGH DR-HDN-019 — Endpoint Protection: Defender Real-Time Protection Off

Description: Windows Defender is installed but real-time protection is turned off, leaving the system without active file scanning.

Impact: Files downloaded, copied, or created are not scanned until a manual or scheduled scan occurs. Malware can execute immediately upon arrival without triggering any detection, potentially running for hours or days before a scheduled scan.

Remediation: Enable real-time protection in Windows Security settings or via PowerShell: Set-MpPreference -DisableRealtimeMonitoring $false. If Group Policy is preventing this, update the policy to allow real-time protection. Verify protection is active with Get-MpComputerStatus.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1562.001 (Defense Evasion)

NIST 800-53: SI-3

PCI DSS 4: 5.2.1

HIGH DR-HDN-020 — Remote Desktop: RDP Without NLA

Description: Remote Desktop Protocol is enabled without requiring Network Level Authentication (NLA), allowing unauthenticated users to reach the RDP login screen.

Impact: Without NLA, attackers can establish RDP sessions without credentials, consuming server resources (DoS) and reaching the Windows login screen where they can attempt credential attacks. This also exposes the system to pre-authentication RDP vulnerabilities like BlueKeep.

Remediation: Enable NLA for Remote Desktop by setting UserAuthentication to 1 at HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp. Apply via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security > Require user authentication for remote connections by using Network Level Authentication.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1021.001 (Lateral Movement)

NIST 800-53: AC-17, IA-2

PCI DSS 4: 8.3.1

CISA KEV

MEDIUM DR-HDN-021 — System Hardening: DEP Not System-Wide

Description: Data Execution Prevention (DEP) is not configured to protect all programs, only essential Windows programs and services.

Impact: Without system-wide DEP, buffer overflow exploits can execute shellcode in data memory regions. DEP prevents code execution from non-executable memory pages, making many common exploitation techniques significantly harder.

Remediation: Configure DEP to protect all programs by running: bcdedit /set nx AlwaysOn. Alternatively, configure via System Properties > Advanced > Performance Settings > Data Execution Prevention > Turn on DEP for all programs and services except those I select. Add specific exceptions only for applications that are confirmed incompatible.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1203 (Execution)

NIST 800-53: SI-16, CM-6

PCI DSS 4: 6.2.4

HIGH DR-HDN-022 — Access Control: Anonymous Named Pipe Access

Description: Anonymous (null session) access to named pipes is permitted, allowing unauthenticated users to connect to specific named pipes on the system.

Impact: Attackers can enumerate sensitive information through named pipes without authentication, including user lists, group memberships, share lists, and security policies. This information aids in planning targeted credential attacks and privilege escalation.

Remediation: Clear the NullSessionPipes registry value at HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters and set RestrictNullSessAccess to 1. Apply via Group Policy: Network access: Restrict anonymous access to Named Pipes and Shares (Enabled).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1087 (Discovery)

NIST 800-53: AC-14, AC-3

PCI DSS 4: 7.2.1

HIGH DR-HDN-023 — Access Control: Null Session Access

Description: The system allows null session (anonymous) connections for SAM enumeration and share enumeration.

Impact: Attackers can connect without credentials to enumerate all user accounts, groups, and network shares. This provides a complete map of the attack surface and user accounts to target for password spraying or brute force attacks.

Remediation: Set RestrictAnonymousSAM to 1 and RestrictAnonymous to 1 at HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Apply via Group Policy: Network access: Do not allow anonymous enumeration of SAM accounts (Enabled) and Network access: Do not allow anonymous enumeration of SAM accounts and shares (Enabled).

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1087 (Discovery)

NIST 800-53: AC-14, AC-3

PCI DSS 4: 7.2.1

MEDIUM DR-HDN-024 — Policy: Audit Policy Insufficient

Description: The Windows audit policy does not log critical security events. Key audit categories such as logon events, privilege use, object access, or policy changes are not configured for success and/or failure auditing.

Impact: Without comprehensive audit logging, security incidents go undetected and uninvestigated. Login attempts, privilege escalation, file access, and policy changes occur without any record, severely impacting incident response and forensic capabilities.

Remediation: Configure advanced audit policy via Group Policy to log at minimum: Logon/Logoff (Success+Failure), Account Logon (Success+Failure), Privilege Use (Success+Failure), Object Access (Failure), Policy Change (Success+Failure), System (Success+Failure). Use auditpol to verify: auditpol /get /category:*.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A09:2021 - Security Logging and Monitoring Failures

MITRE ATT&CK: T1562.002 (Defense Evasion)

NIST 800-53: AU-2, AU-3

PCI DSS 4: 10.2.1

MEDIUM DR-HDN-025 — Service Hardening: Print Spooler Running

Description: The Print Spooler service is running on a server where printing functionality is likely not required.

Impact: The Print Spooler service has been the target of multiple critical vulnerabilities including PrintNightmare (CVE-2021-34527) enabling remote code execution and privilege escalation. Running it on servers unnecessarily increases the attack surface.

Remediation: Disable the Print Spooler service on servers that do not need printing: Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled. On domain controllers, the Spooler should always be disabled as it exposes the DC to coercion attacks via the MS-RPRN protocol.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1210 (Lateral Movement)

NIST 800-53: CM-7

PCI DSS 4: 2.2.4

CISA KEV

MEDIUM DR-HDN-026 — Endpoint Protection: Application Whitelisting Not Configured

Description: Neither AppLocker nor Windows Defender Application Control (WDAC) is configured on this system. Without application whitelisting, any executable, script, or DLL can run without restriction.

Impact: Without application control, an attacker can execute arbitrary malware, scripts, and tools on the system without restriction. Application whitelisting is consistently rated as one of the most effective endpoint security controls by ACSC Essential Eight, NIST, and CIS. Its absence significantly increases the attack surface for malware execution, lateral movement tools, and post-exploitation frameworks.

Remediation: Implement AppLocker or Windows Defender Application Control (WDAC). Start in audit mode to identify legitimate applications, then switch to enforce mode. At minimum, implement script rules to block unauthorized script execution. For WDAC: create a base policy with Microsoft recommended block rules, then supplement with organization-specific allow rules. For AppLocker: configure default rules plus explicit allow rules for approved applications.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1059 (Execution)

NIST 800-53: CM-7(5), SI-7

PCI DSS 4: 5.3.1, 2.2.1

MEDIUM DR-HDN-027 — System Hardening: HVCI Not Enabled

Description: Hypervisor-Protected Code Integrity (HVCI / Memory Integrity) is not enabled on this system. HVCI uses virtualization-based security (VBS) to protect the Windows kernel code integrity verification process, preventing kernel-mode code injection and driver-based attacks.

Impact: Without HVCI, the kernel is vulnerable to code injection attacks via malicious drivers, kernel exploits, and rootkits. HVCI prevents unsigned or improperly signed kernel-mode code from executing, significantly raising the bar for kernel-level attacks. Its absence leaves the system vulnerable to bootkit/rootkit installations and kernel-mode exploit payloads.

Remediation: Enable HVCI via Group Policy: Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security > Virtualization Based Protection of Code Integrity = Enabled with UEFI lock. Alternatively, enable via Windows Security > Device Security > Core isolation > Memory integrity. Prerequisites: compatible CPU with virtualization extensions (Intel VT-x/AMD-V), UEFI firmware, Secure Boot enabled.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1553 (Defense Evasion)

NIST 800-53: SI-7, SI-16, CM-6

PCI DSS 4: 5.3.1

MEDIUM DR-HDN-028 — System Hardening: CredSSP Delegation Enabled

Description: Credential Security Support Provider (CredSSP) delegation is enabled, allowing this system to forward user credentials to remote servers. The AllowFreshCredentials or AllowFreshCredentialsDomain policies permit credential delegation to specified or all remote hosts.

Impact: CredSSP delegation sends the user's cleartext credentials to the remote server. If the remote server is compromised, these credentials are immediately available to the attacker. CredSSP delegation to '*' (all servers) is especially dangerous as it enables credential forwarding to any host, including attacker-controlled machines. This defeats the purpose of Restricted Admin mode and other credential protection mechanisms.

Remediation: Disable CredSSP delegation via Group Policy: Computer Configuration > Administrative Templates > System > Credentials Delegation > Allow delegating fresh credentials = Disabled. If CredSSP is required for specific administrative tasks, restrict delegation to specific trusted servers only (never use '*'). Apply CVE-2018-0886 patches. Consider using Remote Credential Guard instead of CredSSP for RDP sessions.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1550.001 (Lateral Movement)

NIST 800-53: IA-5, SC-28, AC-17

PCI DSS 4: 8.3.1, 8.3.2

MEDIUM DR-HDN-029 — Endpoint Protection: AMSI Not Registered

Description: No Antimalware Scan Interface (AMSI) provider is registered on this system. AMSI is a Windows interface that allows applications to send content (scripts, macro code, .NET assemblies) to the installed antimalware solution for scanning before execution.

Impact: Without AMSI, script-based attacks (PowerShell, VBScript, JScript, .NET) can execute malicious code without real-time scanning. AMSI is the primary defense against fileless malware, obfuscated scripts, and in-memory attacks. Its absence or deregistration is a common attacker technique (T1562.001) to disable defenses before deploying payloads.

Remediation: Verify that Windows Defender or a third-party antimalware solution with AMSI support is installed and active. Check AMSI provider registration: reg query "HKLM\SOFTWARE\Microsoft\AMSI\Providers" /s. If no providers are listed, reinstall or re-register the antimalware solution. If AMSI was deliberately tampered with, investigate as a potential compromise indicator.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1562.001 (Defense Evasion)

NIST 800-53: SI-3, SI-4

PCI DSS 4: 5.2.1, 5.3.1

LOW DR-HDN-030 — System Hardening: .NET Framework v2/v3.5 Installed

Description: .NET Framework version 2.0 or 3.5 is installed on this system. These legacy .NET versions include the CLR v2 runtime which has weaker security controls than CLR v4 and can be leveraged by attackers to bypass application-level security restrictions.

Impact: The .NET CLR v2 runtime can be invoked by PowerShell v2 and other tools to bypass AMSI, script block logging, constrained language mode, and other security controls that are only enforced in CLR v4. Attackers specifically target legacy .NET to downgrade the runtime and evade security monitoring. If .NET 2.0/3.5 is not required by any application, it represents unnecessary attack surface.

Remediation: Remove .NET Framework 3.5 (includes 2.0 and 3.0) if no application requires it: Disable-WindowsOptionalFeature -Online -FeatureName NetFx3. On Server: Remove-WindowsFeature NET-Framework-Core. Before removing, verify no application dependencies by auditing installed software and testing in a pre-production environment.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A06:2021 - Vulnerable and Outdated Components

MITRE ATT&CK: T1059.001 (Execution)

NIST 800-53: CM-7, SI-3

PCI DSS 4: 2.2.4

MEDIUM DR-HDN-031 — System Hardening: PS Constrained Language Not Enforced

Description: PowerShell is running in Full Language Mode rather than Constrained Language Mode (CLM). Full Language Mode allows unrestricted access to .NET types, COM objects, and Win32 APIs, enabling powerful post-exploitation capabilities.

Impact: Full Language Mode enables attackers to load arbitrary .NET assemblies, invoke Win32 APIs via P/Invoke or Add-Type, create COM objects, and execute complex exploitation frameworks (Invoke-Mimikatz, PowerView, etc.) entirely in memory. Constrained Language Mode blocks these capabilities while preserving administrative scripting functionality.

Remediation: Enforce Constrained Language Mode via WDAC/AppLocker code integrity policies (the most robust method — CLM activates automatically when UMCI is enforced). Alternatively, set the __PSLockdownPolicy environment variable to 4 (system-wide), though this is less robust than WDAC enforcement. Test with administrative scripts first — CLM restricts .NET and COM access that some admin scripts require.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1059.001 (Execution)

NIST 800-53: CM-7, CM-6, SI-7

PCI DSS 4: 2.2.1

MEDIUM DR-HDN-032 — System Hardening: ASR Rules Not Configured

Description: Windows Defender Attack Surface Reduction (ASR) rules are not configured or are set to audit-only mode. ASR rules block specific behaviors commonly used by malware, such as Office macros creating child processes, obfuscated scripts, credential theft from LSASS, and untrusted USB process execution.

Impact: Without ASR rules, the system lacks behavioral protection against common attack techniques: Office macro malware, script-based attacks, credential dumping, ransomware file encryption patterns, and lateral movement techniques. ASR rules are one of the most effective free security controls available on Windows 10/11 and Server 2016+.

Remediation: Enable ASR rules via Group Policy or Intune. Recommended rules to enable in block mode: Block Office apps from creating child processes (D4F940AB-401B-4EFC-AADC-AD5F3C50688A), Block credential stealing from LSASS (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2), Block executable content from email/webmail (BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550), Use advanced protection against ransomware (c1db55ab-c21a-4637-bb3f-a12568109d35). Start in audit mode for 2 weeks, then switch to block.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1059 (Execution)

NIST 800-53: SI-3, SI-4, CM-7

PCI DSS 4: 5.2.1, 5.3.1

LOW DR-HDN-033 — Endpoint Protection: Controlled Folder Access Not Enabled

Description: Windows Defender Controlled Folder Access is not enabled. This feature protects designated folders (Documents, Desktop, Pictures, etc.) from unauthorized modification by untrusted applications, serving as anti-ransomware protection.

Impact: Without Controlled Folder Access, ransomware and destructive malware can freely encrypt or delete files in user profile folders and other protected locations. CFA provides a last line of defense against ransomware by blocking unauthorized write operations, even from elevated processes, unless the application is explicitly whitelisted.

Remediation: Enable Controlled Folder Access via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access > Configure Controlled folder access = Enabled (Block mode). Alternatively: Set-MpPreference -EnableControlledFolderAccess Enabled. Whitelist legitimate applications that need write access to protected folders.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1486 (Impact)

NIST 800-53: SI-3, CP-9

PCI DSS 4: 5.2.1

LOW DR-HDN-034 — Endpoint Protection: Network Protection Not Enabled

Description: Windows Defender Network Protection is not enabled. Network Protection extends SmartScreen capabilities to block outbound connections to low-reputation or malicious domains and IP addresses, protecting against phishing, exploit hosting sites, and command-and-control infrastructure.

Impact: Without Network Protection, the system can establish connections to known-malicious domains, phishing sites, and C2 infrastructure without being blocked. This feature provides network-layer defense against web-based threats and can prevent initial access (drive-by downloads, phishing), malware download, and C2 communication.

Remediation: Enable Network Protection via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Network Protection > Prevent users and apps from accessing dangerous websites = Enabled (Block mode). Alternatively: Set-MpPreference -EnableNetworkProtection Enabled. Start in audit mode to identify false positives before enforcing.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1071 (Command and Control)

NIST 800-53: SI-3, SI-4, SC-7

PCI DSS 4: 5.2.1, 1.4.2

MEDIUM DR-HDN-035 — Endpoint Protection: Exploit Protection Not Configured

Description: Windows Exploit Protection (successor to EMET) process mitigations are not configured. Exploit Protection applies per-process exploit mitigations such as DEP, ASLR, CFG (Control Flow Guard), heap integrity validation, and image load restrictions to protect against memory corruption exploits.

Impact: Without process-level exploit mitigations, applications are more vulnerable to memory corruption exploits (buffer overflows, use-after-free, ROP chains). Exploit Protection mitigations make exploit development significantly harder and can prevent known exploitation techniques from succeeding, even against unpatched vulnerabilities.

Remediation: Configure Exploit Protection system-wide and per-application: Windows Security > App & browser control > Exploit protection settings. Enable for high-risk applications (browsers, Office, PDF readers, Java). Key mitigations: DEP (AlwaysOn), ASLR (ForceRelocateImages, BottomUp), CFG (enabled), SEHOP (enabled). Deploy via Group Policy using an XML configuration file: Set-ProcessMitigation -PolicyFilePath exploit-protection-settings.xml.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1068 (Privilege Escalation)

NIST 800-53: SI-16, SI-7, CM-6

PCI DSS 4: 5.3.1, 6.3.2

MEDIUM DR-HDN-036 — Network Hardening: SMB Client Signing Not Required

Description: Outbound SMB connections from this host do not require packet signing. An attacker on the local network can intercept and relay SMB authentication to other targets.

Impact: Without client-side signing, NTLM relay attacks are possible. An attacker poisons name resolution (LLMNR/NBT-NS), intercepts this machine's outbound SMB authentication, and relays it to another host to execute commands or access shares.

Remediation: Set RequireSecuritySignature to 1 under HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1557.001 (Credential Access)

NIST 800-53: SC-8, SC-23

PCI DSS 4: 4.2.1

MEDIUM DR-HDN-037 — Access Control: Anonymous SAM Account Enumeration Allowed

Description: Unauthenticated users can enumerate local user accounts through the SAM database. RestrictAnonymousSAM is not enabled.

Impact: An attacker can retrieve the full list of local user accounts without any credentials, providing a target list for password spraying and brute force attacks.

Remediation: Set RestrictAnonymousSAM to 1 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1087.001 (Discovery)

NIST 800-53: AC-3, AC-14

PCI DSS 4: 7.2.1

MEDIUM DR-HDN-038 — System Hardening: Built-in Administrator Exempt from UAC

Description: The built-in Administrator account (RID 500) runs all processes with full elevated privileges without UAC prompts. FilterAdministratorToken is not enabled.

Impact: Any process launched by the RID-500 Administrator account runs with unrestricted administrative privileges. If an attacker obtains these credentials, post-exploitation is immediate with no elevation prompt barrier.

