What is Black Cat White Hat Security - Security Frameworks?

Governance, risk, and compliance (GRC) is a holistic approach to governance, risk management, and regulatory compliance, used by companies, governments, and other organizations to ensure they meet regulatory requirements while running their operations effectively.

What is Black Cat White Hat Security - Defend & Respond?

Our comprehensive IT management strategy ensures complete visibility and protection across your digital infrastructure by leveraging robust Asset Information and Incident Response SIEM (Security Information and Event Management) monitoring. When anomalies arise, our structured Incident Response protocols seamlessly activate alongside dedicated MSP Support to mitigate risks immediately. This proactive defense is backed by Technical Support, providing your organization with continuous operational uptime and expert troubleshooting whenever a vulnerability or system issue occurs.

What is Black Cat White Hat Security - Assessment Gambit?

A suite of 16 assessments featuring 1600 curated questions. A gauntlet designed to push your skills to the breaking point.

BCWH Contact Privacy Licensing Join Now Login

Frameworks Defend & Respond Assessments Digital

BCWHSendpoint 1.5

BCWHSendpointIR 1.3

Windows Endpoint Protection

PowerShell for Endpoint Security. These commands will close up some endpoint issues that are defined in Microsoft's Secure Score and other Windows security products. You can download them all using BCWHSendpoint 1.5.

PowerShell - BCWHSendpoint 1.5

The install and use of the BCWHSendpoint is pretty straight forward. Open Windows PowerShell with Administrative access and copy and paste the commands below. Each function is listed below with more information.

BCWHSendpoint 1.5 Installation

Install-PackageProvider -Name NuGet -RequiredVersion 2.8.5.201 -Force;
Import-PackageProvider -Name NuGet -RequiredVersion 2.8.5.201;

Install-Module -Name BCWHSendpoint -RequiredVersion 1.5 -Force;
Import-Module -Name BCWHSendpoint -RequiredVersion 1.5;

This module is registered with PowerShell Gallery

A majority of these controls are low impact and shouldn't disrupt your workflow however, caution is advised depending on your setup.

To enable all modules: Set-BCWHSallOn

To revert all modules: Set-BCWHSallOff

1) Block outdated ActiveX controls for Internet Explorer

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext" -Name 'VersionCheckEnabled' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod1On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext" -Name 'VersionCheckEnabled' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod1Off

2) Disable 'Autoplay for non-volume devices'

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutoplayfornonVolume' -Value 1;
New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows" -Name 'Explorer' -Force;
New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Explorer" -Name 'NoAutoplayfornonVolume' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod2On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutoplayfornonVolume' -Value 0;
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Explorer" -Name 'NoAutoplayfornonVolume' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod2Off

3) Disable 'Autoplay' for all drives

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoDriveTypeAutoRun' -Value 255;

BCWHSendpoint 1.5: Set-BCWHSmod3On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoDriveTypeAutoRun' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod3Off

4) Disable 'Continue running background apps when Google Chrome is closed'

Set
New-Item -Path "HKLM:\Software\Policies" -Name 'Google' -Force;
New-Item -Path "HKLM:\Software\Policies\Google" -Name 'Chrome' -Force;
New-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BackgroundModeEnabled' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod4On

Revert
Set-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BackgroundModeEnabled' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod4Off

5) Disable 'Enumerate administrator accounts on elevation'

Set
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" -Name 'CredUI' -Force;
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Name 'EnumerateAdministrators' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod5On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Name 'EnumerateAdministrators' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod5Off

6) Disable 'Password Manager'

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\" -Name "PasswordManagerEnabled" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod28On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\" -Name "PasswordManagerEnabled" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod28Off

7) Disable Anonymous enumeration of shares

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name 'RestrictAnonymous' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod6On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name 'RestrictAnonymous' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod6Off

8) Disable Insecure guest logons in SMB

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\" -Name "AllowInsecureGuestLogons" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod39On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\" -Name "AllowInsecureGuestLogons" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod39Off

9) Disable Installation and configuration of Network Bridge on your DNS domain network

Set
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Network Connections\" -Name "NC_AllowNetBridge_NLA" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod30On

Revert
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Network Connections\" -Name "NC_AllowNetBridge_NLA" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod30Off

10) Disable IP Source routing

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\" -Name 'DisableIPSourceRouting' -Value 2;

BCWHSendpoint 1.5: Set-BCWHSmod7On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\" -Name 'DisableIPSourceRouting' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod7Off

