🛡️Security Controls Enumeration
📋 Overview
After gaining initial access to an Active Directory environment, understanding the defensive security controls in place is crucial for planning effective enumeration and attack strategies. Security controls can significantly impact tool selection, exploitation techniques, and post-exploitation activities. Organizations implement varying levels of protection, and these controls may not be applied uniformly across all systems.
🎯 Why Enumerate Security Controls?
🔍 Strategic Planning
Tool Selection: Choose appropriate enumeration tools based on security restrictions
Attack Path Planning: Identify potential bypasses and alternative techniques
Risk Assessment: Understand detection capabilities and defensive posture
Stealth Operations: Avoid triggering security controls during enumeration
⚠️ Common Variations
Inconsistent Policies: Different protection levels across machine types
Legacy Systems: Older systems may have fewer protections
Department Differences: Varying security standards between business units
Administrative Oversight: Gaps in security policy implementation
🛡️ Windows Defender Enumeration
📝 Overview
Windows Defender (Microsoft Defender) has significantly improved and by default blocks many penetration testing tools like PowerView. Understanding its current status helps inform tool selection and evasion strategies.
🔍 Checking Defender Status
📊 Example Output Analysis
🎯 Critical Parameters Interpretation
Parameter
Value
Impact
Evasion Strategy
RealTimeProtectionEnabled
True
High - Active scanning
Use obfuscated scripts, living-off-land techniques
BehaviorMonitorEnabled
False
Medium - Behavioral analysis disabled
Can use more aggressive techniques
OnAccessProtectionEnabled
False
Low - File access not monitored
Direct file manipulation possible
AMServiceEnabled
True
High - Core protection active
Require AV evasion techniques
🔧 Additional Defender Checks
🔒 AppLocker Enumeration
📝 Overview
AppLocker is Microsoft's application whitelisting solution that controls which applications, scripts, and files users can execute. It provides granular control over executables, scripts, Windows Installer files, DLLs, packaged apps, and packed app installers.
🔍 Enumerating AppLocker Policies
📊 Example AppLocker Policy Analysis
🎯 AppLocker Bypass Strategies
🚪 Common PowerShell Bypass Locations
📂 Writable Directory Identification
🔧 AppLocker Analysis Script
🔐 PowerShell Constrained Language Mode
📝 Overview
PowerShell Constrained Language Mode restricts many PowerShell features needed for effective post-exploitation, including COM objects, approved .NET types only, XAML-based workflows, PowerShell classes, and advanced scripting capabilities.
🔍 Checking Language Mode
📊 Language Mode Impact Analysis
Mode
Capabilities
Restrictions
Bypass Difficulty
FullLanguage
Complete PowerShell functionality
None
N/A
ConstrainedLanguage
Basic cmdlets, limited .NET
No COM, limited types, no Add-Type
Medium
RestrictedLanguage
Very basic functionality
Most features blocked
High
NoLanguage
PowerShell completely disabled
Everything blocked
Very High
🎯 Constrained Language Mode Detection
🔧 Testing Specific Restrictions
🔑 LAPS (Local Administrator Password Solution)
📝 Overview
Microsoft LAPS randomizes and rotates local administrator passwords on Windows hosts to prevent lateral movement using shared local admin credentials. Understanding LAPS deployment helps identify potential privilege escalation paths and lateral movement opportunities.
🛠️ LAPS Enumeration Tools
🔍 Finding LAPS Delegated Groups
🎯 LAPS Extended Rights Enumeration
💎 Retrieving LAPS Passwords
🔧 Manual LAPS Enumeration (Without LAPSToolkit)
🎯 LAPS Attack Strategies
🔍 Targeting LAPS Admins
🎪 Computer Account Hijacking
🔧 Additional Security Controls
🛡️ Windows Firewall
🕵️ Event Log Monitoring
🔒 BitLocker
📊 Complete Security Controls Assessment Script
🚀 Comprehensive Enumeration Script
🎯 Key Attack Implications
📋 Security Control Impact Matrix
Control
High Impact
Medium Impact
Low Impact
Windows Defender
Real-time scanning active
Behavior monitoring enabled
On-access protection disabled
AppLocker
PowerShell/cmd blocked
Script execution restricted
Default rules only
Constrained Language
NoLanguage/Restricted
ConstrainedLanguage
FullLanguage
LAPS
Fully deployed
Partial deployment
Not deployed
🚀 Adaptation Strategies
🛡️ High Security Environment
🔧 Medium Security Environment
🎯 Low Security Environment
⚡ Quick Reference Commands
🔍 Rapid Assessment
🛠️ Bypass Testing
🔑 Key Takeaways
✅ Essential Enumeration Points
Always check security controls before deploying tools or techniques
Understand the defensive landscape to plan effective attack paths
Look for inconsistencies in security policy implementation
Test bypass techniques systematically when restrictions are found
⚠️ Critical Considerations
Not all systems are equal - security controls may vary by host type
Legacy systems often have fewer protections than modern workstations
Administrative workstations typically have stronger controls
Server systems may have different security postures than endpoints
🎯 Strategic Planning
Enumerate all security controls on initial access
Identify gaps and inconsistencies in defensive coverage
Adapt tool selection based on control presence
Plan alternative techniques for restricted environments
Document findings for reporting and future reference
Understanding security controls is essential for effective Active Directory enumeration - know your restrictions before you engage, and always have a plan B when controls block your primary approach.
Last updated