Skip to content

[NEW-MODULE] Baseline Windows Enumerations #128

@calebstewart

Description

@calebstewart

Is your feature request related to a problem? Please describe.
No.

Describe the solution you'd like
We need to implement a full compliment of baseline windows enumerations. A good start for this would be implementing all of the checks found in the fantastic winPEAS.bat script found here.

Additional context
The following are the enumerations needed to complete this.

  • System Info
  • Hot Fixes
  • Local Date/Time
  • Audit Settings
  • Windows Event Forwarding
  • LAPS Installation
  • LSA Protection
  • WDigest Enabled
  • Cached Credentials
  • User Account Control (UAC) Settings
  • Registered AntiVirus
  • PowerShell Settings
  • Mounted Drives
  • Environment Variables
  • Installed Software
  • Remote Desktop Credentials Manager
  • WSUS Settings
  • Running Processes
  • Startup Binaries
  • Always Install Elevated
  • Network Shares
  • Network Interfaces
  • Network Bound Ports
  • Network Firewall Settings
  • Arp Tables
  • Network Routes
  • etc/hosts file
  • DNS Cache
  • WiFi Credentials
  • Basic User Info
  • Basic Group info
  • Logged On Users
  • Kerberos Tickets
  • Clipboard Contents
  • Vulnerable Services (accesschk.exe)
  • Service List
  • Service Binary Permissions
  • Unquoted Service Paths
  • PATH Environment Hijacking
  • Windows Vault Credentials
  • DPAPI Master Keys
  • Unattended Files
  • SAM and SYSTEM Backups
  • McAfee Site List
  • GPP Password
  • Cloud Credentials
  • Registry Files Credentials

Metadata

Metadata

Labels

enhancementNew feature or requestnew-moduleIssues or PRs relating to implementing new moduleswindowsIssues relating specifically to the Windows platform

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions