Listen to this Post
- Know Your Tools: Ensure you are familiar with the tools used to triage alerts and suspicious activity. Understand which security controls detect specific types of activity. Practice investigating potential security incidents as if they were real.
-
Clean Up File Shares: Conduct a thorough search for files containing sensitive information such as credentials. Look for files with names like “passw”, “login”, “unattend.xml”, or “.config”. Remove or secure these files to prevent unauthorized access.
-
Implement Least Privilege: Evaluate your environment’s access controls. Ensure that not every file share, document, or SharePoint site is accessible to everyone. Design access control policies to limit permissions and reduce the risk of over-permissive environments, which are prime targets for threat actors.
You Should Know:
- Linux Commands for File Cleanup:
</li> </ul> <h1>Search for files containing "passw" or "login" in the /home directory</h1> <p>find /home -type f -name "<em>passw</em>" -o -name "<em>login</em>" <h1>Search for .config files in the /etc directory</h1> find /etc -type f -name "*.config" <h1>Remove files matching the search criteria</h1> find /home -type f -name "<em>passw</em>" -exec rm -f {} \;- Windows Commands for Access Control:
</li> </ul> <h1>List all shared folders</h1> Get-SmbShare <h1>Check permissions for a specific folder</h1> Get-Acl -Path "C:\SharedFolder" | Format-List <h1>Remove full access for "Everyone" on a shared folder</h1> Revoke-SmbShareAccess -Name "SharedFolder" -AccountName "Everyone" -Force
- Active Directory Security Checks:
</li> </ul> <h1>List all users with administrative privileges</h1> Get-ADGroupMember -Identity "Domain Admins" <h1>Check for users with never-expiring passwords</h1> Get-ADUser -Filter {PasswordNeverExpires -eq $true} -Properties SamAccountName, PasswordNeverExpires <h1>Disable inactive user accounts</h1> Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | Disable-ADAccountWhat Undercode Say:
Preparing for an internal pentest requires a proactive approach to security. Sysadmins must familiarize themselves with their tools, conduct regular file share cleanups, and enforce the principle of least privilege. By implementing these practices, organizations can significantly reduce their attack surface and improve their overall security posture.
For further reading on securing Active Directory, visit:
- Microsoft Active Directory Security Best Practices
- Linux File Permissions and Security
- Windows PowerShell for Sysadmins
References:
Reported By: Spenceralessi 3 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅Join Our Cyber World:
- Active Directory Security Checks:
- Windows Commands for Access Control:
