14 lines
589 B
Markdown
14 lines
589 B
Markdown
- Registry
|
|
- WDigest enable
|
|
- `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential`
|
|
- Set to "1"
|
|
- LSA Secrets
|
|
- `HKLM\SECURITY\Policy\Secrets`
|
|
- Accounts found here:
|
|
- Domain Computer Account
|
|
- Changes every 30 days, can be used to generate Silver ticket or perform RBCD attack
|
|
- Autologon
|
|
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`
|
|
- DPAPI master keys
|
|
- Applocker rules - `HKLM\Software\Policies\Microsoft\Windows\SrpV2`
|
|
- Restricted admin - `HKLM\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin` |