Post Compromise

Internal Networks

A Demilitarized Zone (DMZ)

A DMZ Network is an edge network that protects and adds an extra security layer to a corporation's internal local-area network from untrusted traffic. A common design for DMZ is a subnetwork that sits between the public internet and internal networks.

Designing a network within the company depends on its requirements and need. For example, suppose a company provides public services such as a website, DNS, FTP, Proxy, VPN, etc. In that case, they may design a DMZ network to isolate and enable access control on the public network traffic, untrusted traffic

Network Enumeration

netstat -na

What is the Active Directory (AD) environment?

More details here :

Module 21 (Active Directory Attacks) | 0Sech3ckt0r.gitbook.io

AD

The following is a list of Active Directory components that we need to be familiar with:

• Domain Controllers

• Organizational Units

• AD objects

• AD Domains

• Forest

• AD Service Accounts: Built-in local users, Domain users, Managed service accounts

• Domain Administrators

AD domains are a collection of Microsoft components within an AD network.

AD Forest

Host Security Solution

It is a set of software applications used to monitor and detect abnormal and malicious activities within the host, including:

1. Antivirus software

2. Microsoft Windows Defender

3. Host-based Firewall

4. Security Event Logging and Monitoring

5. Host-based Intrusion Detection System (HIDS)/ Host-based Intrusion Prevention System (HIPS)

6. Endpoint Detection and Response (EDR)

Antivirus Software (AV)

There are various detection techniques that the antivirus uses, including

• Signature-based detection

• Heuristic-based detection

Heuristic VS Signature

• Behavior-based detection

Microsoft Windows Defender

We can use the following PowerShell command to check the service state of Windows Defender:

Get-Service WinDefend

 Get-MpComputerStatus | select RealTimeProtectionEnabled

Host-based Firewall:

FW

Get-NetFirewallProfile | Format-Table Name, Enabled

Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled False
Get-NetFirewallProfile | Format-Table Name, Enabled

We can also learn and check the current Firewall rules, whether allowing or denying by the firewall.

Get-NetFirewallRule | select DisplayName, Enabled, Description

Test-NetConnection -ComputerName 127.0.0.1 -Port 80
(New-Object System.Net.Sockets.TcpClient("127.0.0.1", "80")).Connected

threat details

Get-MpThreat

Get Firewall Rules connection

 Get-NetFirewallRule | findstr "THM-Connection"

Security Event Logging and Monitoring

Event logs in Windows

Get-eventlog -list

Eventlogs