From 6ec2eb61a02f9e55ef5b8d22a5ca61ca53ca05e7 Mon Sep 17 00:00:00 2001 From: heqnx Date: Fri, 11 Jul 2025 21:55:20 +0300 Subject: added initial setup for domain controller --- ansible/files/SQL2019-SSEI-Expr.exe | Bin 0 -> 6379936 bytes ansible/files/adcs/ADCSTemplate/ADCSTemplate.psd1 | Bin 0 -> 9442 bytes ansible/files/adcs/ADCSTemplate/ADCSTemplate.psm1 | 466 ++++++++ ansible/files/adcs/templates/ESC1.json | Bin 0 -> 4252 bytes ansible/files/adcs/templates/ESC2.json | Bin 0 -> 4096 bytes ansible/files/adcs/templates/ESC3-CRA.json | Bin 0 -> 4158 bytes ansible/files/adcs/templates/ESC3.json | Bin 0 -> 4572 bytes ansible/files/adcs/templates/ESC4.json | Bin 0 -> 4308 bytes ansible/files/software/BgInfo.bgi | Bin 0 -> 1174 bytes ansible/files/software/BgInfo.exe | Bin 0 -> 2198952 bytes ansible/files/software/PsExec64.exe | Bin 0 -> 833472 bytes ansible/files/software/Sysmon64.exe | Bin 0 -> 4545344 bytes .../googlechromestandaloneenterprise64.msi | Bin 0 -> 119250944 bytes ansible/files/software/npp.exe | Bin 0 -> 4840120 bytes ansible/files/software/sysmonconfig-export.xml | 1200 ++++++++++++++++++++ 15 files changed, 1666 insertions(+) create mode 100644 ansible/files/SQL2019-SSEI-Expr.exe create mode 100644 ansible/files/adcs/ADCSTemplate/ADCSTemplate.psd1 create mode 100644 ansible/files/adcs/ADCSTemplate/ADCSTemplate.psm1 create mode 100644 ansible/files/adcs/templates/ESC1.json create mode 100644 ansible/files/adcs/templates/ESC2.json create mode 100644 ansible/files/adcs/templates/ESC3-CRA.json create mode 100644 ansible/files/adcs/templates/ESC3.json create mode 100644 ansible/files/adcs/templates/ESC4.json create mode 100644 ansible/files/software/BgInfo.bgi create mode 100644 ansible/files/software/BgInfo.exe create mode 100644 ansible/files/software/PsExec64.exe create mode 100644 ansible/files/software/Sysmon64.exe create mode 100644 ansible/files/software/googlechromestandaloneenterprise64.msi create mode 100644 ansible/files/software/npp.exe create mode 100644 ansible/files/software/sysmonconfig-export.xml (limited to 'ansible/files') diff --git a/ansible/files/SQL2019-SSEI-Expr.exe b/ansible/files/SQL2019-SSEI-Expr.exe new file mode 100644 index 0000000..e8cf49d Binary files /dev/null and b/ansible/files/SQL2019-SSEI-Expr.exe differ diff --git a/ansible/files/adcs/ADCSTemplate/ADCSTemplate.psd1 b/ansible/files/adcs/ADCSTemplate/ADCSTemplate.psd1 new file mode 100644 index 0000000..daf338f Binary files /dev/null and b/ansible/files/adcs/ADCSTemplate/ADCSTemplate.psd1 differ diff --git a/ansible/files/adcs/ADCSTemplate/ADCSTemplate.psm1 b/ansible/files/adcs/ADCSTemplate/ADCSTemplate.psm1 new file mode 100644 index 0000000..39da019 --- /dev/null +++ b/ansible/files/adcs/ADCSTemplate/ADCSTemplate.psm1 @@ -0,0 +1,466 @@ +#requires -Version 5.0 -Modules ActiveDirectory + +Function Get-RandomHex { +param ([int]$Length) + $Hex = '0123456789ABCDEF' + [string]$Return = $null + For ($i=1;$i -le $length;$i++) { + $Return += $Hex.Substring((Get-Random -Minimum 0 -Maximum 16),1) + } + Return $Return +} + +Function IsUniqueOID { +param ($cn,$TemplateOID,$Server,$ConfigNC) + $Search = Get-ADObject -Server $Server ` + -SearchBase "CN=OID,CN=Public Key Services,CN=Services,$ConfigNC" ` + -Filter {cn -eq $cn -and msPKI-Cert-Template-OID -eq $TemplateOID} + If ($Search) {$False} Else {$True} +} + +Function New-TemplateOID { +Param($Server,$ConfigNC) + <# + OID CN/Name [10000000-99999999].[32 hex characters (MD5hash)] + OID msPKI-Cert-Template-OID [Forest base OID].[1000000-99999999].[10000000-99999999] <--- second number same as first number in OID name + #> + do { + $OID_Part_1 = Get-Random -Minimum 10000000 -Maximum 99999999 + $OID_Part_2 = Get-Random -Minimum 10000000 -Maximum 99999999 + $OID_Part_3 = Get-RandomHex -Length 32 + $OID_Forest = Get-ADObject -Server $Server ` + -Identity "CN=OID,CN=Public Key Services,CN=Services,$ConfigNC" ` + -Properties msPKI-Cert-Template-OID | + Select-Object -ExpandProperty msPKI-Cert-Template-OID + $msPKICertTemplateOID = "$OID_Forest.$OID_Part_1.$OID_Part_2" + $Name = "$OID_Part_2.$OID_Part_3" + } until (IsUniqueOID -cn $Name -TemplateOID $msPKICertTemplateOID -Server $Server -ConfigNC $ConfigNC) + Return @{ + TemplateOID = $msPKICertTemplateOID + TemplateName = $Name + } +} + + +<# +.SYNOPSIS +Returns the properties of either a single or all Active Directory Certificate Template(s). +.DESCRIPTION +Returns the properties of either a single or list of Active Directory Certificate Template(s) +depending on whether a DisplayName parameter was passed. +.PARAMETER DisplayName +Name of an AD CS template to retrieve. +.PARAMETER Server +FQDN of Active Directory Domain Controller to target for the operation. +When not specified it will search for the nearest Domain Controller. +.EXAMPLE +PS C:\> Get-ADCSTemplate +.EXAMPLE +PS C:\> Get-ADCSTemplate -DisplayName PowerShellCMS +.EXAMPLE +PS C:\> Get-ADCSTemplate | Sort-Object Name | ft Name, Created, Modified +.EXAMPLE +PS C:\> ###View template permissions +(Get-ADCSTemplate pscms).nTSecurityDescriptor +(Get-ADCSTemplate pscms).nTSecurityDescriptor.Sddl +(Get-ADCSTemplate pscms).nTSecurityDescriptor.Access +ConvertFrom-SddlString -Sddl (Get-ADCSTemplate pscms).nTSecurityDescriptor.sddl -Type ActiveDirectoryRights +.NOTES +Requires Enterprise Administrator permissions, since this touches the AD Configuration partition. +#> +Function Get-ADCSTemplate { +param( + [parameter(Position=0)] + [string] + $DisplayName, + + [string] + $Server = (Get-ADDomainController -Discover -ForceDiscover -Writable).HostName[0] +) + If ($PSBoundParameters.ContainsKey('DisplayName')) { + $LDAPFilter = "(&(objectClass=pKICertificateTemplate)(displayName=$DisplayName))" + } Else { + $LDAPFilter = '(objectClass=pKICertificateTemplate)' + } + + $ConfigNC = $((Get-ADRootDSE -Server $Server).configurationNamingContext) + $TemplatePath = "CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigNC" + Get-ADObject -SearchScope Subtree -SearchBase $TemplatePath -LDAPFilter $LDAPFilter -Properties * -Server $Server +} + + +<# +.SYNOPSIS +Adds an ACL to an Active Directory Certificate template. +.DESCRIPTION +Adds an ACL to an Active Directory Certificate template. +Default permission is read (without the Enroll or AutoEnroll switches). +.PARAMETER DisplayName +Name of an AD CS template to receive the ACL. +.PARAMETER Server +FQDN of Active Directory Domain Controller to target for the operation. +When not specified it will search for the nearest Domain Controller. +.PARAMETER Type +ACL type: Allow or Deny +.PARAMETER Identity +String or string array of Active Directory identities (users or groups) +.PARAMETER Enroll +Set the Enroll permission +.PARAMETER AutoEnroll +Set the AutoEnroll permission +.EXAMPLE +PS C:\> Set-ADCSTemplateACL -DisplayName PowerShellCMS -Type Allow -Identity 'CONTOSO\Servers Group' -Enroll +.EXAMPLE +PS C:\> Set-ADCSTemplateACL -DisplayName PowerShellCMS -Type Allow -Identity 'CONTOSO\Servers Group','CONTOSO\Workstations Group' -Enroll -AutoEnroll +.EXAMPLE +PS C:\> Set-ADCSTemplateACL -DisplayName PowerShellCMS -Type Deny -Identity 'CONTOSO\Servers Group' +.NOTES +Requires Enterprise Administrator permissions, since this touches the AD Configuration partition. +#> +Function Set-ADCSTemplateACL { +param( + [parameter(Mandatory)] + [string]$DisplayName, + [string]$Server = (Get-ADDomainController -Discover -ForceDiscover -Writable).HostName[0], + [ValidateSet('Allow','Deny')] + [string]$Type = 'Allow', + [string[]]$Identity, + [switch]$Enroll, + [switch]$AutoEnroll +) + ## Potential issue here that the AD: drive may not be targetting the selected DC in the -SERVER parameter + $TemplatePath = "AD:\" + (Get-ADCSTemplate -DisplayName $DisplayName -Server $Server).DistinguishedName + $acl = Get-ACL $TemplatePath + $InheritedObjectType = [GUID]'00000000-0000-0000-0000-000000000000' + ForEach ($Group in $Identity) { + $account = New-Object System.Security.Principal.NTAccount($Group) + $sid = $account.Translate([System.Security.Principal.SecurityIdentifier]) + + If ($Type -ne 'Deny') { + # Read, but only if Allow + $ObjectType = [GUID]'00000000-0000-0000-0000-000000000000' + $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ` + $sid, 'GenericRead', $Type, $ObjectType, 'None', $InheritedObjectType + $acl.AddAccessRule($ace) + } + + If ($Enroll) { + $ObjectType = [GUID]'0e10c968-78fb-11d2-90d4-00c04f79dc55' + $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ` + $sid, 'ExtendedRight', $Type, $ObjectType, 'None', $InheritedObjectType + $acl.AddAccessRule($ace) + } + + If ($AutoEnroll) { + $ObjectType = [GUID]'a05b8cc2-17bc-4802-a710-e7c15ab866a2' + $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ` + $sid, 'ExtendedRight', $Type, $ObjectType, 'None', $InheritedObjectType + $acl.AddAccessRule($ace) + } + } + Set-ACL $TemplatePath -AclObject $acl +} + + +<# +.SYNOPSIS +Returns a JSON string with the properties of an Active Directory certificate template. +.DESCRIPTION +Returns a JSON string with the properties of an Active Directory certificate template. +By default returns only the PKI-related properties of the object. These properties are +sufficient for passing to the New-ADCSTemplate function. +.PARAMETER DisplayName +DisplayName for the certificate to export. +.PARAMETER Server +FQDN of Active Directory Domain Controller to target for the operation. +When not specified it will search for the nearest Domain Controller. +.PARAMETER Detailed +Includes all ADObject properties of the template. These are not required for +use with the New-ADCSTemplate function. +.NOTES +C.R.U.D. AD CS Template Operations in this module. +No longer have to use the cert GUI to clone a template and build a new one. +Create one manually the first time in the GUI, then export it to JSON. +Pass the JSON in your new environment (file, here string, DSC, etc.) to build from scratch. +Requires Enterprise Administrator permissions, since this touches the AD Configuration partition. +.EXAMPLE +PS C:\> Export-ADCSTemplate -DisplayName PowerShellCMS +.EXAMPLE +PS C:\> Export-ADCSTemplate -DisplayName PowerShellCMS -Detailed +.EXAMPLE +### Backup all the templates to JSON +md C:\ADCSTemplates -ErrorAction SilentlyContinue +cd C:\ADCSTemplates +(Get-ADCSTemplate).name | ForEach-Object {"Exporting $_"; Export-ADCSTemplate -DisplayName $_ | Out-File .