D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
opt
/
osquery
/
share
/
osquery
/
packs
/
Filename :
windows-hardening.conf
back
Copy
{ "platform": "windows", "queries": { "OpenType_Font_Driver_Vulnerability": { "query" : "select * from registry where path like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\%' AND name = 'DisableATMFD' AND data != '1';", "interval" : "3600", "version": "2.2.1", "description" : "Determine if Adobe Type Manager Font Driver is disabled (https://technet.microsoft.com/en-us/library/security/ms15-078)" }, "Protecting_Against_Weak_Crypto_Algo": { "query" : "select * from registry where path like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\Default\\%' AND name IN ('WeakSha1ThirdPartyFlags','WeakMd5ThirdPartyFlags') AND type = 'REG_DWORD' AND data not like '-2%';", "interval" : "3600", "version": "2.2.1", "description" : "Determine if Windows is configured to log certificates with weak crypto (https://technet.microsoft.com/library/dn375961(v=ws.11).aspx)", "value" : "Artifact used by this malware" }, "UAC_Disabled": { "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA' AND data=0;", "interval": 3600, "version": "2.2.1", "description": "Controls UAC. A setting of 0 indicates that UAC is disabled." }, "SecureBoot": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecureBoot\\State\\UEFISecureBootEnabled'", "interval": "86400", "snapshot": true, "description" : "Whether Secureboot is enabled" }, "FontBlocking": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\MitigationOptions\\MitigationOptions_FontBlocking'", "interval": "86400", "snapshot": true, "description" : "Whether FontBlocking is enabled" }, "DepPolicy": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemStartOptions'", "interval": "86400", "snapshot": true, "description" : "Whether DEP is enabled" }, "MitigationOptions": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Kernel\\MitigationOptions'", "interval": "86400", "snapshot": true, "description" : "Whether DEP is enabled with application mitigation options" }, "MoveImages": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\moveImages'", "interval": "86400", "snapshot": true, "description" : "Check ASLR configuration" }, "KernelSehopEnabled": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Kernel\\KernelSEHOPEnabled'", "interval": "86400", "snapshot": true, "description" : "Whether SEHOP is enabled" }, "EnableCertPaddingCheck": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\WinTrust\\Config\\EnableCertPaddingCheck'", "interval": "86400", "snapshot": true, "description" : "Determine state of Certificate Padding (https://docs.microsoft.com/en-us/security-updates/securityadvisories/2014/2915720)" }, "EnableCertPaddingCheck_wow64": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\WinTrust\\Config\\EnableCertPaddingCheck'", "interval": "86400", "snapshot": true, "description" : "Determine state of Certificate Padding (https://docs.microsoft.com/en-us/security-updates/securityadvisories/2014/2915720)" }, "CwdIllegalInDllSearch": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\CWDIllegalInDllSearch'", "interval": "86400", "snapshot": true, "description" : "Check Secure Search Path state (https://support.microsoft.com/en-us/help/2264107/a-new-cwdillegalindllsearch-registry-entry-is-available-to-control-the)" }, "DisabledExceptionChainValidation": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\kernel\\DisableExceptionChainValidation'", "interval": "86400", "snapshot": true, "description" : "Check SEHOP state: DisabledExceptionChainValidation" }, "EnableLowVaAccess": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\EnableLowVaAccess'", "interval": "86400", "snapshot": true, "description" : "Check Kernel Null page state" }, "ControlFlowGuard": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\EnableCfg'", "interval": "86400", "snapshot": true, "description" : "Check Control Flow Guard state" }, "App_ExecuteOptions": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\%Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\%\\executeOptions'", "interval": "86400", "snapshot": true, "description" : "Check Applications opted in for DEP" }, "App_MitigationOptions": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\%Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\%\\MitigationOptions'", "interval": "86400", "snapshot": true, "description" : "Check Applications opted in for DEP" }, "AppCompat": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\%Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers'", "interval": "86400", "snapshot": true, "description" : "Check Applications opted in for DEP" }, "App_disabledExceptionChainValidation": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\%Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\%\\DisableExceptionChainValidation'", "interval": "86400", "snapshot": true, "description" : "Check Applications not supporting SEHOP" }, "DefaultLevelMachine": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\DefaultLevel'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state" }, "DefaultLevelUser": { "query" : "select * from registry where key like 'HKEY_USERS\\%\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\DefaultLevel'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state" }, "PolicyScopeMachine": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\PolicyScope'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state" }, "PolicyScopeUser": { "query" : "select * from registry where key like 'HKEY_USERS\\%\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\PolicyScope'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state" }, "ExecutableTryMachine": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\ExecutableTry'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state" }, "ExecutableTryUser": { "query" : "select * from registry where key like 'HKEY_USERS\\%\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\ExecutableTry'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state" }, "TransparentEnabledMachine": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\TransparentEnabled'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state" }, "TransparentEnabledUser": { "query" : "select * from registry where key like 'HKEY_USERS\\%\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\TransparentEnabled'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state" }, "Unrestricted": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state: No SRP allow list rules" }, "Unrestricted_Paths": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144\\Paths'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state: No SRP path rules" }, "Unrestricted_Paths_ItemData": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144\\Paths\\%\\ItemData'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state: SRP allow list rules is missing" }, "Disallowed": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state: No SRP deny list rules" }, "Disallowed_Paths": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\Paths'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state: No SRP path rules" }, "Disallowed_Paths_ItemData": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\Paths\\%\\ItemData'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state: SRP deny list rule is missing" }, "SaferFlags": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\%\\%\\%\\SaferFlags'", "interval": "86400", "snapshot": true, "description" : "Check Software Restriction Policies state: SRP rule is not enforcing" }, "RuleSetEnforcementMode": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\SrpV2\\%\\EnforcementMode'", "interval": "86400", "snapshot": true, "description" : "Check Applocker rule set configuration" }, "Rule": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\SrpV2\\%\\%\\Value'", "interval": "86400", "snapshot": true, "description" : "Check Applocker rule set" }, "AuditSpecialGroups": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Audit'", "interval": "86400", "snapshot": true, "description" : "Check Special Logon Audit configuration - https://blogs.technet.microsoft.com/jepayne/2015/11/26/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts/" }, "SysmonConfig": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SYSTEM\\CCS\\Services\\SysmonDrv\\Parameters'", "interval": "86400", "snapshot": true, "description" : "Check Microsoft Sysinternals Sysmon config" }, "DeveloperMode": { "query" : "select * from registry where key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock'", "interval": "86400", "snapshot": true, "description" : "Check Developer Mode state" } } }