rules-windows

RISK: Patching AmsiScanBuffer or EtwEventWrite disables in-process script scanning and EDR telemetry (MITRE T1562.001/006) — there is no legitimate use. FIX: remove the bypass; if a script is being blocked by AMSI, fix the script rather than the scanner.

autorun.inf files trigger automatic execution when media is inserted — a classic worm propagation and persistence technique. Modern Windows disables AutoRun, but these files remain suspicious indicators.

RISK: Disabling BitLocker exposes the volume key to offline DMA, WinRE, and CVE-2024-20666 / CVE-2025-21210 class attacks. FIX: leave BitLocker enabled with TPM+PIN and escrow recovery keys to AD/Entra.

RISK: BITS jobs with /SetNotifyCmdLine survive reboot, run as SYSTEM, and bypass many egress filters — a long-running persistence/exfil technique (MITRE T1197). FIX: restrict BITS destinations to WSUS/Intune FQDNs via firewall and GPO, and use a Windows Service for legitimate background work.

RISK: Clearing the Windows event logs / USN journal (wevtutil cl, Clear-EventLog, fsutil usn deletejournal, auditpol /clear) destroys the forensic record — Indicator Removal (MITRE T1070.001), a hallmark of post-exploitation cleanup. FIX: never clear logs to free space; size them with 'wevtutil sl <log> /ms:<bytes>' and forward to a SIEM so retention is off-host.

RISK: comsvcs MiniDump, procdump lsass, ntdsutil IFM, reg save SAM, and VSS shadow copies extract NTLM/Kerberos secrets and DPAPI keys for offline cracking (MITRE T1003). FIX: enable LSA Protection (RunAsPPL) and Credential Guard, and use LAPS for local-admin credentials.

Adding Windows Defender exclusions creates security blind spots. Attackers commonly write malware to excluded paths to bypass detection. Only exclude specific verified trusted paths.

Disabling Windows Defender real-time monitoring removes the primary malware defense on Windows. Never disable Defender in production — add specific exclusions if needed.

RISK: Formatting or wiping a volume (Format-Volume, Clear-Disk, format C:, cipher /w, diskpart clean) destroys the partition or filesystem (MITRE T1561.002 Disk Wipe) with no undo. FIX: confirm the target via Get-Disk/Get-Volume, and run disk operations interactively in an elevated console — never from an agent.

RISK: certutil/bitsadmin/IEX download cradles fetch and execute remote code in-memory (MITRE T1105/T1059.001), the core technique behind ClickFix and 2024-2025 fake-captcha campaigns. FIX: download to disk with Invoke-WebRequest, verify the Authenticode signature with Get-AuthenticodeSignature, then execute.

RISK: Force-push, hard reset, branch -D, reflog expire, filter-branch, or deleting the .git directory rewrites or destroys version-control history (MITRE T1485) — losing commits and breaking teammates' clones. FIX: prefer 'git revert' for shared branches and '--force-with-lease' only after confirming the remote ref; never delete .git from an agent.

Redirecting Microsoft/Windows Update domains in the hosts file blocks security patches and Defender signature updates. This is a common malware technique to prevent detection and remediation.

Granting Everyone:F (Full Control) on files or directories allows any user on the system to read, write, delete, and execute. Use specific user/group permissions instead.

HYGIENE: pause, cmd /k, Read-Host, 'timeout /t' without /nobreak, and GUI launchers (notepad, mmc, *.msc, *.cpl) block waiting for input that a non-interactive agent shell can never supply — the command hangs until it times out. FIX: use 'Start-Sleep -Seconds N' (or 'timeout /t N /nobreak') for delays, write files with Set-Content instead of opening notepad, and drive configuration with PowerShell cmdlets instead of *.msc consoles.

RISK: mshta/regsvr32/rundll32 invoked with a URL or scrobj.dll is the Squiblydoo/Koadic LOLBIN proxy-execution pattern (MITRE T1218) used to bypass application allowlisting. FIX: install signed MSIs via msiexec or run a signed PowerShell script under WDAC enforcement.

RISK: Stripping the Mark-of-the-Web (Zone.Identifier ADS) defeats SmartScreen, Smart App Control, and Office Protected View — the exact bypass exploited by CVE-2024-21412, CVE-2024-38213 (copy2pwn), and CVE-2025-33053. FIX: leave MOTW intact; if a file is internally trusted, re-sign it with Authenticode instead of unblocking.

Creating new local user accounts or adding users to the Administrators group is a high-impact action. Document new accounts and ensure they follow the principle of least privilege.

Base64-encoded PowerShell commands (-EncodedCommand) obfuscate intent and are the #1 indicator of malicious PowerShell activity. Use plain-text scripts stored in version control.

Bypassing the PowerShell execution policy removes the control that prevents unsigned scripts from running. Use 'RemoteSigned' policy and sign scripts with a code signing certificate.

