Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

NTLM has three versions - NTLMv1, NTLMv2 and NTLMv2 Session Security. NTLMv2 is supposed to offer better security than its previous version, and to some extent it does provides better defense against relay and brute force attacks, but does not completely block them. NTLMv2 Session Security is a session security protocol that can be used in conjunction with NTLMv1 or NTLMv2 to provide additional security.

The Sysdig Windows agent is a game-changer for cloud infrastructure, particularly when it comes to securing Windows containers in Kubernetes environments. While many endpoint protection agents are designed to provide security for traditional Windows hosts, Sysdig goes a step further by incorporating Kubernetes-specific context into its system introspection.

This article explains how, with 1Password’s Device Trust solution, you can use osquery’s file monitoring capabilities to oversee your Windows fleet.

Data Execution Prevention (DEP) is a Windows security feature that protects systems by preventing code from executing in memory areas designated for data storage. By ensuring only authorized programs can run in specific memory regions, DEP helps block malicious software, such as viruses, from executing harmful code. It operates at both hardware and software levels, monitoring memory usage to prevent exploits like buffer overflow attacks.

Microsoft Hyper-V is a type 1 hypervisor that you can install on Windows – including on Windows 10 and Windows Server 2019. In some scenarios, you may need to uninstall Hyper-V on your Windows machine. For example, VMware Workstation and Hyper-V are not compatible when installed on the same machine. The same issues occur with other type 2 hypervisors like VirtualBox.

Managing files and directories is a common task in computing, especially in the Windows PowerShell environment. The Remove-Item in PowerShell is a key cmdlet for deleting files and directories, as well as other types of items in PowerShell. Remove-Item can be used for local file systems as well as other PowerShell providers like the Registry, Certificate Store, and Environment variables.

Managing files and directories is a common task in computing, especially in the Windows PowerShell environment. The Remove-Item in PowerShell is a key cmdlet for deleting files and directories, as well as other types of items in PowerShell. Remove-Item can be used for local file systems as well as other PowerShell providers like the Registry, Certificate Store, and Environment variables.

DNS (Domain Name System) is a key component of the Internet infrastructure. DNS functions as a distributed directory service that translates human-readable domain names into machine-readable IP addresses. When you type a website address into your browser, the DNS system helps your browser find the right server on the internet. DNS uses a hierarchical and distributed database to manage the mapping of domain names to IP addresses.

Administrators can perform all typical Windows registry operations using either the old-good regedit user interface or the reg.exe utility. But there is another option — PowerShell. PowerShell can dramatically streamline the work of managing the registry, either on the local machine or remotely.

Around two years ago, memN0ps took the initiative to create one of the first publicly available rootkit proof of concepts (PoCs) in Rust as an experimental project, while learning a new programming language. It still lacks many features, which are relatively easy to add once the concept is understood, but it was developed within a month, at a part-time capacity.