Microsoft just released a new tool called "NetCease" for anti-network reconnaissance. What does NetCease do, and...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
how important are anti-recon tools for protecting networks?
NetCease is a short PowerShell script for anti-network reconnaissance. It prevents attackers from looking for sensitive data after they get inside a network. Let's take a look at how the data is queried and how the script can stop the query.
An attacker uses the Net Session Enumeration (NetSessionEnum) method to discover a computer's name, IP address, the name of a user who has established a session with the domain controller or a server, and how long the session has been active or idle. After 90 minutes of scanning the network, the attacker may get shut out. However, that's too long; the data is already in the hands of the attacker who could use it to attack the network.
NetSessionEnum works after a user establishes the first session between a workstation and a server. An administrator must start server service before the user can successfully connect with it. One favorite approach attackers (and ethical hackers) use is a penetration testing tool like Bloodhound or Nmap, which automates their work of scanning the network's complex paths.
To protect the network, the administrator runs NetCease in the PowerShell. The NetCease script was created by two Microsoft security researchers; it changes a local Windows registry key that controls NetSessionEnum permissions. Permissions for the "Authenticated Users" group are replaced with the permissions for interactive, service and batch logon sessions. This means that access to private network information becomes restricted unless the individual is authenticated. The attacker pretending to be an authenticated user is, therefore, not permitted to use NetSessionEnum and can't perform reconnaissance on the network.
In addition, NetCease can alert network administrators and security managers of any unauthorized attempts to use NetSessionEnum.
Anti-network reconnaissance tools can stop attackers from collecting sensitive data after gaining a foothold in a network. Changing a Windows registry key, however, is more effective than an open source, anti-reconnaissance tool for protecting the network.
Read more on why enterprises must limit administrative access
Find out about data obfuscation techniques and best practices
Discover the security benefits of MAC address randomization
Dig Deeper on IPv6 security and network protocols security
Related Q&A from Judith Myerson
Malware implants RedLeaves and PlugX infected networked systems in multiple industries and leveraged stolen administrator credentials. Expert Judith ...continue reading
A DocuSign phishing email with a link to a malicious Word document recently targeted the company's users. Expert Judith Myerson outlines six ways to ...continue reading
A vulnerability in Intel AMT enables attackers to gain remote access to PCs and devices. Expert Judith Myerson explains how the attack works and what...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.