RISK: PowerShell v2 lacks AMSI integration and ScriptBlock logging, so attackers force a downgrade to evade defenses (MITRE T1562.010). FIX: remove the PowerShellV2 optional feature and require PowerShell 5.1+ with ScriptBlock and Module logging enabled.

RISK: Reading DPAPI master keys / credential blobs (Microsoft\Protect, Microsoft\Credentials, Vault), browser Login Data / key4.db, *.kdbx / *.pfx / *.ppk key files, or the SAM / ntds.dit hives harvests stored credentials and password hashes (MITRE T1555 / T1552.001 / T1003.003). FIX: never read these stores wholesale — retrieve the single secret you need through the Credential Manager / Key Vault API, which enforces per-secret access control and auditing.

RISK: Recursive force-delete of a system root (Remove-Item -Recurse -Force C:\Windows, rd /s /q C:\) irreversibly destroys the OS or user data (MITRE T1485). An unset variable turns 'Remove-Item -Recurse -Force $dir' into a root wipe. FIX: target a specific non-system absolute path, validate the variable is set, and prefer moving to a quarantine dir over deletion.

Writing to HKLM/HKCU\Software\Microsoft\Windows\CurrentVersion\Run establishes persistence — programs registered here auto-execute on user login or system boot.

Exporting SAM, SECURITY, or LSA registry hives captures credential material including password hashes and LSA secrets. These exports enable offline password cracking.

RISK: A PowerShell TCPClient/GetStream loop, nc/ncat/powercat -e, or WebClient/Invoke-RestMethod upload is a reverse shell or data-exfil channel (MITRE T1059.001 / T1041 / T1571). FIX: use an authenticated, audited API client for legitimate uploads, and never open raw sockets that pipe a shell to a remote host.

Scheduled tasks running as SYSTEM execute with the highest privilege level and persist across reboots — a primary technique for persistence and privilege escalation.

RISK: Deleting Volume Shadow Copies / backup catalogs and disabling recovery (vssadmin delete shadows, wbadmin delete catalog, bcdedit recoveryenabled No) is Inhibit System Recovery (MITRE T1490) — the precursor to every ransomware encryption stage. FIX: never delete shadows programmatically; manage VSS storage with 'vssadmin resize shadowstorage' and keep tested off-host backups.

RISK: SMB1, disabled SMB signing, and unencrypted WinRM expose hosts to NTLM relay and coerced-auth attacks (CVE-2024-43451, CVE-2025-33073). FIX: keep SMB1 disabled, require SMB signing, and run WinRM over HTTPS with Kerberos.

RISK: DROP/TRUNCATE/DELETE via sqlcmd/Invoke-Sqlcmd (or bulk bcp OUT export) mutates or exfiltrates production data (MITRE T1565.001) — a DELETE without WHERE or a DROP is unrecoverable without a backup. FIX: run destructive SQL inside a transaction with an explicit WHERE, take a verified backup first, and restrict the agent's SQL login to read-only.

Placing files in Windows Startup folders creates persistence that executes on every login. This is a common malware persistence mechanism.

RISK: Stopping or disabling Defender (WinDefend/Sense/MsMpEng), the Windows Event Log, or other security services is Impair Defenses / Service Stop (MITRE T1562.001 / T1489) — it blinds EDR and breaks audit. FIX: leave protective services running; use scoped Defender exclusions or tamper-protected policy changes instead of killing the service.

RISK: Enumerating the Credential Manager/Vault (cmdkey /list, vaultcmd), reading Winlogon DefaultPassword, or grepping for stored secrets harvests credentials from password stores (MITRE T1555 / T1552.002). FIX: retrieve only the specific secret you need from a managed vault (Credential Manager API / Key Vault) rather than dumping every stored credential.

RISK: Writing a shell\open\command (or DelegateExecute) under HKCU Classes for ms-settings/mscfile/exefile is the fodhelper / eventvwr / sdclt auto-elevate UAC bypass (MITRE T1548.002) — it runs your payload as High integrity with no prompt. FIX: request elevation legitimately (a manifest with requireAdministrator, or 'Start-Process -Verb RunAs') and remove the registry hijack.

RISK: Installing packages with publisher/checksum verification disabled (Install-Module -Force/-SkipPublisherCheck, marking a repo Trusted, choco --ignore-checksums, winget --ignore-security-hash, msiexec /i <url>) defeats supply-chain integrity (MITRE T1195). FIX: pin versions, keep -InstallationPolicy Untrusted so signatures are checked, and download MSIs to disk + verify the Authenticode signature before install.

RISK: Inline MSBuild <Target><Exec> blocks and InstallUtil-driven payloads are catalogued WDAC/AppLocker bypasses (MITRE T1127), and writes under CodeIntegrity\SiPolicy can swap policy to audit mode. FIX: enforce WDAC in block mode with a signed policy and remove MSBuild/InstallUtil from your allowlist.

WMI process creation (wmic process call create) is frequently used for lateral movement and remote code execution in attacks. Use direct process invocation or Windows services instead.