Forced Authentication

Detect Forced SMB/WebDAV Authentication via lure files and outbound NTLM

Password Policies: Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures:

Windows Systems:

• Use Group Policy Management Console (GPMC) to configure:
  • Minimum password length (e.g., 12+ characters).
  • Password complexity requirements.
  • Password history (e.g., disallow last 24 passwords).
  • Account lockout duration and thresholds.

Linux Systems:

• Configure Pluggable Authentication Modules (PAM):
• Use pam_pwquality to enforce complexity and length requirements.
• Implement pam_tally2 or pam_faillock for account lockouts.
• Use pwunconv to disable password reuse.

Password Managers:

• Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.

Password Blacklisting:

• Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.

Regular Auditing:

• Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.

Tools for Implementation

Windows:

• Group Policy Management Console (GPMC): Enforce password policies.
• Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.

Linux/macOS:

• PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules.
• Lynis: Audit password policies and system configurations.

Cross-Platform:

• Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords.
• Have I Been Pwned API: Prevent the use of breached passwords.
• NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.

Filter Network Traffic: Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

• Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.
• Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

• Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications.
• Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

• Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs.
• Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

• Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized.
• Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

• Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic.
• Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.