Name Resolution and Discovery¶
When Windows needs to find another machine by name, it asks DNS. If DNS doesn't answer, it falls back to older protocols that shout the question to the whole network and accept the first reply. An attacker on the same network answers first and collects the login that follows. Turning off the fallbacks is one of the highest-value changes on a workstation.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates → Network, and MS Security Guide / MSS (Legacy) for the registry-backed ones.
Broadcast name resolution¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.6.4.1 | Configure multicast DNS (mDNS) protocol | Network → DNS Client | Disabled | mDNS resolves .local names by multicast; spoofable |
| 18.4.5 | NetBT NodeType configuration | MS Security Guide | Enabled: P-node | NetBIOS asks a WINS server only, never broadcasts. Registry: HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\NodeType = 2. |
| 18.5.7 | MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers | MSS (Legacy) | Enabled | An attacker can't force the machine to give up its name |
| 18.6.4.2 | Turn off default IPv6 DNS Servers | Network → DNS Client | Enabled | Level 2. Windows has built-in IPv6 DNS addresses it uses if nothing else is set. |
Also disable NetBIOS over TCP/IP on each adapter: Network Connections → adapter → Properties → Internet Protocol Version 4 → Advanced → WINS → Disable NetBIOS over TCP/IP. Or:
Get-CimInstance Win32_NetworkAdapterConfiguration | Where IPEnabled | ForEach-Object { $_ | Invoke-CimMethod -MethodName SetTcpipNetbios -Arguments @{TcpipNetbiosOptions=2} }
And LLMNR, which isn't in this benchmark but belongs with these: Network → DNS Client → Turn off multicast name resolution: Enabled.
Discovery protocols¶
Protocols that announce the machine to the network or map it.
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.6.9.1 | Turn on Mapper I/O (LLTDIO) driver | Network → Link-Layer Topology Discovery | Disabled | Level 2. Stops the machine mapping the network. |
| 18.6.9.2 | Turn on Responder (RSPNDR) driver | Network → Link-Layer Topology Discovery | Disabled | Level 2. Stops it answering others' mapping requests. |
| 18.6.10.2 | Turn off Microsoft Peer-to-Peer Networking Services | Network → Microsoft Peer-to-Peer Networking Services | Enabled | Level 2. Disables PNRP and peer grouping. |
| 18.6.20.1 | Configuration of wireless settings using Windows Connect Now | Network → Windows Connect Now | Disabled | Level 2. WCN pushes Wi-Fi settings with no authentication. |
| 18.6.20.2 | Prohibit access of the Windows Connect Now wizards | Network → Windows Connect Now | Enabled | Level 2. |
| 18.6.5.1 | Enable Font Providers | Network → Fonts | Disabled | Level 2. No fonts downloaded from the internet on demand. |
Proxy auto-discovery¶
WPAD lets the machine find a proxy by asking the network. An attacker who answers becomes the proxy for all web traffic. Under Administrative Templates → Center for Internet Security (CIS) → Additional Benchmark Settings (needs the CIS template; otherwise registry):
| CIS | Setting | Set to | Registry |
|---|---|---|---|
| 18.11.1 | Disable HTTP proxy features: Disable WPAD | Enabled: Checked | HKLM\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc\Start = 4 |
| 18.11.2 | Disable HTTP proxy features: Disable proxy authentication | Enabled: Disable authentication over loopback interfaces | HKLM\SOFTWARE\Policies\Microsoft\Windows\HttpService\Parameters\DisableLoopbackProxyAuth = 1 (roughly; see the benchmark for the exact keys) |
Apply¶
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" /v EnableMDNS /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v NodeType /t REG_DWORD /d 2 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v NoNameReleaseOnDemand /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD" /v AllowLLTDIOOnDomain /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD" /v AllowRspndrOnDomain /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Peernet" /v Disabled /t REG_DWORD /d 1 /f
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient"
reg query "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v NodeType
Example¶
A forensics question asks why a user's password hash showed up in an attacker's tool. The Security log shows an NTLM authentication to an address that isn't a server. LLMNR and NetBIOS were on; the user mistyped a share name, the machine broadcast the question, and the attacker's machine answered and captured the authentication. Turn both off.