Remediation: Set FilterAdministratorToken to 1 under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. Rename the built-in Administrator account.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1548.002 (Privilege Escalation)

NIST 800-53: AC-6, CM-6

PCI DSS 4: 7.2.1

HIGH DR-HDN-039 — Authentication: Blank Passwords Permitted for Network Logon

Description: Accounts with empty passwords can authenticate over the network (SMB, RDP, WinRM). LimitBlankPasswordUse is disabled.

Impact: An attacker who discovers any account with no password set can authenticate remotely. On domain controllers this grants access to SYSVOL, NETLOGON, and potentially administrative shares.

Remediation: Set LimitBlankPasswordUse to 1 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Audit all local and domain accounts to ensure no accounts have empty passwords.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5, AC-7

PCI DSS 4: 8.3.1, 8.3.6

HIGH DR-HDN-040 — Access Control: Anonymous Users Included in Everyone Group

Description: The Everyone security group includes anonymous (unauthenticated) connections. Any resource with Everyone permissions is accessible without credentials.

Impact: Shares, files, and objects granted to Everyone become accessible to null-session connections. This effectively removes the authentication boundary for any Everyone-permissioned resource on the system.

Remediation: Set EveryoneIncludesAnonymous to 0 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Review all resources with Everyone permissions.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1087 (Discovery)

NIST 800-53: AC-3, AC-14

PCI DSS 4: 7.2.1

HIGH DR-HDN-041 — Remote Desktop: Weak RDP Transport Encryption

Description: Remote Desktop is configured with weak or legacy transport encryption. Sessions can be intercepted or downgraded by an on-path attacker.

Impact: SecurityLayer=0 uses legacy RDP encryption (RC4-based, no server certificate validation). Low MinEncryptionLevel allows 56-bit or 40-bit session keys. An on-path attacker can intercept keystrokes, screen content, and credentials.

Remediation: Set SecurityLayer to 2 (TLS) and MinEncryptionLevel to 3 (High) under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1021.001 (Lateral Movement)

NIST 800-53: SC-8, SC-23, AC-17

PCI DSS 4: 4.2.1, 2.2.7

MEDIUM DR-HDN-042 — Monitoring: Critical Audit Subcategories Disabled

Description: Security-critical audit subcategories are not configured. Events in these categories are not being logged, preventing detection and forensic investigation.

Impact: Without subcategory auditing for logon events, credential validation, account management, and process creation, the system cannot detect brute force attacks, pass-the-hash, unauthorized account changes, or malicious process execution.

Remediation: Enable Advanced Audit Policy via Group Policy for: Logon, User Account Management, Credential Validation, Process Creation, and Audit Policy Change subcategories.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

MITRE ATT&CK: T1562.002 (Defense Evasion)

NIST 800-53: AU-2, AU-3, AU-12

PCI DSS 4: 10.2.1, 10.2.2

HIGH DR-HDN-043 — Privilege Escalation: Sensitive User Rights Assigned to Non-Default Accounts

Description: Sensitive user rights (SeDebugPrivilege, SeLoadDriverPrivilege, SeBackupPrivilege, etc.) are assigned to accounts beyond the operating system defaults. These rights enable credential theft, kernel-level access, or file system bypass.

Impact: SeDebugPrivilege allows dumping LSASS memory to extract all cached credentials. SeLoadDriverPrivilege allows loading a malicious kernel driver. SeBackupPrivilege allows reading any file on the system regardless of ACLs, including SAM and SYSTEM registry hives.

Remediation: Review User Rights Assignment in Group Policy. Remove non-essential accounts from sensitive privileges. Only SYSTEM, LOCAL SERVICE, and Administrators should hold SeDebugPrivilege, SeLoadDriverPrivilege, SeBackupPrivilege, and SeTcbPrivilege.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1134 (Privilege Escalation)

NIST 800-53: AC-6, CM-6

PCI DSS 4: 7.2.1, 7.2.2

MEDIUM DR-HDN-044 — Monitoring: Advanced Audit Policy Overridden by Legacy Settings

Description: Advanced Audit Policy subcategory settings are being silently overridden by legacy basic audit policy. Granular audit configurations may not be taking effect.

Impact: Without SCENoApplyLegacyAuditPolicy enabled, basic audit policy takes precedence over Advanced Audit Policy subcategory settings. Administrators who configure granular auditing may not realize their settings are being ignored, creating a false sense of security.

Remediation: Set SCENoApplyLegacyAuditPolicy to 1 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa and use only Advanced Audit Policy Configuration in Group Policy.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

NIST 800-53: AU-2, AU-12

PCI DSS 4: 10.2.1

HIGH DR-NET-001 — Network: Suspicious Outbound Connection

Description: The Windows Firewall is disabled for the Domain network profile.

Impact: All inbound and outbound traffic is unfiltered when connected to a domain network. Any service listening on any port is exposed to all hosts on the network, enabling lateral movement and direct exploitation.

Remediation: Enable the Windows Firewall for the Domain profile via Group Policy or PowerShell: Set-NetFirewallProfile -Profile Domain -Enabled True. Review and configure appropriate inbound/outbound rules before enabling to avoid disrupting legitimate services.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1071 (Command and Control), T1041 (Exfiltration)

NIST 800-53: SI-4, IR-5

PCI DSS 4: 1.2.1

MEDIUM DR-NET-002 — Network: High-Risk Port Exposed

Description: The Windows Firewall is disabled for the Private network profile.

Impact: All network traffic is unfiltered when connected to private networks. Services and ports that should be restricted are accessible to all devices on the local network segment.

Remediation: Enable the Windows Firewall for the Private profile: Set-NetFirewallProfile -Profile Private -Enabled True.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1021 (Lateral Movement)

NIST 800-53: SC-7, CM-7

PCI DSS 4: 1.2.1

MEDIUM DR-NET-003 — Network: Proxy Configured

Description: The Windows Firewall is disabled for the Public network profile, the most exposed profile.

Impact: When connected to any public or untrusted network (airports, hotels, coffee shops), all services are exposed without any filtering. This is the highest-risk firewall misconfiguration as public networks are inherently hostile.

Remediation: Immediately enable the Windows Firewall for the Public profile: Set-NetFirewallProfile -Profile Public -Enabled True. The Public profile should have the most restrictive ruleset with all inbound connections blocked by default.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1090 (Command and Control)

NIST 800-53: SC-8

PCI DSS 4: 1.2.1

MEDIUM DR-NET-004 — Network: External DNS on Domain Host

Description: A high-risk network port is listening on this endpoint (e.g., 445/SMB, 135-139/RPC, 3389/RDP, 23/Telnet, 21/FTP, 1433/MSSQL, 3306/MySQL, 5432/PostgreSQL).

Impact: High-risk ports are frequent targets for automated scanning and exploitation. Exposed database ports enable direct SQL injection and credential brute-forcing. Exposed management ports enable remote administration attacks.

Remediation: Close or restrict access to unnecessary high-risk ports using Windows Firewall rules. For required services, restrict inbound access to specific authorized IP ranges. Consider using IPsec or VPN for administrative access to sensitive services.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1584.002 (Resource Development)

NIST 800-53: SC-20, SC-21

PCI DSS 4: 1.2.1, 1.3.1

HIGH DR-PERS-001 — Persistence: WMI Event Subscription

Description: Active WMI event subscriptions (EventFilter + EventConsumer + FilterToConsumerBinding) were found on this system. WMI subscriptions execute automatically in response to system events and survive reboots, making them a powerful persistence mechanism.

Impact: WMI event subscriptions run with SYSTEM privileges and are difficult to detect through standard monitoring. An attacker can use them to execute malicious scripts or binaries when specific events occur (user logon, process creation, time-based triggers). WMI persistence is used by APT groups and is notoriously resistant to removal — it survives reinstallation of applications and many cleanup procedures.

Remediation: Review all WMI event subscriptions: Get-WMIObject -Namespace root\Subscription -Class __EventFilter; Get-WMIObject -Namespace root\Subscription -Class __EventConsumer; Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding. Remove any unknown or suspicious subscriptions. Deploy Sysmon with WMI monitoring (Event IDs 19-21). Implement WMI activity logging via Group Policy.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1546.003 (Persistence)

NIST 800-53: SI-4, AU-6, IR-4

PCI DSS 4: 10.6.1, 11.5.1

MEDIUM DR-PERS-002 — Persistence: COM Object Hijacking

Description: COM object registrations in the HKCU registry hive override HKLM registrations for CLSIDs that are loaded by privileged processes. This COM object hijacking technique allows a user-level modification to cause a privileged process to load an attacker-controlled DLL.

Impact: COM hijacking is a stealthy persistence and privilege escalation technique. When a legitimate, privileged application loads a hijacked CLSID, it executes the attacker's DLL with the application's privileges. This survives reboots, is difficult to detect without specific monitoring, and blends with normal COM activity. Many legitimate Windows processes load COM objects during startup.

Remediation: Audit HKCU\Software\Classes\CLSID for entries that shadow HKLM CLSID registrations. Remove unauthorized CLSID overrides. Deploy Sysmon with registry monitoring (Event IDs 12-14) targeting CLSID paths. Implement application whitelisting (AppLocker/WDAC) to prevent loading of unauthorized DLLs from user-writable locations.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1546.015 (Persistence)

NIST 800-53: SI-4, CM-6, SI-7

PCI DSS 4: 11.5.1

HIGH DR-PERS-003 — Persistence: AppInit_DLLs Configured

Description: The AppInit_DLLs registry value is configured with one or more DLL paths. Windows loads any DLL listed in AppInit_DLLs into every process that loads user32.dll — which includes virtually all GUI applications. This mechanism is a well-known persistence and injection technique.

Impact: DLLs specified in AppInit_DLLs are loaded into every GUI process on the system, providing system-wide code injection. An attacker can use this for keylogging, credential interception, API hooking, or persistent backdoor access. The injected DLL runs with the privileges of each host process, potentially including SYSTEM-level services.

Remediation: Clear the AppInit_DLLs registry value: reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /f. Also clear the WOW64 key: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /f. Set LoadAppInit_DLLs to 0 to disable the mechanism entirely. Enable Secure Boot and RequireSignedAppInit_DLLs to restrict to signed DLLs only.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1546.010 (Persistence)

NIST 800-53: SI-4, SI-3, CM-6

PCI DSS 4: 5.3.1, 11.5.1

HIGH DR-PERS-004 — Persistence: IFEO Debugger Set

Description: Image File Execution Options (IFEO) registry entries have a 'Debugger' value set for one or more executables. This causes Windows to launch the specified debugger program instead of (or before) the target executable, effectively hijacking the execution of legitimate programs.

Impact: An attacker can set an IFEO debugger entry for commonly used programs (cmd.exe, powershell.exe, taskmgr.exe) to redirect their execution to a malicious binary. This is a stealthy persistence mechanism that activates whenever the legitimate program is launched. It is also used to prevent security tools from running by redirecting them to an empty program or a kill command.

Remediation: Audit IFEO registry entries: reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s /v Debugger. Remove any unauthorized Debugger values. Deploy Sysmon with registry monitoring (Event IDs 12-14) targeting IFEO keys. Legitimate IFEO uses include application compatibility shims — verify with the application vendor before removing.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1546.012 (Persistence)

NIST 800-53: SI-4, SI-7, CM-6

PCI DSS 4: 5.3.1, 11.5.1

CRITICAL DR-PERS-005 — Persistence: Accessibility Feature Modified

Description: One or more Windows accessibility feature binaries (sethc.exe, utilman.exe, osk.exe, narrator.exe, magnify.exe, DisplaySwitch.exe) have been modified or replaced. The modification timestamp does not align with the OS installation date or last Windows Update, indicating potential tampering.

Impact: Replacing accessibility binaries with cmd.exe or a backdoor is a classic persistence technique that provides SYSTEM-level command prompt access from the Windows login screen — before any user has authenticated. An attacker can press Shift five times (sethc.exe), Win+U (utilman.exe), or similar shortcuts to trigger the backdoor. This survives reboots, user password changes, and most remediation attempts short of restoring the original binaries.

Remediation: Restore original accessibility binaries from a known-good source or Windows installation media: sfc /scannow or DISM /Online /Cleanup-Image /RestoreHealth. Verify file hashes against Microsoft published hashes. Investigate as a potential compromise — this finding indicates the system may have been backdoored. Deploy file integrity monitoring on %SystemRoot%\System32\sethc.exe, utilman.exe, osk.exe, narrator.exe, magnify.exe, DisplaySwitch.exe.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1546.008 (Persistence)

NIST 800-53: SI-7, SI-4, AU-6

PCI DSS 4: 5.3.1, 11.5.1, 10.6.1

MEDIUM DR-PERS-006 — Persistence: Print Monitor DLL

Description: Custom print monitor DLLs were found registered in the system. Print monitors are loaded by the Print Spooler service (spoolsv.exe) which runs as SYSTEM. An unauthorized print monitor DLL provides persistent, SYSTEM-level code execution.

Impact: Print monitor DLLs are loaded by the spoolsv.exe service at startup and run with SYSTEM privileges. An attacker who registers a malicious DLL as a print monitor achieves persistence that survives reboots and is difficult to detect — the DLL appears as a legitimate print subsystem component. This technique is used by APT groups for long-term persistence.

Remediation: Audit print monitor registry entries: reg query "HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors" /s. Compare against known legitimate monitors (Standard TCP/IP Port, WSD Port, USB Monitor, Local Port). Remove any unknown or suspicious monitor entries. Verify DLL signatures for all registered monitor DLLs. Deploy Sysmon with registry monitoring on the Print\Monitors key.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1547.010 (Persistence)

NIST 800-53: SI-4, CM-6

PCI DSS 4: 11.5.1

HIGH DR-PERS-008 — Persistence: LSA Authentication Package Modified

Description: Non-default authentication packages or security support providers (SSPs) are registered in the LSA registry configuration. LSA authentication packages are loaded by lsass.exe at boot and run with SYSTEM privileges. Unauthorized packages can intercept credentials during authentication.

Impact: A malicious LSA authentication package runs inside lsass.exe with SYSTEM privileges and intercepts every authentication event on the system. This allows credential harvesting of all user passwords (including domain admin) in cleartext as they authenticate. This is one of the most powerful persistence mechanisms available, used by advanced threat actors and tools like mimilib.

Remediation: Audit LSA registry entries: reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" and "Security Packages". Default values are 'msv1_0' for Authentication Packages and '' (empty) or 'kerberos msv1_0 schannel wdigest tspkg pku2u' for Security Packages. Remove any unauthorized entries. Enable LSA Protection (RunAsPPL) to prevent unauthorized DLL loading into lsass.exe. Enable Credential Guard for additional protection. Investigate as potential compromise.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1547.002 (Persistence)

NIST 800-53: SI-4, SI-7, IA-5

PCI DSS 4: 5.3.1, 10.6.1, 11.5.1

HIGH DR-PRIV-001 — Privilege Escalation: AlwaysInstallElevated Enabled

Description: The AlwaysInstallElevated policy is enabled in both HKLM and HKCU registry hives. This Windows Installer policy allows any user to install MSI packages with SYSTEM-level privileges, regardless of the user's actual privilege level.

Impact: Any standard user can create a malicious MSI package (e.g., using msfvenom) and install it with SYSTEM privileges. This is a trivial, reliable privilege escalation path that requires no exploitation of software vulnerabilities — only the misconfiguration itself. Tools like PowerUp, WinPEAS, and Metasploit all check for and exploit this setting.

Remediation: Disable AlwaysInstallElevated by setting both registry values to 0: HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated=0 and HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated=0. Apply via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Installer > Always install with elevated privileges = Disabled.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1546.016 (Privilege Escalation)

NIST 800-53: CM-6, AC-6, CM-7

PCI DSS 4: 2.2.1, 7.1.1

HIGH DR-PRIV-002 — Privilege Escalation: Modifiable Service Binary

Description: One or more Windows service executables reside in directories that are writable by non-administrative users, or the service binary file itself has permissive ACLs. This allows a standard user to replace the service binary with a malicious one.

Impact: An attacker can replace or modify a service binary that runs as SYSTEM or a privileged account. On the next service restart (or system reboot), the attacker's code executes with the service account's privileges, typically SYSTEM. This is a reliable privilege escalation technique that persists across reboots.

Remediation: Audit and correct file system permissions on all service binary paths. Service executables should be owned by Administrators/SYSTEM with write access restricted to Administrators only. Use icacls to verify: icacls "C:\path\to\service.exe". Install services only in protected directories (C:\Program Files\). Remove write permissions for Users/Authenticated Users groups on service binary paths.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1574.010 (Persistence)

NIST 800-53: CM-6, AC-6, CM-5

PCI DSS 4: 2.2.1, 6.3.2

MEDIUM DR-PRIV-003 — Privilege Escalation: DLL Search Order Hijacking

Description: One or more directories in the system PATH are writable by non-administrative users. Windows DLL search order loads DLLs from the application directory first, then the system directory, then each PATH directory in order. A writable PATH directory allows an attacker to place a malicious DLL that will be loaded by legitimate applications.

Impact: An attacker can place a crafted DLL in a writable PATH directory with the same name as a DLL that a privileged application expects to load. When the application runs, it loads the attacker's DLL instead, executing arbitrary code with the application's privileges. This is particularly dangerous for services and scheduled tasks running as SYSTEM.