\$_.json -Force} +dir +.EXAMPLE +PS C:\> New-ADCSTemplate -DisplayName PowerShellCMS-NEW -JSON (Export-ADCSTemplate -DisplayName PowerShellCMS-OLD) +#> +Function Export-ADCSTemplate { +param( + [parameter(Mandatory)] + [string]$DisplayName, + [string]$Server = (Get-ADDomainController -Discover -ForceDiscover -Writable).HostName[0], + [switch]$Detailed # Detailed output is not required for export/import. Use for documentation/backup purposes. +) + If ($Detailed) { + Get-ADCSTemplate -DisplayName $DisplayName -Server $Server | + ConvertTo-Json + } Else { + Get-ADCSTemplate -DisplayName $DisplayName -Server $Server | + Select-Object -Property name, displayName, objectClass, flags, revision, *pki* | + ConvertTo-Json + } +} + +<# +.SYNOPSIS +Creates a new Active Directory Certificate Services template based on a JSON export. +.DESCRIPTION +Creates a new Active Directory Certificate Services template based on a JSON export. +Optionally can permission and publish the template (best practice). +.PARAMETER DisplayName +DisplayName for the certificate template to create. This does not have to match +the original name of the exported template. +.PARAMETER JSON +JSON string output from Export-ADCSTemplate. Defines the template to create. +Can be retrieved from file using Get-Content -Raw. +.PARAMETER Server +FQDN of Active Directory Domain Controller to target for the operation. +When not specified it will search for the nearest Domain Controller. +.PARAMETER Identity +String or string array of Active Directory identities (users or groups). +This is optional for permissioning the template. +.PARAMETER AutoEnroll +Default permission is Read and Enroll. Use this switch to also grant AutoEnroll +to the identity. Only used when Identity parameter is used. +.PARAMETER Publish +Publish the template to *ALL* Certificate Authority issuers. Use with caution +in production environments. You may want to manually publish to only specific +Certificate Authorities in production. In a lab this is ideal. +.NOTES +This function does not use the official (complicated) API for PKI management. +Instead it creates the exact same AD objects that are generated by the API, +including AD forest-specific OIDs. +Requires Enterprise Administrator permissions, since this touches the AD Configuration partition. +.EXAMPLE +PS C:\> New-ADCSTemplate -DisplayName PowerShellCMS -JSON (Get-Content .\pscms.json -Raw) +.EXAMPLE +PS C:\> New-ADCSTemplate -DisplayName PowerShellCMS -JSON (Get-Content .\pscms.json -Raw) -Server dc1.contoso.com -Identity G_DSCNodes -AutoEnroll -Publish + +# From a client configured for AD CS autoenrollment: +$Req = @{ + Template = 'PowerShellCMS' + Url = 'ldap:' + CertStoreLocation = 'Cert:\LocalMachine\My' +} +Get-Certificate @Req +# Note: If you have the Carbon module installed, it conflicts with Get-Certificate native cmdlet. + +$DocEncrCert = (dir Cert:\LocalMachine\My -DocumentEncryptionCert | Sort-Object NotBefore)[-1] +Protect-CmsMessage -To $DocEncrCert -Content "Encrypted with my new cert from the new template!" +.EXAMPLE +PS C:\> New-ADCSTemplate -DisplayName PowerShellCMS-NEW -JSON (Export-ADCSTemplate -DisplayName PowerShellCMS-OLD) +#> +Function New-ADCSTemplate { +param( + [parameter(Mandatory)] + [string]$DisplayName, # name in JSON export is ignored + [parameter(Mandatory)] + [string]$JSON, + [string]$Server = (Get-ADDomainController -Discover -ForceDiscover -Writable).HostName[0], + [string[]]$Identity, # = "$((Get-ADDomain).NetBIOSName)\Domain Computers", + [switch]$AutoEnroll, + [switch]$Publish +) + ### Put GroupName and AutoEnroll into a parameter set + + # Manually import AD module to get AD: drive used later for permissions + Import-Module ActiveDirectory -Verbose:$false + + $ConfigNC = $((Get-ADRootDSE -Server $Server).configurationNamingContext) + + #region CREATE OID + <# + CN : 14891906.F2AC4390685318BD1D950A66EDB50FF4 + DisplayName : TemplateNameHere + DistinguishedName : CN=14891906.F2AC4390685318BD1D950A66EDB50FF4,CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=com + dSCorePropagationData : {1/1/1601 12:00:00 AM} + flags : 1 + instanceType : 4 + msPKI-Cert-Template-OID : 1.3.6.1.4.1.311.21.8.11489019.14294623.5588661.594850.12204198.151.6616009.14891906 + Name : 14891906.F2AC4390685318BD1D950A66EDB50FF4 + ObjectCategory : CN=ms-PKI-Enterprise-Oid,CN=Schema,CN=Configuration,DC=contoso,DC=com + ObjectClass : msPKI-Enterprise-Oid + #> + $OID = New-TemplateOID -Server $Server -ConfigNC $ConfigNC + $TemplateOIDPath = "CN=OID,CN=Public Key Services,CN=Services,$ConfigNC" + $oa = @{ + 'DisplayName' = $DisplayName + 'flags' = [System.Int32]'1' + 'msPKI-Cert-Template-OID' = $OID.TemplateOID + } + New-ADObject -Path $TemplateOIDPath -OtherAttributes $oa -Name $OID.TemplateName -Type 'msPKI-Enterprise-Oid' -Server $Server + #endregion + + #region CREATE TEMPLATE + # https://docs.microsoft.com/en-us/powershell/dsc/securemof#certificate-requirements + # https://blogs.technet.microsoft.com/option_explicit/2012/04/09/pki-certificates-and-the-x-509-standard/ + # https://technet.microsoft.com/en-us/library/cc776447(v=ws.10).aspx + $import = $JSON | ConvertFrom-Json + $oa = @{ 'msPKI-Cert-Template-OID' = $OID.TemplateOID } + ForEach ($prop in ($import | Get-Member -MemberType NoteProperty)) { + Switch ($prop.Name) { + { $_ -in 'flags', + 'msPKI-Certificate-Name-Flag', + 'msPKI-Enrollment-Flag', + 'msPKI-Minimal-Key-Size', + 'msPKI-Private-Key-Flag', + 'msPKI-Template-Minor-Revision', + 'msPKI-Template-Schema-Version', + 'msPKI-RA-Signature', + 'pKIMaxIssuingDepth', + 'pKIDefaultKeySpec', + 'revision' + } { $oa.Add($_,[System.Int32]$import.$_); break } + + { $_ -in 'msPKI-Certificate-Application-Policy', + 'pKICriticalExtensions', + 'pKIDefaultCSPs', + 'pKIExtendedKeyUsage', + 'msPKI-RA-Application-Policies' + } { $oa.Add($_,[Microsoft.ActiveDirectory.Management.ADPropertyValueCollection]$import.$_); break } + + { $_ -in 'pKIExpirationPeriod', + 'pKIKeyUsage', + 'pKIOverlapPeriod' + } { $oa.Add($_,[System.Byte[]]$import.$_); break } + + } + } + $TemplatePath = "CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigNC" + New-ADObject -Path $TemplatePath -OtherAttributes $oa -Name $DisplayName.Replace(' ','') ` + -DisplayName $DisplayName -Type pKICertificateTemplate -Server $Server + #endregion + + #region PERMISSIONS + ## Potential issue here that the AD: drive may not be targetting the selected DC in the -SERVER parameter + If ($PSBoundParameters.ContainsKey('Identity')) { + If ($AutoEnroll) { + Set-ADCSTemplateACL -DisplayName $DisplayName -Server $Server -Type Allow -Identity $Identity -Enroll -AutoEnroll + } Else { + Set-ADCSTemplateACL -DisplayName $DisplayName -Server $Server -Type Allow -Identity $Identity -Enroll + } + } + #endregion + + #region ISSUE + If ($Publish) { + ### WARNING: Issues on all available CAs. Test in your environment. + $EnrollmentPath = "CN=Enrollment Services,CN=Public Key Services,CN=Services,$ConfigNC" + $CAs = Get-ADObject -SearchBase $EnrollmentPath -SearchScope OneLevel -Filter * -Server $Server + ForEach ($CA in $CAs) { + Set-ADObject -Identity $CA.DistinguishedName -Add @{certificateTemplates=$DisplayName.Replace(' ','')} -Server $Server + } + } + #endregion +} + + +<# +.SYNOPSIS +Removes a certificate template from Active Directory. +.DESCRIPTION +Removes the template from any issuers where it is published. +Removes the template itself. +Removes the unique OID object of the template. +.PARAMETER DisplayName +DisplayName for the certificate template to delete. +.PARAMETER Server +FQDN of Active Directory Domain Controller to target for the operation. +When not specified it will search for the nearest Domain Controller. +.EXAMPLE +PS C:\> Remove-ADCSTemplate -DisplayName PowerShellCMS +.EXAMPLE +PS C:\> (Get-ADCSTemplate).name | Where-Object {$_ -like "PowerShellCMS*"} | ForEach-Object {Remove-ADCSTemplate -DisplayName $_ -Verbose} +.NOTES +Use with caution! +Requires Enterprise Administrator permissions, since this touches the AD Configuration partition. +#> +Function Remove-ADCSTemplate { +[CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact='High')] +param( + [parameter(Mandatory)] + [string]$DisplayName, + [string]$Server = (Get-ADDomainController -Discover -ForceDiscover -Writable).HostName[0] +) + if ($pscmdlet.ShouldProcess($DisplayName, 'Remove certificate template')) { + $ConfigNC = $((Get-ADRootDSE -Server $Server).configurationNamingContext) + + $Template = Get-ADCSTemplate -DisplayName $DisplayName -Server $Server + + #region REMOVE ISSUE IF IT EXISTS + $EnrollmentPath = "CN=Enrollment Services,CN=Public Key Services,CN=Services,$ConfigNC" + $CAs = Get-ADObject -SearchBase $EnrollmentPath -SearchScope OneLevel -Filter * -Server $Server + ForEach ($CA in $CAs) { + Set-ADObject -Identity $CA.DistinguishedName -Remove @{certificateTemplates=$Template.cn} -Server $Server -Confirm:$false + } + #endregion + + #region REMOVE TEMPLATE + Remove-ADObject -Identity $Template.distinguishedName -Server $Server -Confirm:$false + #endregion + + #region REMOVE OID + $TemplateOIDPath = "CN=OID,CN=Public Key Services,CN=Services,$ConfigNC" + Get-ADObject -SearchBase $TemplateOIDPath -LDAPFilter "(DisplayName=$DisplayName)" -Server $Server | Remove-ADObject -Confirm:$false + #endregion + } +} + + +<# +.SYNOPSIS +Maps a PowerShell drive to the Active Directory Certificate Services location. +.DESCRIPTION +Maps a PowerShell drive to the Active Directory Certificate Services location +of the Configuration partition under CN=Public Key Services,CN=Services,... . +The new drive is ADCS:. This is purely for convenience of checking the objects +updated by functions in the ADCSTemplate module. +.PARAMETER Server +FQDN of Active Directory Domain Controller to target for the operation. +When not specified it will search for the nearest Domain Controller. +.EXAMPLE +PS C:\> New-ADCSDrive +PS C:\> Set-Location ADCS: +.EXAMPLE +### Explore templates with drive +New-ADCSDrive +Get-PSDrive +cd ADCS: +dir + +# List templates +cd '.\CN=Certificate Templates' +dir +dir | fl * +dir *WebServer* + +# list CAs +cd \ +cd '.