Attack Surface Hardening¶
A grab-bag of settings that each close one door: files from the internet keep their warning, installers can't silently elevate, Explorer keeps its own exploit mitigations, unsigned app packages don't install, and the sandbox stays sealed. None of them break normal use.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates unless marked User Configuration.
Files from the internet¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.29.4 | Do not apply the Mark of the Web tag to files copied from insecure sources | Windows Components → File Explorer | Disabled | Downloaded files keep the tag that triggers SmartScreen and Office Protected View |
| 19.7.5.1 | Do not preserve zone information in file attachments | User Configuration → Windows Components → Attachment Manager | Disabled | Same, for email attachments |
| 19.7.5.2 | Notify antivirus programs when opening attachments | User Configuration → Attachment Manager | Enabled | Defender scans attachments as they open |
| 18.10.58.1 | Prevent downloading of enclosures | Windows Components → RSS Feeds | Enabled | RSS feeds can't drop files on the machine |
| STIG WN11-CC-000300 | Turn on Basic feed authentication over HTTP | Windows Components → RSS Feeds | Disabled | Feed credentials aren't sent in the clear |
| 19.7.46.2.1 | Prevent Codec Download | User Configuration → Windows Media Player → Playback | Enabled | Level 2. A media file can't trigger a codec download. |
Installers and packages¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.82.2 | Always install with elevated privileges | Windows Components → Windows Installer | Disabled | Enabled means any MSI a user runs gets SYSTEM. This is a well-known privilege escalation. |
| 18.10.82.1 | Allow user control over installs | Windows Components → Windows Installer | Disabled | Users can't change install options that policy set |
| 18.10.82.3 | Prevent Internet Explorer security prompt for Windows Installer scripts | Windows Components → Windows Installer | Disabled | Level 2. Keeps the warning. |
| 18.10.4.3 | Prevent non-admin users from installing packaged Windows apps | Windows Components → App Package Deployment | Enabled | Only administrators install .appx / .msix |
| 18.10.4.2 | Not allow per-user unsigned packages to install by default | App Package Deployment | Enabled | Unsigned packages are refused |
| 18.10.4.1 | Allow a Windows app to share application data between users | App Package Deployment | Disabled | Level 2. |
| 18.10.18.2 | Enable App Installer Experimental Features | Windows Components → Desktop App Installer | Disabled | |
| 18.10.18.3 | Enable App Installer Hash Override | Desktop App Installer | Disabled | A package whose hash doesn't match its manifest is refused |
| 18.10.18.4 | Enable App Installer Local Archive Malware Scan Override | Desktop App Installer | Disabled | Archives get scanned |
| 18.10.18.5 | Enable App Installer Microsoft Store Source Certificate Validation Bypass | Desktop App Installer | Disabled | Store certificates are checked |
| 18.10.18.6 | Enable App Installer ms-appinstaller protocol | Desktop App Installer | Disabled | ms-appinstaller: links in web pages can't launch an install (used in real phishing campaigns) |
| 18.10.18.1 | Enable App Installer | Desktop App Installer | Disabled | Level 2. App Installer off entirely. |
| 18.10.18.7 | Enable Windows Package Manager command line interfaces | Desktop App Installer | Disabled | Level 2. winget off. Run your updates first. |
| 18.9.7.2 | Prevent automatic download of applications associated with device metadata | System → Device Installation | Enabled | Plugging in a device doesn't fetch a vendor app |
Explorer's own mitigations¶
Explorer has per-process exploit mitigations that can be switched off by policy. They should stay on.
| CIS | Setting (Windows Components → File Explorer) | Set to |
|---|---|---|
| 18.10.29.3 | Turn off Data Execution Prevention for Explorer | Disabled |
| 18.10.29.5 | Turn off heap termination on corruption | Disabled |
| 18.10.29.6 | Turn off shell protocol protected mode | Disabled |
Kernel and filesystem¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.9.13.1 | Boot-Start Driver Initialization Policy | System → Early Launch Antimalware | Enabled: Good, unknown and bad but critical | Drivers Defender flags as bad don't load at boot, unless Windows can't boot without them |
| 18.9.17.1 | Enable / disable CLFS logfile authentication | System → Filesystem | Enabled | Common Log File System entries are signed; unsigned CLFS files have been a privilege-escalation route |
| 18.4.4 | Enable SEHOP | MS Security Guide | Enabled | Covered under Other Security Options |
| 18.4.3 | Enable Certificate Padding | MS Security Guide | Enabled | Same |
PowerShell 2.0¶
Windows PowerShell 2.0 is an optional feature kept for compatibility. It predates script block logging and AMSI, so an attacker who runs powershell -Version 2 gets an engine that logs nothing and isn't scanned. Remove it (STIG WN11-00-000155).
Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root | Select State
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -NoRestart
Application allowlisting¶
The STIG's strongest rule (WN11-00-000035): the machine should run only software that's been explicitly approved, and refuse everything else. Windows does this with AppLocker (gpedit.msc → Windows Settings → Security Settings → Application Control Policies) or Windows Defender Application Control. A full allowlist takes days to build and test, so it's out of scope for a competition round. What is in scope: AppLocker's default rules, which allow everything in Program Files and Windows and block executables run from user folders, where downloaded malware lands.
gpedit.msc→ Application Control Policies → AppLocker → Executable Rules → right-click → Create Default Rules.- Right-click AppLocker → Properties → Executable rules: Configured, Enforce rules.
- Start the Application Identity service:
Set-Service AppIDSvc -StartupType Automatic; Start-Service AppIDSvc.
Test by copying calc.exe to the desktop and running it; it should be blocked.
Windows Sandbox¶
Sandbox runs a throwaway Windows for testing untrusted files. It's only useful if it stays sealed.
| CIS | Setting (Windows Components → Windows Sandbox) | Set to |
|---|---|---|
| 18.10.92.1 | Allow clipboard sharing with Windows Sandbox | Disabled |
| 18.10.92.3 | Allow networking in Windows Sandbox | Disabled |
| 18.10.92.2 | Allow mapping folders into Windows Sandbox | Disabled (Level 2) |
Miscellaneous¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.6.2 | Block launching Universal Windows apps with Windows Runtime API access from hosted content | Windows Components → App runtime | Enabled | Level 2. Web content can't launch apps with system API access. |
| 18.10.93.2.1 | Prevent users from modifying settings | Windows Components → Windows Security → App and browser protection | Enabled | Users can't turn off SmartScreen and exploit protection from the Windows Security app |
| 18.10.14.1 | Require pin for pairing | Windows Components → Connect | Enabled: First Time (or Always) | Wireless display pairing needs a PIN |
Apply the important ones¶
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v EnableUserControl /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx" /v BlockNonAdminUserInstall /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" /v EnableMSAppInstallerProtocol /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" /v EnableHashOverride /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v NoDataExecutionPrevention /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v NoHeapTerminationOnCorruption /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v PreXPSP2ShellProtocolBehavior /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v SaveZoneInformation /t REG_DWORD /d 2 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\EarlyLaunch" /v DriverLoadPolicy /t REG_DWORD /d 3 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Sandbox" /v AllowClipboardRedirection /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Sandbox" /v AllowNetworking /t REG_DWORD /d 0 /f
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" /v EnableMSAppInstallerProtocol
Both 0. If the first query says the value doesn't exist, that's also fine (the default is off); 1 is the problem.
Example¶
AlwaysInstallElevated is 1 in both HKLM and HKCU. Any user can build an MSI that runs a command and get SYSTEM. This is a favorite on competition images because nothing visible changes. Set both to 0.