Remediation: Audit all directories in the system PATH and remove write permissions for non-administrative users. Remove unnecessary directories from PATH. Enable SafeDllSearchMode (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode=1). Consider implementing Windows Defender Application Control (WDAC) to restrict DLL loading to signed binaries.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1574.001 (Persistence)

NIST 800-53: CM-6, CM-5, SI-7

PCI DSS 4: 2.2.1, 6.3.2

HIGH DR-PRIV-004 — Privilege Escalation: Dangerous Token Privileges

Description: The current process or service accounts hold dangerous Windows token privileges. SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege enable token impersonation attacks (Potato family exploits). SeDebugPrivilege allows debugging any process including LSASS. SeBackupPrivilege/SeRestorePrivilege bypass file ACLs. SeTcbPrivilege acts as part of the operating system.

Impact: Token impersonation privileges (SeImpersonate, SeAssignPrimaryToken) enable immediate SYSTEM-level privilege escalation via tools like JuicyPotato, PrintSpoofer, RoguePotato, or GodPotato. SeDebugPrivilege allows LSASS memory dumping for credential extraction. These privileges are commonly held by IIS application pool accounts, SQL Server service accounts, and other service identities.

Remediation: Review and minimize token privileges assigned to service accounts. Remove SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege from service accounts where not operationally required. Use Group Managed Service Accounts (gMSA) with minimal privileges. Audit User Rights Assignments via: secpol.msc > Local Policies > User Rights Assignment. Consider running services in Windows containers or AppContainers which restrict available privileges.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1134 (Defense Evasion), T1134.001 (Privilege Escalation)

NIST 800-53: AC-6, AC-6(5), CM-6

PCI DSS 4: 7.1.1, 7.2.1

MEDIUM DR-PRIV-005 — Privilege Escalation: Unquoted Service Path

Description: One or more Windows services have unquoted executable paths containing spaces, AND at least one intermediate directory in the path is writable by non-administrative users. Windows resolves unquoted paths by trying each space-delimited segment as a potential executable.

Impact: An attacker can place an executable at a space-boundary in the unquoted path. For example, if the service path is 'C:\Program Files\Some Service\service.exe' (unquoted), placing 'C:\Program.exe' or 'C:\Program Files\Some.exe' in a writable directory causes it to execute with the service's privileges. This requires both the unquoted path AND a writable intermediate directory to be exploitable.

Remediation: Quote all service binary paths that contain spaces. Fix via registry: reg add "HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>" /v ImagePath /t REG_EXPAND_SZ /d '"C:\Program Files\...\service.exe"' /f. Additionally, restrict write permissions on all intermediate directories in service paths. Identify all unquoted paths: wmic service get name,pathname | findstr /i /v "C:\Windows" | findstr /i " ".

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1574.009 (Persistence)

NIST 800-53: CM-6, CM-5

PCI DSS 4: 2.2.1, 6.3.2

MEDIUM DR-PRIV-006 — Access Control: Named Pipe Permission Weakness

Description: Named pipes on this system have overly permissive access controls, allowing non-administrative users to read, write, or impersonate connections on pipes used by privileged services.

Impact: Improperly secured named pipes can be exploited for privilege escalation or lateral movement. An attacker can connect to a weakly-permissioned pipe to capture or relay authentication tokens, inject commands into service communication channels, or impersonate the pipe server's identity. Named pipe impersonation is a core technique in several Potato-family privilege escalation exploits.

Remediation: Audit named pipe ACLs using pipelist.exe (Sysinternals) and accesschk.exe. Restrict pipe permissions to the minimum required identities. Remove write/connect access for Authenticated Users and Everyone groups on privileged service pipes. Implement pipe security descriptors in service configurations.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1570 (Lateral Movement)

NIST 800-53: AC-3, AC-6

PCI DSS 4: 7.1.1

CRITICAL DR-PROC-001 — Process: Known Malicious Process Detected

Description: One or more running processes match known malicious software signatures in the threat intelligence database. This is a strong indicator of active system compromise requiring immediate incident response.

Impact: Known malicious processes indicate active malware execution. Depending on the malware type (RAT, keylogger, cryptominer, ransomware dropper), the attacker may have full remote access, be exfiltrating data, or preparing for destructive action. The system should be considered compromised.

Remediation: Immediately isolate the system from the network. Capture memory and disk images for forensic analysis before remediation. Identify the malware family and check for persistence mechanisms (scheduled tasks, services, registry run keys, WMI subscriptions). Re-image the system after forensics are complete.

Effort: Major

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1059 (Execution), T1543 (Persistence)

NIST 800-53: SI-3, IR-4

PCI DSS 4: 5.2.1, 11.4.1

HIGH DR-PROC-002 — Process: Running from Temporary Directory

Description: One or more processes are executing from temporary directories (%TEMP%, %TMP%, C:\Windows\Temp). Legitimate software rarely runs from temp folders; this pattern is a strong indicator of malware, dropper activity, or exploitation payload execution.

Impact: Malware commonly stages and executes from temporary directories because they are user-writable, loosely monitored, and files there are expected to be transient. Ransomware droppers, fileless malware stagers, and post-exploitation payloads frequently use temp paths as their execution location.

Remediation: Investigate each process: check file hash against VirusTotal, examine parent process chain, check for associated network connections. Implement AppLocker or WDAC policies to block executable execution from temp directories. Enable Windows Defender ASR rules to block execution from temp paths.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1204 (Execution), T1036.005 (Defense Evasion)

NIST 800-53: CM-7, SI-3

PCI DSS 4: 5.2.1

MEDIUM DR-PROC-003 — Process: No Executable Path

Description: One or more running processes have no associated executable path on disk. This may indicate fileless malware executing entirely from memory, process hollowing, or a process whose binary was deleted after execution.

Impact: Processes without a disk-backed executable path can indicate fileless malware executing entirely from memory, process hollowing (where a legitimate process is replaced in memory with malicious code), or an attacker who deleted the binary after launching it to hinder forensic analysis.

Remediation: Investigate each process: capture a memory dump for forensic analysis, check the parent process chain for suspicious lineage, examine loaded DLLs and handles. Implement Sysmon with process creation logging (Event ID 1) to capture full command lines and parent process details.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1055 (Defense Evasion), T1620 (Defense Evasion)

NIST 800-53: SI-3, SI-4

PCI DSS 4: 5.2.1

CRITICAL DR-PROC-004 — Process: SYSTEM Process in User-Writable Path

Description: One or more processes are running as SYSTEM from user-writable locations (Users, AppData, Downloads, ProgramData, Temp). Legitimate SYSTEM processes run from protected directories (System32, Program Files). This is a strong indicator of privilege escalation or malware with elevated privileges.

Impact: A process running as SYSTEM from a user-writable directory indicates successful privilege escalation. The attacker has achieved the highest local privilege level and can install rootkits, create backdoor accounts, modify security settings, access any file on the system, and pivot to other systems.

Remediation: Immediately investigate: capture memory and disk forensics, identify the privilege escalation vector (service binary hijacking, DLL search order hijacking, unquoted service path). Fix the underlying vulnerability. Deploy WDAC/AppLocker to prevent execution from user-writable paths.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1574.001 (Privilege Escalation), T1574.010 (Persistence)

NIST 800-53: CM-5, AC-6

PCI DSS 4: 6.2.4

CISA KEV

HIGH DR-RMT-001 — Remote Access: Unauthorized RMT Detected

Description: A remote management tool (TeamViewer, AnyDesk, LogMeIn, ConnectWise, Splashtop, etc.) was detected that is not part of the organization's approved toolset.

Impact: Unauthorized remote access tools create unmonitored backdoors into the network. They bypass VPN, firewall, and network security controls by tunneling through standard HTTPS. Attackers frequently install these tools for persistent remote access.

Remediation: Remove unauthorized remote management tools and block their installation via application control policies. If the tool was installed by an attacker, initiate incident response. Maintain an approved remote access solution with centralized logging and multi-factor authentication.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1219 (Command and Control)

NIST 800-53: CM-7, CM-11

PCI DSS 4: 6.3.2, 12.3.1

CISA KEV

MEDIUM DR-RMT-002 — Remote Desktop: RDP Enabled

Description: Remote Desktop Protocol (RDP) is enabled on this system. RDP exposes the system to brute-force attacks, credential stuffing, and known RDP vulnerabilities including BlueKeep (CVE-2019-0708) and DejaBlue.

Impact: An attacker who gains RDP access obtains full interactive control of the system. Without NLA, unauthenticated attackers can reach the login screen and exploit pre-authentication vulnerabilities.

Remediation: Disable RDP if not required. If required, enforce Network Level Authentication (NLA), restrict access via firewall rules to authorized IP ranges, use an RDP gateway, and enable account lockout policies.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1021.001 (Lateral Movement)

NIST 800-53: AC-17

PCI DSS 4: 12.3.1

CISA KEV

MEDIUM DR-RMT-003 — Service Hardening: WinRM Running

Description: Windows Remote Management (WinRM) is running on this system. WinRM allows remote command execution via PowerShell remoting and is a common lateral movement vector used by attackers.

Impact: An attacker with valid credentials can use WinRM to execute arbitrary commands remotely. If basic authentication or unencrypted traffic is allowed, credentials may be captured in transit.