11) Disable JavaScript/Flash on Adobe Reader DC

Set
New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\" -Name 'Acrobat Reader' -Force;
New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader" -Name 'DC' -Force;
New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC" -Name 'FeatureLockDown' -Force;
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bDisableJavaScript' -Value 1;
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bEnableFlash' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod8On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bDisableJavaScript' -Value 0;
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bEnableFlash' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod8Off

12) Disable Microsoft Defender Firewall notifications when programs are blocked for Domain/Public/Private profile

Set
New-Item -Path "HKLM:\Software\Policies\Microsoft" -Name 'WindowsFirewall' -Force;
New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'DomainProfile' -Force;
New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'PrivateProfile' -Force;
New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'PublicProfile' -Force;
New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name 'DisableNotifications' -Value 1;
New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile" -Name 'DisableNotifications' -Value 1;
New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile" -Name 'DisableNotifications' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod9On

Revert
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name 'DisableNotifications' -Value 0;
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile" -Name 'DisableNotifications' -Value 0;
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile" -Name 'DisableNotifications' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod9Off

13) Disable running or installing downloaded software with invalid signature

Set
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\" -Name 'Internet Explorer' -Force;
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer" -Name 'Download' -Force;
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Download\" -Name 'RunInvalidSignatures' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod10On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Download\" -Name 'RunInvalidSignatures' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod10Off

14) Disable sending unencrypted password to third-party SMB servers

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\" -Name "SealSecureChannel" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod42On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\" -Name "SealSecureChannel" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod42Off

15) Disable SMBv1 client driver

Set
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart;

BCWHSendpoint 1.5: Set-BCWHSmod40On

Revert
Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart;

BCWHSendpoint 1.5: Set-BCWHSmod40Off

16) Disable SMBv1 server

Set
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force;

BCWHSendpoint 1.5: Set-BCWHSmod41On

Revert
Set-SmbServerConfiguration -EnableSMB1Protocol $true -Force;

BCWHSendpoint 1.5: Set-BCWHSmod41Off

17) Disable the local storage of passwords and credentials

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "DisableDomainCreds" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod31On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "DisableDomainCreds" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod31Off

18) Disable WDigest Authentication

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\" -Name "UseLogonCredential" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod43On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\" -Name "UseLogonCredential" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod43Off

19) Enable 'Apply UAC restrictions to local accounts on network logons'

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name 'LocalAccountTokenFilterPolicy' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod11On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name 'LocalAccountTokenFilterPolicy' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod11Off

20) Enable 'Block third party cookies'

Set
New-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BlockThirdPartyCookies' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod12On

Revert
Set-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BlockThirdPartyCookies' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod12Off

21) Enable 'Microsoft network client: Digitally sign communications (always)'

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name 'RequireSecuritySignature' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod13On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name 'RequireSecuritySignature' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod13Off

22) Enable Domain member: Digitally encrypt or sign secure channel data (always)

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\" -Name "RequireSignOrSeal" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod45On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\" -Name "RequireSignOrSeal" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod45Off

23) Enable Domain member: Digitally sign secure channel data (when possible)

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\" -Name "SignSecureChannel" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod44On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\" -Name "SignSecureChannel" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod44Off

24) Enable Microsoft Defender Antivirus Email Scanning

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableEmailScanning' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod14On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableEmailScanning' -Value 1
BCWHSendpoint 1.5: Set-BCWHSmod14Off

25) Enable Network Protection

Set
Set-MpPreference -EnableNetworkProtection Enabled;

BCWHSendpoint 1.5: Set-BCWHSmod38On

Revert
Set-MpPreference -EnableNetworkProtection Disabled;

BCWHSendpoint 1.5: Set-BCWHSmod38Off

26) Enable Require domain users to elevate when setting a networks location

Set
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Network Connections\" -Name "NC_StdDomainUserSetLocation" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod32On

Revert
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Network Connections\" -Name "NC_StdDomainUserSetLocation" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod32Off

27) Enable Safe DLL Search Mode

Set
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Session Manager\" -Name "SafeDllSearchMode" -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod37On

Revert
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Session Manager\" -Name "SafeDllSearchMode" -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod37Off

28) Enable scanning of removable drives during a full scan

Set
New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name 'Scan' -Force;
New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableRemovableDriveScanning' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod15On

Revert
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableRemovableDriveScanning' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod15Off

29) Hide Option & Enable Automatic Updates

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\cloud\office\16.0\common\officeupdate" -Name 'enableautomaticupdates' -Value 1;
New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft" -Name 'Office' -Force;
New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office" -Name '16.0' -Force;
New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0" -Name 'Common' -Force;
New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common" -Name 'Officeupdate' -Force;
New-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'hideenabledisableupdates' -Value 1;
New-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'enableautomaticupdates' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod16On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\cloud\office\16.0\common\officeupdate" -Name 'enableautomaticupdates' -Value 0;
Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'hideenabledisableupdates' -Value 0;
Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'enableautomaticupdates' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod16Off

