Author Archive: SEC-LABS R&D

SSH native in Windows 10 1803

If you manage a mixed platform your might be switching between, RDP sessions, Remote PowerShell and other remote Tools.

Except for old legacy applications which may not be possible to manage without a GUI, it’s easier, possible to automate and will save you a lot of time using a command line interface.

To extend this support, there is now a native SSH client in Windows.

You may want to check your firewall rules to Control who and where admins can connect and what you need to block

Use powershell to download sysinternals tools

Today, I was starting to get some order of my troubleshooting tools and thought it was a good idea to re-download all sysinternals tools.

It could be, in the future, that I might want to download the latest tools again. Here is a function which will download the files to prefered destination folder.


Windows Event Forward and Custom Logs

First of all, this post is more about configuring custom event channels than configure WEF.


There is more than one way to work with event logs and the most important is to start working with event logs.

Some of the benefits is one place to find the logs for multiple systems and if someone clears, for example, the security log it’s important that you can find the log events before that happened and have alerts triggered on the clearing event.

Using the WEC (Windows Event collector) service is a free option and one of the most frequent used way to gather logs from Windows Clients.

So where do these events end up?


Windows Event Forward uses WinRM to forward the logs from the source to the server which runs the Windows Event Collector Service.

There are 2 different options where one option is to let the WEC server to connect to the client and poll the events and the other options is to let the client to push the events to the WEC server.

This is configured in the subscription part in Event Viewer

Besides the Subscription types you also must configure the Destination log (Default Forwarded Events) and select which events will be forwarded.

There are a few git projects for events in xml(xpath) format which you can use to automatically update the events.


There are more than security people which wants to be able to forward events.

IT operations and endpoint management teams would benefit from WEF by being able to collect errors and other events that might help with troubleshooting.

If you are about to publish new applocker rules you could set them in Audit mode and collect and analyze information where the rules would impact on a user.

Since we have multiple user cases for WEF you may want to separate the logs into different logs.

Security people maybe don’t want the support-.log to fill their selections of security related events.

You may want to forward the security logs into a SIEM solution like Splunk or QRADAR and don’t want to waist SIEM data license with non-security events.


To achieve this, we create a custom log.

Using Ecmangen.exe (provided in one of the Windows 10 SDKs, beware of that this tool is removed from the latest releases)

Save the output to c:\temp\WEF and run the following commands

“C:\Program Files (x86)\Windows Kits\10\bin\x64\mc.exe” C:\temp\wef\

“C:\Program Files (x86)\Windows Kits\10\bin\x64\mc.exe” -css WEFEvents.DummyEvent C:\temp\wef\

 “C:\Program Files (x86)\Windows Kits\10\bin\x64\rc.exe” C:\temp\wef\WEFEvents.rc

 “C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe” /win32res:C:\temp\wef\WEFEvents.res /unsafe /target:library /out:C:\temp\wef\WEFEvents.dll C:\temp\wef\WEFEvents.cs

Copy the WEFEvents.dll and to c:\windows\system32 and register with:

wevtutil im c:\Windows\system32\


You will now be able to use these logs for WEF.

You can have, for example, one for servers one for clients. One with a SPLUNK forwarder and one inserted to a database with a nice custom interface which suites your need depending of what you have.









Links from our TechDays Presentation


Image may contain: 2 people, people smiling, people standing

Here are a link collection and some brief information from our TechDays session.

We’ll skip the wannacry part from the post because it’s everywhere anyway except for the fact that patching is extremely important.

Selecting hardware

There is no secret that Microsoft is working hard to reduce the use of passwords. It’s simple, It’s something you know and someone else can find it out.

Windows Hello Requirements
Hardware Security Testability Specification

Managing firmware patches

Firmware also needs patching. You need to be able to deploy firmware patches to your clients which is already in the environment

TPM Recommendations

BitLocker mitigation plan for vulnerability in TPM

UEFI Secure Boot

Security features

Credential guard

Device Guard

Windows Defender Exploit Guard

Attack Surface Reduction

This security feature really harderns the client. Especially when it comes to office applications.
As an example, one of the rules, will stop office applications form starting another process like CMD or powershell using DDE.

PowerShell Example
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550,D4F940AB-401B-4EFC-AADC-AD5F3C50688A,3B576869-A4EC-4529-8536-B80A7769E899,75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84,D3E037E1-3EB8-44C8-A917-57927947596D,5BEB7EFE-FD9A-4556-801D-275E5FFC04CC,92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled,Enabled,Enabled,Enabled,Enabled


Controlled Folder Access

This is the new ransomware protection. It looks great but too soon to call it the silver bullet since you can still to a full disc encryption.
But ransomware’s that encrypt files this is something that has to be configured for your protection. Sec-Labs R&D will dig deeper into this feature.

PowerShell Downgrade Attacks

All new cool security features are being added in PowerShell version 5.0.
AMSI (Antimalware scan interface) – Not that many 3rd party AV vendors are supporting this which is a shame when we look at real world attacks today
Constrained Language Mode – Lock down, no api calls just legacy powershell
System Wide Transcript
Script Block Logging

PowerShell -version 2 and you’re in… (more or less)

PowerShell version 2 is deprecated since Windows 10 1709. When you install .net 3.5 it will be enabled and then you’ll have to disable it.

PowerShell downgrade attacks can be found in the event viewer, ID 400 and then the host version less than 5.0

Oldschool configurations which should already be in place

Local firewall – Enabled!

