Ensure 'Replace a process level token' is set to 'LOCAL SERVICE, NETWORK SERVICE'

AltaNivel 1Automatizadawindows

Descripción

This policy setting allows one process or service to start another service or process with a different security access token, which can be used to modify the security access token of that sub-process and result in the escalation of privileges. The recommended state for this setting is: LOCAL SERVICE, NETWORK SERVICE. Note: This user right is considered a "sensitive privilege" for the purposes of auditing.

Cómo se verifica

Método de auditoría: Comando de shell

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeAssignPrimaryTokenPrivilege\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); if ((($have | Sort-Object -Unique) -join ',') -eq 'S-1-5-19,S-1-5-20') { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Replace a process level token

Propiedades

Sistemas operativos: windows-10
Etiquetas: cis-convertedseceditwindows
Referencia: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 2.2.36

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target windows