30) Prohibit use of Internet Connection Sharing on your DNS domain network

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" -Name 'NC_ShowSharedAccessUI' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod17On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" -Name 'NC_ShowSharedAccessUI' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod17Off

31) Secure Microsoft Defender Firewall domain profile

Set
Set-NetFirewallProfile -Profile Domain -Enabled True;

BCWHSendpoint 1.5: Set-BCWHSmod34On

Revert
Set-NetFirewallProfile -Profile Domain -Enabled False;

BCWHSendpoint 1.5: Set-BCWHSmod34Off

32) Secure Microsoft Defender firewall private profile

Set
Set-NetFirewallProfile -Profile Private -Enabled True;

BCWHSendpoint 1.5: Set-BCWHSmod36On

Revert
Set-NetFirewallProfile -Profile Private -Enabled False;

BCWHSendpoint 1.5: Set-BCWHSmod36Off

33) Secure Microsoft Defender Firewall public profile

Set
Set-NetFirewallProfile -Profile Public -Enabled True;

BCWHSendpoint 1.5: Set-BCWHSmod35On

Revert
Set-NetFirewallProfile -Profile Public -Enabled False;

BCWHSendpoint 1.5: Set-BCWHSmod35Off

34) Set 'Account lockout duration' to 15 minutes or more

Set
net accounts /lockoutduration:15

BCWHSendpoint 1.5: Set-BCWHSmod18On

Revert
BCWHSendpoint 1.5: Set-BCWHSmod18Off

35) Set 'Account lockout threshold' to 1-10 invalid login attempts

Set
net accounts /lockoutthreshold:10

BCWHSendpoint 1.5: Set-BCWHSmod19On

Revert
BCWHSendpoint 1.5: Set-BCWHSmod19Off

36) Set 'Enforce Password History' to '24 or more password(s)'

Set
net accounts /uniquepw:24

BCWHSendpoint 1.5: Set-BCWHSmod20On

Revert
BCWHSendpoint 1.5: Set-BCWHSmod20Off

37) Set 'Interactive logon: Machine inactivity limit' to '1-900 seconds'

Set
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'InactivityTimeoutSecs' -PropertyType DWORD -Value 0x00000384 -Force

BCWHSendpoint 1.5: Set-BCWHSmod21On

Revert
BCWHSendpoint 1.5: Set-BCWHSmod21Off

38) set 'Minimum Password Age' to '1 or more day(s)'

Set
net accounts /minpwage:1

BCWHSendpoint 1.5: Set-BCWHSmod22On

Revert
BCWHSendpoint 1.5: Set-BCWHSmod22Off

39) Set 'Reset account lockout counter after' to 15 minutes or more

Set
net accounts /lockoutwindow:15

BCWHSendpoint 1.5: Set-BCWHSmod23On

Revert
BCWHSendpoint 1.5: Set-BCWHSmod23Off

40) Set default behavior for 'AutoRun' to 'Enabled: Do not execute any autorun commands'

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutorun' -Value 1;

BCWHSendpoint 1.5: Set-BCWHSmod24On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutorun' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod24Off

41) Set IPV6 source routing to highest protection

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\" -Name 'DisableIPSourceRouting' -Value 2;

BCWHSendpoint 1.5: Set-BCWHSmod25On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\" -Name 'DisableIPSourceRouting' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod25Off

42) Set LAN Manager authentication level to 'Send NTLMv2 response only. Refuse LM & NTLM'

Set
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" -Name 'LmCompatibilityLevel' -Value 5;

BCWHSendpoint 1.5: Set-BCWHSmod26On

Revert
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" -Name 'LmCompatibilityLevel' -Value 3;

BCWHSendpoint 1.5: Set-BCWHSmod26Off

43) Set User Account Control (UAC) to automatically deny elevation requests

Set
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'ConsentPromptBehaviorUser' -Value 0;

BCWHSendpoint 1.5: Set-BCWHSmod27On

Revert
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'ConsentPromptBehaviorUser' -Value 3;

BCWHSendpoint 1.5: Set-BCWHSmod27Off

44) Set user authentication for remote connections by using Network Level Authentication to Enabled

Set
Set-NetworkLevelAuthentication -EnableNLA $true;

BCWHSendpoint 1.5: Set-BCWHSmod29On

Revert
Set-NetworkLevelAuthentication -EnableNLA $false;

BCWHSendpoint 1.5: Set-BCWHSmod29Off

45) Update Microsoft Defender Antivirus definitions

Set
Update-MpSignature;

BCWHSendpoint 1.5: Set-BCWHSmod33On

Revert
BCWHSendpoint 1.5: Set-BCWHSmod33Off

Windows Incident Response

PowerShell for Incident Response. These commands are a good start and will help you Threat Hunt and with Incident Response.

PowerShell - BCWHSendpointIR 1.3

The install and use of the BCWHSendpointIR is pretty straight forward. Open Windows PowerShell with Administrative access and copy and paste the commands below. Each function is listed below with more information.

BCWHSendpointIR 1.3 Installation

Install-PackageProvider -Name NuGet -RequiredVersion 2.8.5.201 -Force;
Import-PackageProvider -Name NuGet -RequiredVersion 2.8.5.201;

Install-Module -Name BCWHSendpointIR -RequiredVersion 1.3 -Force;
Import-Module -Name BCWHSendpointIR -RequiredVersion 1.3;

This module is registered with PowerShell Gallery

1) Check BitLocker Status

manage-bde -status

Turns on or turns off BitLocker, specifies unlock mechanisms, updates recovery methods, and unlocks BitLocker-protected data drives.

BCWHSendpointIR 1.3: Get-BCWHSIRBLStatus

2) Check BitLocker Volume

Get-BitLockerVolume

Gets information about volumes that BitLocker can protect.

BCWHSendpointIR 1.3: Get-BCWHSIRBLVolume

3) Check for malicious process

Get-Process | Sort-Object -Descending WS

Get-Process cmdlet can be used to get currently executing processes.

BCWHSendpointIR 1.3: Get-BCWHSIRProcess

4) List Application Event Log Data

Get-EventLog -logName "Application" -newest 500 | Select MachineName,TimeGenerated,EntryType,Source,Message

The "Windows Logs" section contains (of note) the Application logs

BCWHSendpointIR 1.3: Get-BCWHSIRAppLogs

5) List Logged In Users

Get-CimInstance –ClassName Win32_ComputerSystem

Gets the CIM instances of a class from a CIM server.

BCWHSendpointIR 1.3: Get-BCWHSIRUsers

6) List of Recently Installed Software (Events)

Get-WinEvent -ProviderName msiinstaller | where id -eq 1033 | select timecreated,message | FL *

Gets events from event logs and event tracing log files on local and remote computers.

BCWHSendpointIR 1.3: Get-BCWHSIRSoftware

7) List performance data

Get-Counter

The Get-Counter cmdlet gets performance counter data directly from the performance monitoring instrumentation in the Windows family of operating systems. Get-Counter gets performance data from a local computer or remote computers.

BCWHSendpointIR 1.3: Get-BCWHSIRCounter

8) List Scheduled Tasks

Get-ScheduledTask

The Get-ScheduledTask cmdlet gets the task definition object of a scheduled task that is registered on a computer.

BCWHSendpointIR 1.3: Get-BCWHSIRTasks

9) List Security Event Log Data

Get-EventLog -logName "Security" -newest 500 | Select MachineName,TimeGenerated,EntryType,Source,Message

The "Windows Logs" section contains (of note) the Security logs

BCWHSendpointIR 1.3: Get-BCWHSIRSecurityLogs

10) List Services

Get-Service | Select-Object Name, DisplayName, Status, StartType

The Get-Service cmdlet gets objects that represent the services on a computer, including running and stopped services. By default, when Get-Service is run without parameters, all the local computer's services are returned.

BCWHSendpointIR 1.3: Get-BCWHSIRServices

11) List System Event Log Data

Get-EventLog -logName "System" -newest 500 | Select MachineName,TimeGenerated,EntryType,Source,Message

The "Windows Logs" section contains (of note) the System logs

BCWHSendpointIR 1.3: Get-BCWHSIRSystemLogs

12) List Users (Administrators)

Get-LocalGroupMember Administrators

The Get-LocalGroupMember cmdlet gets members from a local group.

BCWHSendpointIR 1.3: Get-BCWHSIRListUsers

13) Network Activity

Get-NetTCPConnection | Select-Object creationtime, localaddress, localport, RemoteAddress, Remoteport

The Get-NetTCPConnection cmdlet gets current TCP connections. Use this cmdlet to view TCP connection properties such as local or remote IP address, local or remote port, and connection state.

BCWHSendpointIR 1.3: Get-BCWHSIRNetwork

14) Terminate malicious process

Get-Process "process" | Stop-Process

Stop-Process can be used to terminate processes based on process name or process ID (PID).