Security Experts:

Connect with us

Hi, what are you looking for?


Network Security

Microsoft Researchers Release Anti-Reconnaissance Tool

Microsoft researchers have released a new tool designed to help security teams protect corporate networks by making it more difficult for attackers to conduct reconnaissance.

Microsoft researchers have released a new tool designed to help security teams protect corporate networks by making it more difficult for attackers to conduct reconnaissance.

The tool, dubbed “NetCease,” was developed by Itai Grady and Tal Be’ery of the Microsoft Advanced Threat Analytics (ATA) research team. NetCease has been made available on Microsoft’s TechNet Gallery, but it’s not an official Microsoft tool. The software is provided under the default license terms for “Software on Documentation Portals.”

During the reconnaissance phase of an attack, hackers need to collect information that will allow them to move from the device they compromised first to other machines on the victim’s network. Specifically, they need to identify privileged users and the computers they accessed.

Once they identified the targets, attackers can use the NetSessionEnum function to obtain information about sessions established on domain controllers (DC) or other servers. NetSessionEnum can be executed by any authenticated user and it provides information such as device name and IP address, the username that established a session, and the length of the session.

This technique has been used in numerous attacks and it has been integrated into popular penetration testing tools such as PowerSploit and BloodHound.

By default, any domain user is allowed to execute the NetSessionEnum method remotely, and the default permissions can only be changed by manually editing a registry key. Grady and Be’ery created NetCease to help administrators easily modify these permissions and make it more difficult for attackers to obtain information needed to move laterally within the network.

NetCease is a short PowerShell script that must be executed once on each server or domain controller that needs to be protected. Since it’s a PowerShell script, its source code is also available.

“The NetCease script hardens the access to the NetSessionEnum method by removing the execute permission for Authenticated Users group and adding permissions for interactive, service and batch logon sessions,” the researchers explained. “This will allow any administrator, system operator and power user to remotely call this method, and any interactive/service/batch logon session to call it locally.”

The NetCease tool has been released as a preview for an upcoming Black Hat Europe talk where Be’ery and Grady will demonstrate what they call “offensive cyber defense” methods.

Related: New Windows Attack Turns Evil Maid into Malicious Butler

Related: Facebook’s “Osquery” Security Tool Available for Windows

Related: Mozilla Launches Website Security Testing Tool

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cybersecurity Funding

Forward Networks, a company that provides network security and reliability solutions, has raised $50 million from several investors.

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Network Security

Cisco patched a high-severity SQL injection vulnerability in Unified Communications Manager (CM) and Unified Communications Manager Session Management Edition (CM SME).

Cybersecurity Funding

Network security provider Corsa Security last week announced that it has raised $10 million from Roadmap Capital. To date, the company has raised $50...

Network Security

Vulnerabilities identified in TP-Link and NetComm router models could be exploited to achieve remote code execution (RCE).