home.social

#windowssecurity — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #windowssecurity, aggregated by home.social.

  1. Windows SMB Flaw Enables File Lockdowns Without Traditional Ransomware Traces

    New Windows 'GhostLock' flaw lets attackers lock files on SMB shares. It bypasses security and leaves no traditional ransomware traces. Learn how to respond.

    #WindowsSecurity, #CyberAttack, #Ransomware, #SMB, #GhostLock

    newsletter.tf/windows-ghostloc

  2. Attackers can now lock files on Windows SMB shares using a new 'GhostLock' method. This exploit is harder to detect than normal ransomware because it doesn't leave typical signs like file changes.

    #WindowsSecurity, #CyberAttack, #Ransomware, #SMB, #GhostLock
    newsletter.tf/windows-ghostloc

  3. 🔐 Just shipped a fix for the April 2026 Windows update (KB5083769) that flags unsigned RDP files as "Unknown Publisher".
    If you manage RDP shortcuts via Intune and your users are suddenly seeing red security warnings — here's a complete solution:
    ✅ Self-signed code signing cert (no PKI required)
    ✅ rdpsign.exe signing workflow
    ✅ Intune Win32 package (install + uninstall scripts)
    ✅ Trusted Certificate profile + Settings Catalog policies
    ✅ Versioned detection rule for clean updates
    ✅ Supersedence pattern for migrating from unsigned deployments
    Tested in production on a real M365 Business Premium environment.
    🔗 github.com/Bluewal/m365-intune-scripts/tree/main/intune/rdp-signing
    #Intune #Microsoft365 #RDP #BlueTeam #WindowsSecurity #MicrosoftDefender

  4. 🔐 Just shipped a fix for the April 2026 Windows update (KB5083769) that flags unsigned RDP files as "Unknown Publisher".
    If you manage RDP shortcuts via Intune and your users are suddenly seeing red security warnings — here's a complete solution:
    ✅ Self-signed code signing cert (no PKI required)
    ✅ rdpsign.exe signing workflow
    ✅ Intune Win32 package (install + uninstall scripts)
    ✅ Trusted Certificate profile + Settings Catalog policies
    ✅ Versioned detection rule for clean updates
    ✅ Supersedence pattern for migrating from unsigned deployments
    Tested in production on a real M365 Business Premium environment.
    🔗 github.com/Bluewal/m365-intune-scripts/tree/main/intune/rdp-signing
    #Intune #Microsoft365 #RDP #BlueTeam #WindowsSecurity #MicrosoftDefender

  5. 🔐 Just shipped a fix for the April 2026 Windows update (KB5083769) that flags unsigned RDP files as "Unknown Publisher".
    If you manage RDP shortcuts via Intune and your users are suddenly seeing red security warnings — here's a complete solution:
    ✅ Self-signed code signing cert (no PKI required)
    ✅ rdpsign.exe signing workflow
    ✅ Intune Win32 package (install + uninstall scripts)
    ✅ Trusted Certificate profile + Settings Catalog policies
    ✅ Versioned detection rule for clean updates
    ✅ Supersedence pattern for migrating from unsigned deployments
    Tested in production on a real M365 Business Premium environment.
    🔗 github.com/Bluewal/m365-intune-scripts/tree/main/intune/rdp-signing
    #Intune #Microsoft365 #RDP #BlueTeam #WindowsSecurity #MicrosoftDefender

  6. 🔐 Just shipped a fix for the April 2026 Windows update (KB5083769) that flags unsigned RDP files as "Unknown Publisher".
    If you manage RDP shortcuts via Intune and your users are suddenly seeing red security warnings — here's a complete solution:
    ✅ Self-signed code signing cert (no PKI required)
    ✅ rdpsign.exe signing workflow
    ✅ Intune Win32 package (install + uninstall scripts)
    ✅ Trusted Certificate profile + Settings Catalog policies
    ✅ Versioned detection rule for clean updates
    ✅ Supersedence pattern for migrating from unsigned deployments
    Tested in production on a real M365 Business Premium environment.
    🔗 github.com/Bluewal/m365-intune-scripts/tree/main/intune/rdp-signing
    #Intune #Microsoft365 #RDP #BlueTeam #WindowsSecurity #MicrosoftDefender

