Individual Hardening Techniques

This section has all of the individual documentation for each hardening technique. The techniques we focused in on were the ones that I have either exploited as part of Red Team engagements, been on the receiving end of from an Incident Response effort. These are very common attack tactics that I see many Offensive Security Teams, and threat actors alike take advantage of for various exploitation efforts.

  1. Disable LLMNR, Disable mDNS, Disable NetBios Name Solution (NBNS) combined into single document
  2. Enable SMB Signing
  3. Disable WPAD
  4. Force NTLMv2 or higher
  5. Restrict Null Sessions
  6. Disable WDigest
  7. Restrict AT.exe
  8. Prefer IPv4 over IPv6
  9. Enable Windows Firewall Logging (Detective, not preventative)
  10. Disable PowerShell V2
  11. Enable PowerShell Script Block Logging (Detective, not preventative)
  12. Remove SeDebug Privilege from Users in the Linked OU
  13. Enable Restricted Admin Mode
  14. Enable LSA Protection
  15. Disable Credential Caching (Set to 0 Cached Credentials)
  16. Disable Internet Explorer
  17. Enable SEHOP (Structured Exception Handler Overwrite Protection)
  18. Disable Reversible Password Encryption
  19. Enable LDAP Signing
  20. Disable Insecure Logons to an SMB Server
  21. Restrict Anonymous Access to Named Pipes and Shares
  22. ASR (Attack Surface Reduction) Rules