Security feature bypass

Windows Defender Credential Guard Security Feature Bypass Vulnerability...

CVE-2022-21921

CVE-2022-21921 is a Windows Defender Credential Guard security feature bypass. Connected documents identify Windows Defender as affected, with the issue categorized as a security-measure bypass (CVSS/Impact cited in sources such as Microsoft KBs and security advisories). The root cause and exact ...

CVE-2022-21921 Windows Defender Credential Guard Security Feature Bypass Vulnerability

...

Windows Defender Credential Guard Security Feature Bypass Vulnerability

...

Windows 11 is out. Is it any good for security?

Windows 11, the latest operating system OS from Microsoft, launches today, and organizations have begun asking themselves when and if they should upgrade from Windows 10 or older versions. The requirements and considerations of each organization will be different, and many things will inform the...

WdToggle - A Beacon Object File (BOF) For Cobalt Strike Which Uses Direct System Calls To Enable WDigest Credential Caching

A Proof of Concept Cobalt Strike Beacon Object File which uses direct system calls to enable WDigest credential caching and circumvent Credential Guard if enabled. Additional guidance can be found in this blog post: https://outflank.nl/blog/?p=1592 Background This PoC code is based on the followi...

System Management Mode deep dive: How SMM isolation hardens the platform

Ensuring that the platform firmware is healthy and trustworthy is fundamental to guaranteeing that powerful platform security features like Hypervisor-protected code integrity HVCI and Windows Defender Credential Guard are functioning as expected. Windows 10 achieves this by leveraging a...

November 10, 2020—KB4586830 (OS Build 14393.4046) - EXPIRED

None None...

Abusing RDP’s Remote Credential Guard with Rubeus PTT

TL;DR Microsoft’s Remote Credential Guard RCG for RDP protects creds if an RDP server is compromised. It leaves little scope for password or NTLM credential dumping when a user connects to the server. It does however introduce workstation attack vectors. Abusing a user’s Kerberos token allows...

April 14, 2020—KB4550939 (OS Build 15063.2346)

None None...

March 17, 2020—KB4541331 (OS Build 17763.1131)

None None...

March 17, 2020—KB4541333 (OS Build 17134.1399)

None None...

March 10, 2020—KB4540705 (OS Build 15063.2313)

None None...

SYS.1.2.2.A8

Ziel des Bausteins SYS.1.2.2 ist die Absicherung von Microsoft Windows Server 2012 und Microsoft Windows Server 2012 R2. Die Standard-Anforderung Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify...

SYS.1.2.2.A6

Ziel des Bausteins SYS.1.2.2 ist die Absicherung von Microsoft Windows Server 2012 und Microsoft Windows Server 2012 R2. Die Standard-Anforderung Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify...

SYS.2.2.3.A11

Ziel des Bausteins SYS.2.2.3 ist der Schutz von Informationen, die durch und auf Windows 10-Clients verarbeiten werden. Die Standard-Anforderung SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...

Servicing stack update for Windows 10 version 1903: October 8, 2019

None None...

Servicing stack update for Windows 10 version 1709: October 8, 2019

None None...

Servicing stack update for Windows Server 2012: October 8, 2019

Servicing stack update for Windows Server 2012: October 8, 2019 Summary This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Key changes include the following: Improves the Secure Boot revocation list DBX update experience to avoid...

Microsoft Windows: Turn On Virtualization Based Security (Credential Guard Configuration)

Specifies whether Virtualization Based Security is enabled. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections requir...