Remediation: Disable WinRM if not required. If required, enforce HTTPS transport, disable basic authentication, configure TrustedHosts to restrict connections, and monitor WinRM event logs for unauthorized access.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1021.006 (Lateral Movement)

NIST 800-53: AC-17, SC-8

PCI DSS 4: 8.3.1

MEDIUM DR-RMT-004 — Service Hardening: SSH Server Enabled

Description: An SSH server (OpenSSH) is running on this Windows system. SSH on Windows endpoints is uncommon and may indicate unauthorized installation, developer tools, or a persistence mechanism installed by an attacker.

Impact: SSH provides encrypted remote shell access that can be used for lateral movement, tunneling, and persistent access. On Windows endpoints, SSH is rarely business-justified and represents an additional attack surface.

Remediation: Disable the OpenSSH Server Windows feature if not required. If required, enforce key-based authentication, disable password login, and restrict access via firewall rules to authorized source IPs.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1021.004 (Lateral Movement)

NIST 800-53: AC-17

PCI DSS 4: 4.2.1

MEDIUM DR-RMT-005 — Service Hardening: Multiple RMT Tools

Description: The OpenSSH Server service is running on this Windows endpoint, providing SSH remote access.

Impact: OpenSSH on Windows provides command-line remote access. While potentially legitimate for administration, it adds an additional remote access vector that should be documented and monitored.

Remediation: If OpenSSH is authorized, ensure it is configured securely: disable root login, use key-based authentication, limit allowed users, and monitor SSH logs. If not authorized, disable the sshd service.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1219 (Command and Control), T1021 (Lateral Movement)

NIST 800-53: CM-7

PCI DSS 4: 12.3.1, 6.3.2

MEDIUM DR-SFT-001 — EOL Software: End-of-Life Software Installed

Description: Software that has reached end-of-life and no longer receives security updates is installed on this endpoint.

Impact: EOL software accumulates unpatched vulnerabilities over time with no vendor fixes available. Publicly known exploits continue to work indefinitely. This represents a permanent and growing security gap.

Remediation: Upgrade or replace end-of-life software with supported versions. If no replacement is available, implement compensating controls (network isolation, application whitelisting) and document the risk acceptance.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A06:2021 - Vulnerable and Outdated Components

MITRE ATT&CK: T1203 (Execution)

NIST 800-53: SA-22, SI-2

PCI DSS 4: 6.3.3

MEDIUM DR-SFT-002 — Software: Remote Access Software

Description: An installed software version is known to contain security vulnerabilities with available updates.

Impact: Running known-vulnerable software versions exposes the system to exploits targeting those specific vulnerabilities. Attackers routinely scan for known vulnerable software versions using automated tools.

Remediation: Update the software to the latest patched version. If updates are not immediately possible, implement compensating controls such as network segmentation and application-level monitoring. Prioritize based on CVSS score and network exposure.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1219 (Command and Control)

NIST 800-53: CM-7, CM-11

PCI DSS 4: 6.3.3

HIGH DR-SFT-003 — Software: Suspicious Startup Item

Description: Development tools (compilers, debuggers, IDEs, scripting language interpreters beyond what the system requires) are installed on a production system.

Impact: Development tools enable an attacker to compile and run custom tools directly on the compromised system, create sophisticated payloads, and debug security controls. Their presence on production systems violates hardening baselines.

Remediation: Remove development tools from production systems. If development work is needed, use separate development environments. Document any exceptions with business justification and compensating controls.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1547.001 (Persistence)

NIST 800-53: SI-4, CM-3

PCI DSS 4: 2.2.4

MEDIUM DR-SFT-004 — Software: P2P/Torrent Software

Description: Software not included in the organization's approved software list was detected. This finding requires per-engagement policy configuration.

Impact: Unauthorized software may introduce vulnerabilities, licensing issues, or compliance violations. It may also indicate shadow IT or user-installed tools that bypass change management.

Remediation: Review unauthorized software with the system owner to determine if it should be added to the approved list or removed. Implement application control policies (AppLocker, WDAC) to prevent installation of unapproved software.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1105 (Command and Control)

NIST 800-53: CM-7, CM-11

PCI DSS 4: 6.3.2

HIGH DR-SFT-005 — Software: Known Vulnerable Software Installed

Description: Installed software matches known vulnerable versions with published CVEs or documented security defects. These versions have public exploits or well-documented attack paths.

Impact: An attacker can exploit known vulnerabilities in installed software to gain unauthorized access, execute arbitrary code, or escalate privileges. Public exploit code and automated exploit frameworks (Metasploit, Nuclei) make exploitation straightforward.

Remediation: Update all identified software to the latest patched version. Where an update is not possible, implement compensating controls: restrict network access to the service, deploy WAF rules, enable exploit prevention features, and increase monitoring.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5, CM-8

PCI DSS 4: 6.3.3, 6.2.4

HIGH DR-SFT-006 — Service Hardening: High-Risk Services Running

Description: High-risk services are actively running, including services that transmit credentials in cleartext (Telnet), allow remote registry manipulation, or expose SNMP information with default community strings.

Impact: Telnet transmits all data including credentials in cleartext. Remote Registry allows attackers to read and modify registry settings remotely. SNMP with default community strings enables full network reconnaissance. FTP transmits credentials in cleartext.

Remediation: Disable unnecessary high-risk services. Replace Telnet with SSH. Replace SNMP v1/v2c with v3 using authentication and encryption. Disable Remote Registry unless required by a specific management tool.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1021 (Lateral Movement)

NIST 800-53: CM-7, SC-8, AC-17

PCI DSS 4: 2.2.4, 2.2.7

LOW DR-SFT-007 — Service Hardening: Unnecessary Services Running

Description: Unnecessary or legacy services are actively running. While individually low-risk, each running service expands the system's attack surface.

Impact: Legacy services like SSDP, UPnP, Computer Browser, and Telephony are rarely needed on servers and can be exploited for reconnaissance, denial of service, or as pivot points in chained attacks.

Remediation: Review each identified service and disable any that are not required for the system's operational role. Set unnecessary services to Disabled startup type.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

NIST 800-53: CM-7

PCI DSS 4: 2.2.4

MEDIUM DR-SFT-008 — Service Hardening: Services Running Under User Accounts

Description: Services are running under domain or local user accounts rather than standard service accounts (LocalSystem, LocalService, NetworkService). These credentials are cached in memory and may have excessive privileges.

Impact: Service account credentials cached in LSASS memory are extractable via Mimikatz or comsvcs.dll MiniDump. If the service account has domain admin or other elevated privileges, compromising this host yields those credentials. Service accounts often have weak, non-rotating passwords.

Remediation: Migrate services to Group Managed Service Accounts (gMSA). For services requiring a user account: enforce minimum privileges, rotate passwords regularly, deny interactive logon, and exclude from privileged groups.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1003.001 (Credential Access)

NIST 800-53: AC-6, IA-5, AC-2

PCI DSS 4: 7.2.1, 8.6.1

HIGH DR-SFT-009 — Software: Network Tunnel or Bypass Tool Installed

Description: Network tunneling or overlay network software is installed. These tools create encrypted channels that can bypass firewall rules, IDS/IPS inspection, and network segmentation controls.

Impact: Tools like cloudflared, ngrok, ZeroTier, Tailscale, and Chisel create encrypted outbound tunnels that bypass perimeter security. An attacker can use them to establish persistent command-and-control channels or expose internal services to the internet without firewall approval.

Remediation: Remove unauthorized tunnel software. If operationally required (e.g., Cloudflare Tunnel), document the business justification, restrict access, and monitor. Block known tunnel endpoints at the firewall. Deploy application control policies.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1572 (Command and Control)

NIST 800-53: CM-7, SC-7, CM-11

PCI DSS 4: 1.2.1, 1.4.2

MEDIUM DR-SFT-010 — Software: Development or Diagnostic Tools on Production Server

Description: Development, diagnostic, or offensive security tools are installed on a production server. These tools lower the post-exploitation barrier by providing compilers, packet analyzers, or debuggers an attacker can use directly.

Impact: Installed compilers can build custom malware on-target. Packet analyzers capture credentials in transit. Debuggers dump process memory including cached credentials from LSASS. These tools eliminate the need for an attacker to upload their own tooling, avoiding endpoint detection.

Remediation: Remove development, diagnostic, and security tools from production servers. Development should occur in isolated environments. If tools are required operationally, document the justification and restrict access via file system ACLs.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1588.002 (Resource Development)

NIST 800-53: CM-7, CM-11

PCI DSS 4: 2.2.4

INFO DR-SFT-011 — Software: Software Installed Without Version Information

Description: Software packages are installed with no version information in the Windows registry. This prevents vulnerability assessment and may indicate manually installed, sideloaded, or malicious software.

Impact: Software without version metadata cannot be checked against vulnerability databases (CVE, NVD). Sideloaded applications and malware that registers itself in the Uninstall registry key often omit version data, making them invisible to patch management and vulnerability scanners.

