Full Report
Series of blog posts that share the breadth and depth of Huntress’ experience to assist others in reducing their attack surface, and inhibiting or even obviating cyber attacks.
Analysis Summary
# Best Practices: Addressing Initial Access Vectors
## Overview
These practices address the most common methods threat actors use to gain a foothold in an environment (Initial Access). Specifically, they focus on neutralizing "weaponized" file formats—such as Microsoft OneNote files, disk images (ISO/VHD), and Office Macros—which are frequently used in phishing campaigns to bypass standard security filters.
## Key Recommendations
### Immediate Actions
1. **Block Office Macros from the Internet:** Implement the registry/GPO change to block macros in files downloaded from the web (Mark of the Web).
2. **Disable OneNote Attachment Execution:** Apply registry modifications to prevent users from clicking on or launching embedded files within OneNote.
3. **Disable Auto-Mounting of Disk Images:** Modify the default handler for `.iso`, `.img`, `.vhd`, and `.vhdx` files to prevent malware execution via simple double-clicking.
### Short-term Improvements (1-3 months)
1. **Application Audit:** Identify departments using OneNote and Office Macros. If no business use exists for a specific group, uninstall the applications or disable the features entirely via GPO.
2. **Standardize PowerShell Deployment:** Create a central repository of the provided Huntress PowerShell scripts to ensure consistent application across all new builds.
### Long-term Strategy (3+ months)
1. **Attack Surface Reduction (ASR):** Transition from manual registry edits to formal ASR rules within Microsoft Defender for Endpoint.
2. **Move to Web-Based Productivity:** Encourage the use of web-based Office (Word/Excel Online) where macros are naturally sandboxed and disk images cannot be mounted to the local OS.
## Implementation Guidance
### For Small Organizations
- Use the provided PowerShell one-liners manually or via an RMM (Remote Monitoring and Management) tool to harden endpoints quickly without needing a Domain Controller.
### For Medium Organizations
- Implement these settings via **Group Policy Objects (GPOs)**. This ensures that any new machine joined to the domain automatically inherits these security configurations.
### For Large Enterprises
- Utilize **Microsoft Endpoint Manager (Intune)** to deploy these configurations as "Configuration Profiles." Use "Security Baselines" to ensure these settings do not drift over time.
## Configuration Examples
### Prevent Disk Image Auto-Mounting (PowerShell)
powershell
# Set the default action for ISO/VHD files to 'Burn' rather than 'Mount'
$extension = @(".iso", ".img", ".vhd", ".vhdx")
foreach ($ext in $extension) {
Set-ItemProperty -Path "HKLM:\SOFTWARE\Classes\$ext" -Name "PerceivedType" -Value "system"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Classes\$ext" -Name "NoOpen" -Value ""
}
### Disable OneNote Embedded Files (PowerShell)
powershell
# Blocks the ability to open embedded attachments in OneNote
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\OneNote\Options\General" -Name "DisableEmbeddedFiles" -PropertyType DWord -Value 1
## Compliance Alignment
- **NIST CSF:** PR.PT-3 (Identity Management and Access Control) and PR.IP-1 (Baseline Configuration).
- **CIS Controls:** Control 9 (Email and Web Browser Protections) and Control 4 (Secure Configuration of Enterprise Assets).
- **MITRE ATT&CK:** Mitigates **TA0001** (Initial Access) and specific techniques like **T1566** (Phishing).
## Common Pitfalls to Avoid
- **Inconsistent Extension Coverage:** Only blocking `.iso` but forgetting `.vhd` or `.vhdx` files, which attackers use as functional alternatives.
- **Helpdesk Blind Spots:** Not informing the helpdesk before implementation; these changes will trigger error messages for users, which can lead to a surge in support tickets if not communicated.
- **Macro Dependency:** Blocking all macros without identifying "Mission Critical" Excel sheets used by finance or HR, potentially breaking business workflows.
## Resources
- **MITRE ATT&CK Framework:** [https://attack.mitre.org/tactics/TA0001/](https://attack.mitre.org/tactics/TA0001/)
- **Microsoft Security Documentation:** Search for "Block macros from running in Office files from the Internet."
- **Huntress Blog:** [https://www.huntress.com/blog](https://www.huntress.com/blog)