  7. 🔐 Just shipped a fix for the April 2026 Windows update (KB5083769) that flags unsigned RDP files as "Unknown Publisher".
    If you manage RDP shortcuts via Intune and your users are suddenly seeing red security warnings — here's a complete solution:
    ✅ Self-signed code signing cert (no PKI required)
    ✅ rdpsign.exe signing workflow
    ✅ Intune Win32 package (install + uninstall scripts)
    ✅ Trusted Certificate profile + Settings Catalog policies
    ✅ Versioned detection rule for clean updates
    ✅ Supersedence pattern for migrating from unsigned deployments
    Tested in production on a real M365 Business Premium environment.
    🔗 github.com/Bluewal/m365-intune-scripts/tree/main/intune/rdp-signing
    #Intune #Microsoft365 #RDP #BlueTeam #WindowsSecurity #MicrosoftDefender

  8. What is DCSync Attack and Mimikatz Usage in Active Directory

    One of the most critical attacks in Active Directory environments, DCSync, allows attackers to impersonate a Domain Controller and extract password hashes through replication abuse.

    #CyberSecurity #ActiveDirectory #DCSync #RedTeam #BlueTeam #InfoSec #Pentesting #SOC #ThreatDetection #WindowsSecurity #EthicalHacking #ITSecurity #NetworkSecurity #SecurityOperations #DenizHalil

    denizhalil.com/2026/03/27/dcsy

  9. What is DCSync Attack and Mimikatz Usage in Active Directory

    One of the most critical attacks in Active Directory environments, DCSync, allows attackers to impersonate a Domain Controller and extract password hashes through replication abuse.

    #CyberSecurity #ActiveDirectory #DCSync #RedTeam #BlueTeam #InfoSec #Pentesting #SOC #ThreatDetection #WindowsSecurity #EthicalHacking #ITSecurity #NetworkSecurity #SecurityOperations #DenizHalil

    denizhalil.com/2026/03/27/dcsy

  10. 🚨 CRITICAL: CVE-2026-4606 in GeoVision GV-Edge Recording Manager 2.3.1 allows any local user to escalate to SYSTEM privileges (CVSS 10.0). Patch or restrict local access now! radar.offseq.com/threat/cve-20 #OffSeq #Vulnerability #WindowsSecurity #GeoVision

  11. 🚨 CRITICAL: CVE-2026-4606 in GeoVision GV-Edge Recording Manager 2.3.1 allows any local user to escalate to SYSTEM privileges (CVSS 10.0). Patch or restrict local access now! radar.offseq.com/threat/cve-20 #OffSeq #Vulnerability #WindowsSecurity #GeoVision

  12. 🚨 CRITICAL: CVE-2026-4606 in GeoVision GV-Edge Recording Manager 2.3.1 allows any local user to escalate to SYSTEM privileges (CVSS 10.0). Patch or restrict local access now! radar.offseq.com/threat/cve-20 #OffSeq #Vulnerability #WindowsSecurity #GeoVision

  13. 🚨 CRITICAL: CVE-2026-4606 in GeoVision GV-Edge Recording Manager 2.3.1 allows any local user to escalate to SYSTEM privileges (CVSS 10.0). Patch or restrict local access now! radar.offseq.com/threat/cve-20 #OffSeq #Vulnerability #WindowsSecurity #GeoVision

  14. A case study: detecting and removing a coinminer that persists via svchost DcomLaunch by adding a u###### service and a PowerShell script to automate cleanup hackernoon.com/how-i-removed-a #windowssecurity