Remediation: Investigate software with missing version information. Remove unauthorized or unrecognized software. Enforce software installation policies that require standard packaging with version metadata.

Effort: Easy

NIST 800-53: CM-8, CM-11

PCI DSS 4: 2.2.1

HIGH DR-SRV-001 — Authentication: SQL Server Mixed Authentication

Description: SQL Server is configured with mixed authentication mode, allowing both Windows and SQL Server authentication. SQL authentication transmits credentials that may be weaker and harder to audit than Windows/Kerberos authentication.

Impact: Mixed mode enables SQL logins (like 'sa') which are frequently targeted by brute-force attacks. SQL passwords are not subject to Active Directory password policies, may be stored in application config files, and bypass centralized authentication controls.

Remediation: Switch to Windows Authentication mode unless SQL authentication is strictly required. If mixed mode must remain, disable the 'sa' account, enforce strong passwords on all SQL logins, and enable SQL Server Audit for login events.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1110 (Credential Access), T1078.001 (Persistence)

NIST 800-53: IA-2, IA-5

PCI DSS 4: 8.3.1

MEDIUM DR-SRV-002 — Service Hardening: IIS Default Site

Description: IIS is running with the default web site active. The default site exposes server information, may serve default pages, and typically lacks application-specific hardening that production deployments require.

Impact: The default IIS site reveals the web server platform, may expose debug pages or sample applications, and often lacks proper access controls. Attackers use default sites to fingerprint the server and find known vulnerabilities.

Remediation: Remove or stop the 'Default Web Site' if it is not needed. For production sites, create named sites with specific bindings and remove all default content, sample applications, and documentation.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1082 (Discovery)

NIST 800-53: CM-7

PCI DSS 4: 8.3.1

CISA KEV

MEDIUM DR-SRV-003 — Service Hardening: Unnecessary Server Roles

Description: Server roles (DHCP, DNS, AD DS, Hyper-V, IIS, etc.) are installed on this workstation. Server roles on workstations expand the attack surface with services not intended for endpoint use.

Impact: Each server role introduces additional listening services, open ports, and potential vulnerabilities. On a workstation, these roles are rarely monitored or patched with the same rigor as production servers.

Remediation: Remove unnecessary server roles via Server Manager or DISM. Workstations should not run server infrastructure services unless specifically authorized and hardened.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1210 (Lateral Movement), T1543.003 (Persistence)

NIST 800-53: CM-7

PCI DSS 4: 8.6.1

MEDIUM DR-SRV-004 — Service Hardening: Web Server on Workstation

Description: A web server (IIS, Apache, Nginx, XAMPP, WAMP, etc.) is running on this workstation. Web servers on endpoints are often development installations with default configurations and no hardening.

Impact: Web servers on workstations are typically unmonitored, lack WAF protection, may expose sensitive development data, and are frequently misconfigured with directory listing, debug modes, or default credentials enabled.

Remediation: Remove web server software from workstations. Use dedicated servers or containerized development environments. If a local dev server is required, ensure it binds only to localhost (127.0.0.1).

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: CM-7

PCI DSS 4: 6.3.3

CISA KEV

HIGH DR-SYS-001 — EOL Software: End-of-Life Windows Version

Description: The Windows operating system version running on this endpoint has reached end-of-life and no longer receives security updates from Microsoft.

Impact: An attacker can exploit publicly disclosed vulnerabilities that will never be patched, leading to full system compromise. The organization also faces compliance violations as most frameworks require supported software.

Remediation: Upgrade the operating system to a currently supported version of Windows that receives regular security updates. For Windows Server environments, plan a migration path to Server 2019 or later. For desktop systems, upgrade to Windows 10 22H2 or Windows 11. Coordinate with application owners to verify compatibility before migration.

Effort: Major

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 - Vulnerable and Outdated Components

MITRE ATT&CK: T1210 (Lateral Movement)

NIST 800-53: SA-22, SI-2, CM-6

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM DR-SYS-002 — Patch Management: Missing Critical Updates

Description: The endpoint has critical or important security updates pending installation, leaving known vulnerabilities unpatched.

Impact: Attackers can exploit publicly known vulnerabilities with available patches. Delayed patching is one of the most common vectors for ransomware and lateral movement within enterprise networks.

Remediation: Install all pending critical and important security updates immediately. Configure Windows Update or WSUS to automatically download and install security updates on a regular schedule. Establish a patch management process with a maximum 30-day window for critical updates and 90 days for important updates.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 - Vulnerable and Outdated Components

MITRE ATT&CK: T1203 (Execution)

NIST 800-53: SI-2, CM-6

PCI DSS 4: 6.3.3

MEDIUM DR-SYS-003 — Patch Management: Windows Update Disabled

Description: The Windows Update service (wuauserv) is disabled or stopped, preventing automatic security update installation.

Impact: Without the update service running, the system will not receive security patches, accumulating vulnerabilities over time. This creates a growing attack surface that adversaries can exploit.

Remediation: Enable the Windows Update service by setting its startup type to Automatic and starting the service. Verify that Group Policy is not overriding this setting. If WSUS or SCCM is used for update management, ensure the client agent is properly configured and communicating with the update server.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1562.001 (Defense Evasion)

NIST 800-53: SI-2, CM-6

PCI DSS 4: 6.3.3

INFO DR-SYS-004 — Patch Management: WSUS Not Configured

Description: No Windows Server Update Services (WSUS) or equivalent centralized update management solution is configured for this endpoint.

Impact: Without centralized update management, there is no visibility into the patch compliance status of this endpoint. Updates depend on individual machine settings, making enterprise-wide patch compliance difficult to enforce and verify.

Remediation: Configure a centralized update management solution such as WSUS, SCCM, or Intune. Point this endpoint to the organization's WSUS server via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify intranet Microsoft update service location).

Effort: Moderate

OWASP Web: A05:2021 - Security Misconfiguration

NIST 800-53: SI-2, CM-2

PCI DSS 4: 6.3.3

LOW DR-SYS-005 — Patch Management: System Uptime Exceeds 90 Days

Description: The system has been running for over 90 days without a reboot, which may indicate that kernel-level patches requiring a restart have not been applied.

Impact: Many Windows security updates require a system restart to take effect. Extended uptime suggests these updates have been downloaded but not fully installed, leaving kernel-level vulnerabilities unpatched.

Remediation: Schedule a maintenance window to restart the system and apply any pending updates that require a reboot. Establish a regular reboot schedule aligned with the organization's patch management cycle, typically monthly following Patch Tuesday.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A06:2021 - Vulnerable and Outdated Components

NIST 800-53: SI-2

PCI DSS 4: 6.3.3

MEDIUM DR-SYS-006 — Patch Management: No Backup Configured

Description: No Windows backup solution (Windows Server Backup, System Restore, or third-party backup) is configured on this endpoint.

Impact: Without backups, data loss from ransomware, hardware failure, or accidental deletion is unrecoverable. This significantly increases the business impact of any destructive attack or system failure.

Remediation: Configure Windows Server Backup or a third-party backup solution to perform regular system state and data backups. Store backups on a separate, isolated storage target. Test backup restoration procedures regularly to ensure recoverability.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1490 (Impact)

NIST 800-53: CP-9, CP-10

PCI DSS 4: 12.10.1

MEDIUM DR-SYS-007 — Patch Management: Last Backup Over 30 Days

Description: The most recent backup on this system is older than 30 days, indicating that backup jobs may have failed or been disabled.

Impact: A stale backup means up to 30+ days of data would be lost in a disaster recovery scenario. Critical business data, configuration changes, and system state captured after the last backup cannot be restored.

Remediation: Investigate why backups have not completed recently. Check backup job schedules, storage target availability, and backup service health. Resume regular backup operations and configure alerting for backup failures.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1490 (Impact)

NIST 800-53: CP-9

PCI DSS 4: 12.10.1

MEDIUM DR-SYS-008 — System Hardening: BitLocker Not Enabled

Description: BitLocker Drive Encryption is not enabled on one or more fixed drives, leaving data at rest unprotected.

Impact: If the device is stolen or a hard drive is physically removed, all data on unencrypted volumes is accessible without authentication. This includes cached credentials, local databases, documents, and application data.

Remediation: Enable BitLocker Drive Encryption on all fixed drives. Use TPM+PIN for pre-boot authentication where possible. Store recovery keys in Active Directory or a centralized key management solution. For systems without TPM, use USB key-based or password-based protectors.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1005 (Collection)

NIST 800-53: SC-28

PCI DSS 4: 3.5.1

INFO DR-SYS-009 — System Hardening: TPM Not Available

Description: No Trusted Platform Module (TPM) is available or the TPM is not in a ready state on this endpoint.

Impact: Without a functional TPM, hardware-rooted security features such as BitLocker with TPM-based protectors, Credential Guard, and Measured Boot cannot be used. The system must rely on software-only security mechanisms which are more susceptible to tampering.

Remediation: If the hardware supports TPM, enable it in the BIOS/UEFI firmware settings and initialize it through the TPM Management console (tpm.msc). For virtual machines, enable virtual TPM through the hypervisor. If the hardware does not support TPM, consider hardware replacement during the next refresh cycle.

Effort: Moderate

NIST 800-53: SC-28

PCI DSS 4: 3.5.1

MEDIUM DR-SYS-010 — System Hardening: Secure Boot Not Enabled

Description: UEFI Secure Boot is not enabled on this endpoint, allowing unsigned or tampered boot components to execute during system startup.

Impact: An attacker with physical access or kernel-level privileges can install a bootkit or rootkit that loads before the operating system, persisting across reinstalls and evading all OS-level security controls including antivirus and EDR.

Remediation: Enable Secure Boot in the system's UEFI firmware settings. Ensure the operating system was installed in UEFI mode (not legacy BIOS). Verify that all boot components (bootloader, kernel, drivers) are properly signed. Note that enabling Secure Boot on a legacy BIOS-installed system requires OS reinstallation in UEFI mode.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 - Security Misconfiguration

MITRE ATT&CK: T1542.003 (Persistence)

NIST 800-53: SI-7, CM-6

PCI DSS 4: 2.2.1

MEDIUM DR-SYS-011 — Monitoring: Sysmon Not Installed

Description: Sysmon (System Monitor) is not installed on this system. Sysmon provides detailed telemetry about process creation, network connections, file creation, registry modifications, WMI events, and other security-relevant activities that are essential for threat detection and incident response.

Impact: Without Sysmon, the system lacks granular visibility into process execution (with command lines and parent process chains), network connections per-process, file creation timestamps and hashes, registry modifications, WMI activity, and named pipe operations. This severely limits the ability to detect and investigate malicious activity, lateral movement, and persistence mechanisms. Native Windows event logs lack the detail that Sysmon provides.

Remediation: Install Sysmon from Microsoft Sysinternals: sysmon64.exe -accepteula -i sysmonconfig.xml. Use a community-maintained configuration such as SwiftOnSecurity/sysmon-config or olafhartong/sysmon-modular as a starting point. Key event types to enable: Process creation (Event 1), Network connection (Event 3), File creation (Event 11), Registry modification (Event 13), WMI events (Events 19-21). Forward Sysmon logs to a SIEM for detection and alerting.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP Web: A09:2021 - Security Logging and Monitoring Failures

MITRE ATT&CK: T1562.001 (Defense Evasion)

NIST 800-53: AU-2, AU-3, AU-12, SI-4

PCI DSS 4: 10.2.1, 10.6.1

CRITICAL DR-SYS-012 — Service Hardening: PrintNightmare Vulnerable

Description: The system is vulnerable to PrintNightmare (CVE-2021-34527 / CVE-2021-1675). The Print Spooler service is running AND the RestrictDriverInstallationToAdministrators registry key is not set to 1, or the NoWarningNoElevationOnInstall / UpdatePromptSettings Point-and-Print restriction keys are configured unsafely.

Impact: PrintNightmare allows any authenticated user (local or remote) to execute arbitrary code with SYSTEM privileges by exploiting the Print Spooler service's driver installation functionality. This vulnerability was actively exploited in the wild and provides reliable remote code execution. On domain controllers, it enables immediate domain compromise. Multiple exploit variants exist in public tooling.

Remediation: 1) Install all PrintNightmare patches (KB5004945 and later cumulative updates). 2) Set RestrictDriverInstallationToAdministrators=1: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 1 /f. 3) Set NoWarningNoElevationOnInstall=0 and UpdatePromptSettings=0 in the same key. 4) On servers that do not need printing, disable the Print Spooler service entirely: Stop-Service Spooler; Set-Service Spooler -StartupType Disabled. 5) On domain controllers, always disable Print Spooler.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 - Vulnerable and Outdated Components

MITRE ATT&CK: T1547.012 (Persistence)

NIST 800-53: CM-6, SI-2, AC-6

PCI DSS 4: 6.3.3, 2.2.1

CISA KEV

MEDIUM DR-SYS-013 — Network Hardening: DNS Zone Transfer Allowed

Description: The DNS server role is installed and zone transfers (AXFR) are allowed to any requestor, or are not restricted to specific secondary DNS servers. This allows any host to download the complete contents of DNS zones, including all hostnames, IP addresses, and service records.

Impact: Unrestricted DNS zone transfers expose the entire internal DNS namespace to any attacker who can reach the DNS server. This provides a complete map of internal hosts, services, domain controllers, and other infrastructure without triggering typical detection mechanisms. The information enables targeted attacks against specific systems and services identified through the zone data.

Remediation: Restrict zone transfers to authorized secondary DNS servers only. In DNS Manager: right-click zone > Properties > Zone Transfers > uncheck 'Allow zone transfers' or select 'Only to the following servers' and list authorized secondaries. For AD-integrated zones, consider disabling zone transfers entirely and relying on AD replication. Verify with: nslookup > set type=AXFR > ls -d <domain>.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1590.002 (Reconnaissance)

NIST 800-53: AC-3, SC-8, CM-6

PCI DSS 4: 1.3.1

MEDIUM DR-USR-001 — Account Management: Built-in Administrator Enabled

Description: The built-in Administrator account (RID 500) is enabled on this endpoint.

Impact: The built-in Administrator is a well-known target for brute force attacks and cannot be locked out by default. If compromised, it provides full system control. Attackers specifically target this account during password spraying and pass-the-hash attacks.

Remediation: Disable the built-in Administrator account and create named individual admin accounts. If the built-in account must remain enabled for emergency access, rename it and set a complex password stored in a password vault. Consider implementing LAPS for local admin password management.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1078.001 (Persistence)

NIST 800-53: AC-2, AC-6

PCI DSS 4: 8.6.1

HIGH DR-USR-002 — Account Management: Guest Account Enabled

Description: The built-in Guest account is enabled on this endpoint, allowing unauthenticated or minimally-authenticated access.

Impact: The Guest account provides a foothold for unauthenticated access to the system. Even with limited privileges, it can be used for local enumeration, accessing public shares, and as a stepping stone for privilege escalation.

Remediation: Disable the Guest account immediately: net user Guest /active:no. Verify via Group Policy that it remains disabled.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1078.001 (Persistence)

NIST 800-53: AC-2

PCI DSS 4: 8.6.1

MEDIUM DR-USR-003 — Account Management: Password Never Expires

Description: One or more interactive user accounts have the 'Password never expires' flag set.

Impact: Passwords that never expire may remain unchanged for years, increasing the window for compromise through credential theft or brute force. Compliance frameworks universally require periodic password rotation.

Remediation: Remove the 'Password never expires' flag from interactive user accounts. Implement a maximum password age policy (60-90 days). Service accounts should use managed service accounts (gMSA) or be documented with compensating controls if password expiry would break functionality.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1078 (Persistence)

NIST 800-53: IA-5

PCI DSS 4: 7.2.1

MEDIUM DR-USR-004 — Account Management: Excessive Local Administrators

Description: The local Administrators group contains more than 3 members, indicating excessive administrative access.

Impact: Each local administrator account is a potential credential for full system compromise. Excessive admin accounts increase the attack surface for pass-the-hash, credential theft, and privilege abuse. Lateral movement is easier when admin credentials are widespread.

Remediation: Review the local Administrators group and remove unnecessary members. Implement the principle of least privilege using standard user accounts for daily operations. Consider implementing LAPS and just-in-time admin access solutions.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A01:2021 - Broken Access Control

MITRE ATT&CK: T1078.003 (Privilege Escalation)

NIST 800-53: AC-6, AC-2

PCI DSS 4: 8.3.9

HIGH DR-USR-005 — Policy: Weak Password Policy

Description: The local password policy does not meet security baselines: minimum length is less than 8 characters and/or password complexity requirements are disabled.

Impact: Weak password policies allow users to set easily guessable passwords. Short passwords without complexity requirements can be cracked in seconds using modern hardware, making brute force and dictionary attacks trivially successful.

Remediation: Set minimum password length to at least 12 characters and enable complexity requirements. Configure via Group Policy: Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy. Consider implementing a password filter or Azure AD Password Protection to block common passwords.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1110 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 8.3.6

MEDIUM DR-USR-006 — Authentication: Account Lockout Not Configured

Description: The account lockout threshold is set to 0 (disabled), allowing unlimited failed login attempts without locking the account.

Impact: Without account lockout, attackers can perform unlimited password guessing attacks against all accounts without triggering any lockout defense. Password spraying and brute force attacks can continue indefinitely.

Remediation: Configure account lockout policy: set lockout threshold to 5-10 failed attempts, lockout duration to 30 minutes, and reset counter after 30 minutes. Apply via Group Policy: Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1110 (Credential Access)

NIST 800-53: AC-7

PCI DSS 4: 8.3.4