\CN=Enrollment Services' +dir +cd C: +.NOTES +Requires Enterprise Administrator permissions, since this touches the AD Configuration partition. +#> +Function New-ADCSDrive { +param( + [string]$Server = (Get-ADDomainController -Discover -ForceDiscover -Writable).HostName[0] +) + $ConfigNC = $((Get-ADRootDSE -Server $Server).configurationNamingContext) + New-PSDrive -Name ADCS -PSProvider ActiveDirectory -Root "CN=Public Key Services,CN=Services,$ConfigNC" -Server $Server -Scope Global +} + + +Export-ModuleMember -Function *-ADCS* diff --git a/ansible/files/adcs/templates/ESC1.json b/ansible/files/adcs/templates/ESC1.json new file mode 100644 index 0000000..a102696 Binary files /dev/null and b/ansible/files/adcs/templates/ESC1.json differ diff --git a/ansible/files/adcs/templates/ESC2.json b/ansible/files/adcs/templates/ESC2.json new file mode 100644 index 0000000..82414d6 Binary files /dev/null and b/ansible/files/adcs/templates/ESC2.json differ diff --git a/ansible/files/adcs/templates/ESC3-CRA.json b/ansible/files/adcs/templates/ESC3-CRA.json new file mode 100644 index 0000000..2882ef5 Binary files /dev/null and b/ansible/files/adcs/templates/ESC3-CRA.json differ diff --git a/ansible/files/adcs/templates/ESC3.json b/ansible/files/adcs/templates/ESC3.json new file mode 100644 index 0000000..fb346c7 Binary files /dev/null and b/ansible/files/adcs/templates/ESC3.json differ diff --git a/ansible/files/adcs/templates/ESC4.json b/ansible/files/adcs/templates/ESC4.json new file mode 100644 index 0000000..a5f29a3 Binary files /dev/null and b/ansible/files/adcs/templates/ESC4.json differ diff --git a/ansible/files/software/BgInfo.bgi b/ansible/files/software/BgInfo.bgi new file mode 100644 index 0000000..ecd219f Binary files /dev/null and b/ansible/files/software/BgInfo.bgi differ diff --git a/ansible/files/software/BgInfo.exe b/ansible/files/software/BgInfo.exe new file mode 100644 index 0000000..76d3d31 Binary files /dev/null and b/ansible/files/software/BgInfo.exe differ diff --git a/ansible/files/software/PsExec64.exe b/ansible/files/software/PsExec64.exe new file mode 100644 index 0000000..db94608 Binary files /dev/null and b/ansible/files/software/PsExec64.exe differ diff --git a/ansible/files/software/Sysmon64.exe b/ansible/files/software/Sysmon64.exe new file mode 100644 index 0000000..8d72282 Binary files /dev/null and b/ansible/files/software/Sysmon64.exe differ diff --git a/ansible/files/software/googlechromestandaloneenterprise64.msi b/ansible/files/software/googlechromestandaloneenterprise64.msi new file mode 100644 index 0000000..b958b6f Binary files /dev/null and b/ansible/files/software/googlechromestandaloneenterprise64.msi differ diff --git a/ansible/files/software/npp.exe b/ansible/files/software/npp.exe new file mode 100644 index 0000000..3ca17fa Binary files /dev/null and b/ansible/files/software/npp.exe differ diff --git a/ansible/files/software/sysmonconfig-export.xml b/ansible/files/software/sysmonconfig-export.xml new file mode 100644 index 0000000..028d373 --- /dev/null +++ b/ansible/files/software/sysmonconfig-export.xml @@ -0,0 +1,1200 @@ + + + + + md5,sha256,IMPHASH + + + + + + + + + + + + + + + + + "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" + C:\Windows\system32\DllHost.exe /Processid + C:\Windows\system32\wbem\wmiprvse.exe -Embedding + C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding + C:\Windows\system32\wermgr.exe -upload + C:\Windows\system32\SearchIndexer.exe /Embedding + C:\windows\system32\wermgr.exe -queuereporting + \??\C:\Windows\system32\autochk.exe * + \SystemRoot\System32\smss.exe + C:\Windows\System32\RuntimeBroker.exe -Embedding + C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe + C:\Windows\System32\TokenBrokerCookies.exe + C:\Windows\System32\plasrv.exe + C:\Windows\System32\wifitask.exe + C:\Windows\system32\CompatTelRunner.exe + C:\Windows\system32\PrintIsolationHost.exe + C:\Windows\system32\SppExtComObj.Exe + C:\Windows\system32\audiodg.exe + C:\Windows\system32\conhost.exe + C:\Windows\system32\mobsync.exe + C:\Windows\system32\musNotification.exe + C:\Windows\system32\musNotificationUx.exe + C:\Windows\system32\powercfg.exe + C:\Windows\system32\sndVol.exe + C:\Windows\system32\sppsvc.exe + C:\Windows\system32\wbem\WmiApSrv.exe + AppContainer + %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows + C:\windows\system32\wermgr.exe -queuereporting + C:\WINDOWS\system32\devicecensus.exe UserCxt + C:\Windows\System32\usocoreworker.exe -Embedding + C:\Windows\system32\SearchIndexer.exe + + C:\Windows\system32\svchost.exe -k appmodel -s StateRepository + C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc + C:\Windows\system32\svchost.exe -k appmodel + C:\Windows\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc + C:\Windows\system32\svchost.exe -k camera -s FrameServer + C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM + C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay + C:\Windows\system32\svchost.exe -k defragsvc + C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc + C:\Windows\system32\svchost.exe -k imgsvc + C:\Windows\system32\svchost.exe -k localService -s EventSystem + C:\Windows\system32\svchost.exe -k localService -s bthserv + C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc + C:\Windows\system32\svchost.exe -k localService -s nsi + C:\Windows\system32\svchost.exe -k localService -s w32Time + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc + C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -s BTAGService + C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p -s SSDPSRV + C:\Windows\system32\svchost.exe -k localServiceNoNetwork + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s NgcSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -p -s NgcCtnrSvc + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SCardSvr + C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv + C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost + C:\Windows\System32\svchost.exe -k localSystemNetworkRestricted -p -s WdiSystemHost + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc + C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc + C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC + C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC + C:\Windows\system32\svchost.exe -k netsvcs -p -s BITS + C:\Windows\system32\svchost.exe -k netsvcs -s BITS + C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc + C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc + C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo + C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc + C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc + C:\Windows\system32\svchost.exe -k netsvcs -s SENS + C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv + C:\Windows\system32\svchost.exe -k netsvcs -s Themes + C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc + C:\Windows\system32\svchost.exe -k networkService -s Dnscache + C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation + C:\Windows\system32\svchost.exe -k networkService -s NlaSvc + C:\Windows\system32\svchost.exe -k networkService -s TermService + C:\Windows\system32\svchost.exe -k networkService + C:\Windows\system32\svchost.exe -k networkService -p + C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k rPCSS + C:\Windows\system32\svchost.exe -k secsvcs + C:\Windows\system32\svchost.exe -k swprv + C:\Windows\system32\svchost.exe -k unistackSvcGroup + C:\Windows\system32\svchost.exe -k utcsvc + C:\Windows\system32\svchost.exe -k wbioSvcGroup + C:\Windows\system32\svchost.exe -k werSvcGroup + C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc + C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC + C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc + C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC + C:\Windows\system32\svchost.exe -k wsappx + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\Windows\system32\deviceenroller.exe /c /AutoEnrollMDM + + "C:\Program Files (x86)\Microsoft\Edge Dev\Application\msedge.exe" --type= + + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + + C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE + C:\Program Files\Microsoft Office\Office16\msoia.exe + C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + + C:\Program Files\Windows Media Player\wmpnscfg.exe + + "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= + "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= + + + + + + + + + + C:\Users + .exe + \Device\HarddiskVolumeShadowCopy + + + + + + OneDrive.exe + C:\Windows\system32\backgroundTaskHost.exe + setup + install + Update\ + redist.exe + msiexec.exe + TrustedInstaller.exe + \NVIDIA\NvBackend\ApplicationOntology\ + + + + + + + + + + + + + + + + + C:\Users + C:\Recycle + C:\ProgramData + C:\Windows\Temp + \ + C:\perflogs + C:\intel + C:\Windows\fonts + C:\Windows\system32\config + + at.exe + certutil.exe + cmd.exe + cmstp.exe + cscript.exe + driverquery.exe + dsquery.exe + hh.exe + infDefaultInstall.exe + java.exe + javaw.exe + javaws.exe + mmc.exe + msbuild.exe + mshta.exe + msiexec.exe + nbtstat.exe + net.exe + net1.exe + notepad.exe + nslookup.exe + powershell.exe + powershell_ise.exe + qprocess.exe + qwinsta.exe + qwinsta.exe + reg.exe + regsvcs.exe + regsvr32.exe + rundll32.exe + rwinsta.exe + sc.exe + schtasks.exe + taskkill.exe + tasklist.exe + wmic.exe + wscript.exe + + bitsadmin.exe + esentutl.exe + expand.exe + extrac32.exe + findstr.exe + GfxDownloadWrapper.exe + ieexec.exe + makecab.exe + replace.exe + Excel.exe + Powerpnt.exe + Winword.exe + squirrel.exe + + nc.exe + ncat.exe + psexec.exe + psexesvc.exe + tor.exe + vnc.exe + vncservice.exe + vncviewer.exe + winexesvc.exe + nmap.exe + psinfo.exe + + 22 + 23 + 25 + 143 + 3389 + 5800 + 5900 + 4444 + + 1080 + 3128 + 8080 + + 1723 + 9001 + 9030 + + + + + + + C:\ProgramData\Microsoft\Windows Defender\Platform\ + AppData\Local\Microsoft\Teams\current\Teams.exe + .microsoft.com + microsoft.com.akadns.net + microsoft.com.nsatc.net + + 23.4.43.27 + 72.21.91.29 + + 127.0.0.1 + fe80:0:0:0 + + + + + + + + + + + + + + + C:\Users + \ + + + + + + + + + + + + + + + + microsoft + windows + Intel + + + + + + + + + + + + + + + + + + + + + + C:\Windows\system32\wbem\WmiPrvSE.exe + C:\Windows\system32\svchost.exe + C:\Windows\system32\wininit.exe + C:\Windows\system32\csrss.exe + C:\Windows\system32\services.exe + C:\Windows\system32\winlogon.exe + C:\Windows\system32\audiodg.exe + C:\Windows\system32\kernel32.dll + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \Start Menu + \Startup\ + \Content.Outlook\ + \Downloads\ + .application + .appref-ms + .bat + .chm + .cmd + .cmdline + .crx + .dmp + .docm + .dll + .exe + .exe.log + .jar + .jnlp + .jse + .hta + .job + .pptm + .ps1 + .sct + .sys + .scr + .vbe + .vbs + .wsc + .wsf + .xlsm + .ocx + proj + .sln + .xls + C:\Users\Default + C:\Windows\system32\Drivers + C:\Windows\SysWOW64\Drivers + C:\Windows\system32\GroupPolicy\Machine\Scripts + C:\Windows\system32\GroupPolicy\User\Scripts + C:\Windows\system32\Wbem + C:\Windows\SysWOW64\Wbem + C:\Windows\system32\WindowsPowerShell + C:\Windows\SysWOW64\WindowsPowerShell + C:\Windows\Tasks\ + C:\Windows\system32\Tasks + C:\Windows\SysWOW64\Tasks + \Device\HarddiskVolumeShadowCopy + + C:\Windows\AppPatch\Custom + VirtualStore + + .xls + .ppt + .rtf + + + + + + + C:\Program Files (x86)\EMET 5.5\EMET_Service.exe + + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + + C:\Windows\system32\smss.exe + C:\Windows\system32\CompatTelRunner.exe + \\?\C:\Windows\system32\wbem\WMIADAP.EXE + C:\Windows\system32\mobsync.exe + C:\Windows\system32\DriverStore\Temp\ + C:\Windows\system32\wbem\Performance\ + C:\Windows\Installer\ + + C:\$WINDOWS.~BT\Sources\ + C:\Windows\winsxs\amd64_microsoft-windows + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CurrentVersion\Run + Policies\Explorer\Run + Group Policy\Scripts + Windows\System\Scripts + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit + HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + UserInitMprLogonScript + user shell folders\startup + + \ServiceDll + \ServiceManifest + \ImagePath + \Start + + Control\Terminal Server\WinStations\RDP-Tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser + fDenyTSConnections + LastLoggedOnUser + RDP-tcp\PortNumber + Services\PortProxy\v4tov4 + + \command\ + \ddeexec\ + {86C86720-42A0-1069-A2E8-08002B30309D} + exefile + + \InprocServer32\(Default) + + \Hidden + \ShowSuperHidden + \HideFileExt + + Classes\*\ + Classes\AllFilesystemObjects\ + Classes\Directory\ + Classes\Drive\ + Classes\Folder\ + Classes\PROTOCOLS\ + ContextMenuHandlers\ + CurrentVersion\Shell + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + + HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ + + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + + HKLM\SYSTEM\CurrentControlSet\Services\WinSock + \ProxyServer + + HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders + HKLM\Software\Microsoft\Netsh + Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable + + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + \EnableFirewall + \DoNotAllowExceptions + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + + Microsoft\Office\Outlook\Addins\ + Office Test\ + Security\Trusted Documents\TrustRecords + \EnableBHO + + Internet Explorer\Toolbar\ + Internet Explorer\Extensions\ + Browser Helper Objects\ + \DisableSecuritySettingsCheck + \3\1206 + \3\2500 + \3\1809 + + HKLM\Software\Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\ + HKLM\Software\Classes\WOW6432Node\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\ + HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\ + HKLM\Software\Classes\WOW6432Node\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\ + + \UrlUpdateInfo + \InstallSource + \EulaAccepted + + \DisableAntiSpyware + \DisableAntiVirus + \SpynetReporting + DisableRealtimeMonitoring + \SubmitSamplesConsent + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + + HKLM\Software\Microsoft\Security Center\ + SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + VirtualStore + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\ + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \FriendlyName + HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\Software\Microsoft\Tracing\RASAPI32 + HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\ + \Keyboard Layout\Preload + \Keyboard Layout\Substitutes + + \LowerCaseLongPath + \Publisher + \BinProductVersion + \DriverVersion + \DriverVerVersion + \LinkDate + Compatibility Assistant\Store\ + + regedit.exe + \ + + + + + + + + \{CAFEEFAC- + CreateKey + HKLM\COMPONENTS + + HKLM\Software\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache + + Toolbar\WebBrowser + Browser\ITBar7Height + Browser\ITBar7Layout + Internet Explorer\Toolbar\Locked + Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} + }\PreviousPolicyAreas + \Control\WMI\Autologger\ + HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start + \Lsa\OfflineJoin\CurrentValue + HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ + _Classes\AppX + HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LsaPid + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains + + \Services\BITS\Start + \services\clr_optimization_v2.0.50727_32\Start + \services\clr_optimization_v2.0.50727_64\Start + \services\clr_optimization_v4.0.30319_32\Start + \services\clr_optimization_v4.0.30319_64\Start + \services\deviceAssociationService\Start + \services\fhsvc\Start + \services\nal\Start + \services\trustedInstaller\Start + \services\tunnel\Start + \services\usoSvc\Start + + \UserChoice\ProgId + \UserChoice\Hash + \OpenWithList\MRUList + Shell Extentions\Cached + + HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\PSScriptOrder + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\SOM-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\GPO-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\IsPowershell + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\ExecTime + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\PSScriptOrder + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\SOM-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\GPO-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\IsPowershell + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\ExecTime + \safer\codeidentifiers\0\HASHES\{ + + VirtualStore\MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\ + HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ + + C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe + HKCR\VLC. + HKCR\iTunes. + + HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{945a8954-c147-4acd-923f-40c45405a658} + + + + + + + + + + + Downloads + Temp\7z + Startup + .bat + .cmd + .doc + .hta + .jse + .lnk + .ppt + .ps1 + .ps2 + .reg + .sct + .vb + .vbe + .vbs + .wsc + .wsf + + + + + + + + + + + + + + + + + + + + + + + + + + paexec;remcom;csexec + + \lsadump;\cachedump;\wceservicepipe + + \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\svcctl;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + + MSSE-;-server + \postex_ + \postex_ssh_ + \status_ + \msagent_ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + .arpa. + .arpa + .msftncsi.com + ..localmachine + localhost + + -pushp.svc.ms + .b-msedge.net + .bing.com + .hotmail.com + .live.com + .live.net + .s-microsoft.com + .microsoft.com + .microsoftonline.com + .microsoftstore.com + .ms-acdc.office.com + .msedge.net + .msn.com + .msocdn.com + .skype.com + .skype.net + .windows.com + .windows.net.nsatc.net + .windowsupdate.com + .xboxlive.com + login.windows.net + C:\ProgramData\Microsoft\Windows Defender\Platform\ + + .activedirectory.windowsazure.com + .aria.microsoft.com + .msauth.net + .msftauth.net + .office.net + .opinsights.azure.com + .res.office365.com + acdc-direct.office.com + atm-fp-direct.office.com + loki.delve.office.com + management.azure.com + messaging.office.com + outlook.office365.com + portal.azure.com + protection.outlook.com + substrate.office.com + .measure.office.com + + .adobe.com + .adobe.io + .mozaws.net + .mozilla.com + .mozilla.net + .mozilla.org + .spotify.com + .spotify.map.fastly.net + .wbx2.com + .webex.com + clients1.google.com + clients2.google.com + clients3.google.com + clients4.google.com + clients5.google.com + clients6.google.com + safebrowsing.googleapis.com + + .akadns.net + .netflix.com + aspnetcdn.com + ajax.googleapis.com + cdnjs.cloudflare.com + fonts.googleapis.com + .typekit.net + cdnjs.cloudflare.com + .stackassets.com + .steamcontent.com + play.google.com + content-autofill.googleapis.com + + .disqus.com + .fontawesome.com + disqus.com + + .1rx.io + .2mdn.net + .3lift.com + .adadvisor.net + .adap.tv + .addthis.com + .adform.net + .adnxs.com + .adroll.com + .adrta.com + .adsafeprotected.com + .adsrvr.org + .adsymptotic.com + .advertising.com + .agkn.com + .amazon-adsystem.com + .amazon-adsystem.com + .analytics.yahoo.com + .aol.com + .betrad.com + .bidswitch.net + .casalemedia.com + .chartbeat.net + .cnn.com + .convertro.com + .criteo.com + .criteo.net + .crwdcntrl.net + .demdex.net + .domdex.com + .dotomi.com + .doubleclick.net + .doubleverify.com + .emxdgt.com + .everesttech.net + .exelator.com + .google-analytics.com + .googleadservices.com + .googlesyndication.com + .googletagmanager.com + .googlevideo.com + .gstatic.com + .gvt1.com + .gvt2.com + .ib-ibi.com + .jivox.com + .krxd.net + .lijit.com + .mathtag.com + .moatads.com + .moatpixel.com + .mookie1.com + .myvisualiq.net + .netmng.com + .nexac.com + .openx.net + .optimizely.com + .outbrain.com + .pardot.com + .phx.gbl + .pinterest.com + .pubmatic.com + .quantcount.com + .quantserve.com + .revsci.net + .rfihub.net + .rlcdn.com + .rubiconproject.com + .scdn.co + .scorecardresearch.com + .serving-sys.com + .sharethrough.com + .simpli.fi + .sitescout.com + .smartadserver.com + .snapads.com + .spotxchange.com + .taboola.com + .taboola.map.fastly.net + .tapad.com + .tidaltv.com + .trafficmanager.net + .tremorhub.com + .tribalfusion.com + .turn.com + .twimg.com + .tynt.com + .w55c.net + .ytimg.com + .zorosrv.com + 1rx.io + adservice.google.com + ampcid.google.com + clientservices.googleapis.com + googleadapis.l.google.com + imasdk.googleapis.com + l.google.com + ml314.com + mtalk.google.com + update.googleapis.com + www.googletagservices.com + + .pscp.tv + + .amazontrust.com + .digicert.com + .globalsign.com + .globalsign.net + .intel.com + .symcb.com + .symcd.com + .thawte.com + .usertrust.com + .verisign.com + ocsp.identrust.com + pki.goog + msocsp.com + ocsp.comodoca.com + ocsp.entrust.net + ocsp.godaddy.com + ocsp.int-x3.letsencrypt.org + ocsp.msocsp.com + pki.goog + ocsp.godaddy.com + amazontrust.com + ocsp.sectigo.com + pki-goog.l.google.com + .usertrust.com + ocsp.comodoca.com + ocsp.verisign.com + ocsp.entrust.net + ocsp.identrust.com + status.rapidssl.com + status.thawte.com + ocsp.int-x3.letsencrypt.org + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -- cgit v1.2.3