Johnng007
commented
8 months ago Fix for Issue https://github.com/wazuh/wazuh/issues/21298
(L1) Ensure 'Domain member: Maximum machine account password age' is set to '30 or fewer days, but not 0'. (Automated)
-
id: 15521 title: "Ensure 'Domain member: Maximum machine account password age' is set to '30 or fewer days, but not 0'." description: "This policy setting determines the maximum allowable age for a computer account password. By default, domain members automatically change their domain passwords every 30 days. If you increase this interval significantly so that the computers no longer change their passwords, an attacker would have more time to undertake a brute force attack against one of the computer accounts. The recommended state for this setting is: 30 or fewer days, but not 0. Note: A value of 0 does not conform to the benchmark as it disables maximum password age. Note #2: Some problems can occur as a result of machine account password expiration, particularly if a machine is reverted to a previous point-in-time state, as is common with virtual machines. Depending on how far back the reversion is, the older machine account password stored on the machine may no longer be recognized by the domain controllers, and therefore the computer loses its domain trust. This can also disrupt non-persistent VDI implementations, and devices with write filters that disallow permanent changes to the OS volume. Some organizations may choose to exempt themselves from this recommendation and disable machine account password expiration for these situations." rationale: "In Active Directory-based domains, each computer has an account and password just like every user. By default, the domain members automatically change their domain password every 30 days. If you increase this interval significantly, or set it to 0 so that the computers no longer change their passwords, an attacker will have more time to undertake a brute force attack to guess the password of one or more computer accounts." impact: "None - this is the default behavior." remediation: "To establish the recommended configuration via GP, set the following UI path to 30 or fewer days, but not 0: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Maximum machine account password age." references:
- "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age" compliance:
- cis: ["2.3.6.5"]
- cis_csc_v8: ["5.2"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"] condition: all rules:
WRONG RULE
- 'c:net.exe accounts -> n:Maximum password age (days):\s+(\d+) compare <= 30'
- 'c:net.exe accounts -> n:Maximum password age (days):\s+(\d+) compare > 0'
CORRECT RULE condition: all rules:
- 'r:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters -> MaximumPasswordAge'
- 'not r:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters -> MaximumPasswordAge -> 0'
- 'r:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters -> MaximumPasswordAge -> n:^(\d+) compare <= 30'
(L1) Ensure 'Accounts: Guest account status' is set to 'Disabled'. (Automated)
- id: 15509
title: "Ensure 'Accounts: Guest account status' is set to 'Disabled'."
description: "This policy setting determines whether the Guest account is enabled or disabled. The Guest account allows unauthenticated network users to gain access to the system. The recommended state for this setting is: Disabled. Note: This setting will have no impact when applied to the Domain Controllers organizational unit via group policy because Domain Controllers have no local account database. It can be configured at the domain level via group policy, similar to account lockout and password policy settings."
rationale: "The default Guest account allows unauthenticated network users to log on as Guest with no password. These unauthorized users could access any resources that are accessible to the Guest account over the network. This capability means that any network shares with permissions that allow access to the Guest account, the Guests group, or the Everyone group will be accessible over the network, which could lead to the exposure or corruption of data."
impact: "All network users will need to authenticate before they can access shared resources. If you disable the Guest account and the Network Access: Sharing and Security Model option is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. This policy setting should have little impact on most organizations because it is the default setting in Microsoft Windows 2000, Windows XP, and Windows Server™ 2003."
remediation: "To establish the recommended configuration via GP, set the following UI path to Disabled: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Guest account status."
references:
- "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status" compliance:
- cis: ["2.3.1.2"]
- cis_csc_v8: ["4.7"]
- cis_csc_v7: ["16.8"]
- iso_27001-2013: ["A.9.2.1"]
- pci_dss_v3.2.1: ["2.1", "2.1.1"]
- pci_dss_v4.0: ["2.2.2", "2.3.1"]
- soc_2: ["CC6.3"] condition: any rules:
- 'c:net user guest -> r:Account active\s+No'
- "c:net user guest -> r:The user name could not be found."
jk-olaoluwa
IsExec
ooniagbi
Main tasks
Checks
Syntax and semantic
Content
Auditsection from the CIS check.Unit testing
agent.logafter the SCA scan and a raw output of the result of the checks.Tests results
Analysisd (server or local)
analysisd.debug=2
Auth daemon debug (server)
authd.debug=0
Exec daemon debug (server, local, or Unix agent)
execd.debug=0
Monitor daemon debug (server, local, or Unix agent)
monitord.debug=0
Log collector (server, local or Unix agent)
logcollector.debug=0
Integrator daemon debug (server, local or Unix agent)
integrator.debug=0
Unix agentd
agent.debug=2
Deployment
sca.filestemplates.Documentation