We always get’s questions about applocker. It is builtin since Windows 7.
Build, evaluate and push a baseline to take control of executions no need for 3rd party here.

Windows Event Forwarding, WEF
When we asked, there were just a few actually using this.
There are lots of documentation on how to deploy this in an enterprise.

Encrypt the harddrives, no excuses here.

DMA Protection

Don’t spend your money here.

LAPS Local Admin Password Solution
Make sure you don’t have the same local admin password on all clients.

Guidelines to secure and lockdown you Internet Browsers

Windows Defender Advanded threat protection (WD ATP)

Built-in Security Stack (Agent-less)

Supported on:
Windows 10 1607 (minimum)
Windows Server 2012 R2
Windows Server 2016
X-Plat Support under Investigation

Windows 10 Enterprise E5
Windows 10 Education E5
Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5


Sysinternals Sysmon is also a great tool to deploy if you can’t use WD ATP for some reasons or just want to see more for yourself.
Should be used with Event Forwarding

Securing Privilege access


Link to slides here







KrackAttack – Vulnerability in WPA2 – Disclosed

A security researcher Mathy Van Hoef will disclose a vulnerability in WPA2 within a few hours.

The vulnerability leaves Wi-Fi traffic open to eavesdropping and it will be possible to inject malicious content and much more.



Important URLs


Van Hoef on Twitter



Our main attack is against the 4-way handshake of the WPA2 protocol. This handshake is executed when a client wants to join a protected Wi-Fi network, and is used to confirm that both the client and access point possess the correct credentials (e.g. the pre-shared password of the network). At the same time, the 4-way handshake also negotiates a fresh encryption key that will be used to encrypt all subsequent traffic. Currently, all modern protected Wi-Fi networks use the 4-way handshake. This implies all these networks are affected by (some variant of) our attack. For instance, the attack works against personal and enterprise Wi-Fi networks, against the older WPA and the latest WPA2 standard, and even against networks that only use AES. All our attacks against WPA2 use a novel technique called a key reinstallation attack (KRACK):

  • Basically all Wireless networks are vulnerable and the vendors are working to get the patches out.
  • Microsoft was mitigating this on the client side in the October patch release cycle
  • If you won’t get an update to your router your really only option is to get a new one (if it’s out of support)
  • Recommendations are to apply patches as soon as they’re available.



This post will be updated

EVENT: Åtgärder mot finansiell brottslighet [Swedish Event]


SEC-Labs R&D will be presenting at – Åtgärder mot finansiell brottslighet – in Stockholm in December.

During the session – Digital World, Digital Criminals – From code to cash We will give you an insight to the darkest corner of the internet. We will share our knowledge about hackers and how they can get to your secret information without you even know it happened.



Event: SCUG.SE – Client days in October 2017

The popular client event is back in October held by System Center User Group Sweden.

A mix of good to know and news where the field experts will share their knowledge during these two dates at the Microsoft office in Akalla – Stockholm

Most of the sessions are in Swedish

Date and Time
Thu, Oct 12, 2017, 8:30 AM –
Fri, Oct 13, 2017, 3:30 PM CEST

Microsoft Sweden
36 Finlandsgatan
164 74 Akalla

Agenda (current)

Day 1

  • 0815 – Doors Open
  • 0830 – 0900 – Keynote – Future of a managed client – Jörgen & Stefan
  • 0915 – 1015 – What’s new in Configuration Manager 1706 and beyond! – Jörgen
  • 1030 – 1130 – The latest news on Windows 10 17xx modern management – TBA
  • 1130 – 1230 – Lunch
  • 1230 – 1315 – Sponsor Session
  • 1315 – 1345 – Scripting, Code and APIs the good, bad and the ugly – Fredrik Wall
  • 1400 – 1430 – Intune and PowerShell – Nickolaj Andersen
  • 1445 – 1545 – Best of Ignite – Stefan Schörling
  • 1545 – 1645 – Plan and deploy efficient content management – Andreas Hammarskjöld
  • 1645 – Q&A – Expert panel!
  • 1930 – Mingel på Stan

Day 2

  • 0815 – Doors Open
  • 0830 – 0930 – Windows 10 Enterprise Adoption – TBA
  • 0930 – 1030 – (EMS) TBA – Jan-Ketil Skanke
  • 1045 – 1115 – Using Ci’s in Configuration Manager deep-dive – Jörgen
  • 1115 – 1130 – Increase your patch compliance to 99% using ConfigMgr Health Script – Anders Rödland
  • 1130 – 1215 – TBA
  • 1215 – 1300 – Lunch
  • 1300 – 1345 – Managing Office 365 using Configuration Manager real world challenges – Stefan Schörling
  • 1400 – 1500 – Task Sequence Optimizations and Tricks – Jörgen / Johnny / Nickolaj

Get your tickets here:

Join SCUG.SE User group on facebook




TechDays Sweden – Take care of your clients, you don’t WannaCry

In October SEC-LABS R&D Crew will be presenting at the Swedish Premier Microsoft IT Event TechDays. We will be talking about how to Secure your Windows clients, we are going to walk you through the Microsoft security stack you can use to protect your Windows client with. We will be focusing not only on Windows 10 but other solutions and practices you can leverage to build a more secure client environment. 

We hope to see you there / Stefan and Mattias

We have embedded a video from last years event below (Swedish)