Microsoft researchers have released a new tool designed to help security teams protect corporate networks by making it more difficult for attackers to conduct reconnaissance.
The tool, dubbed “NetCease,” was developed by Itai Grady and Tal Be’ery of the Microsoft Advanced Threat Analytics (ATA) research team. NetCease has been made available on Microsoft’s TechNet Gallery, but it’s not an official Microsoft tool. The software is provided under the default license terms for “Software on Documentation Portals.”
During the reconnaissance phase of an attack, hackers need to collect information that will allow them to move from the device they compromised first to other machines on the victim’s network. Specifically, they need to identify privileged users and the computers they accessed.
Once they identified the targets, attackers can use the NetSessionEnum function to obtain information about sessions established on domain controllers (DC) or other servers. NetSessionEnum can be executed by any authenticated user and it provides information such as device name and IP address, the username that established a session, and the length of the session.
This technique has been used in numerous attacks and it has been integrated into popular penetration testing tools such as PowerSploit and BloodHound.
By default, any domain user is allowed to execute the NetSessionEnum method remotely, and the default permissions can only be changed by manually editing a registry key. Grady and Be’ery created NetCease to help administrators easily modify these permissions and make it more difficult for attackers to obtain information needed to move laterally within the network.
NetCease is a short PowerShell script that must be executed once on each server or domain controller that needs to be protected. Since it’s a PowerShell script, its source code is also available.
“The NetCease script hardens the access to the NetSessionEnum method by removing the execute permission for Authenticated Users group and adding permissions for interactive, service and batch logon sessions,” the researchers explained. “This will allow any administrator, system operator and power user to remotely call this method, and any interactive/service/batch logon session to call it locally.”
The NetCease tool has been released as a preview for an upcoming Black Hat Europe talk where Be’ery and Grady will demonstrate what they call “offensive cyber defense” methods.
Related: New Windows Attack Turns Evil Maid into Malicious Butler
Related: Facebook’s “Osquery” Security Tool Available for Windows
