CaptiveCrunch · ChocoShell · DFIR-2026-001

What would actually have stopped this, and what the defaults already did

Midnight Blizzard's CaptiveCrunch campaign compromises captive portals at hotels and airports, redirects travellers to a ClickFix lure, and delivers ChocoShell — a PowerShell stealer that takes browser cookies, saved passwords, Microsoft 365 SSO tokens and Wi-Fi keys. This maps its real capability chain onto specific Windows, Edge and Chrome settings: 50 controls, 37 of them Group Policy. Every registry path and every quoted default below is joined from the Windows, Edge and Chrome reference data at build time, not written by hand.

Every control also carries what it costs, on two separate axes: how hard it is to deploy, and how much the user notices. They are not the same thing. 39 are broadly deployable, 7 need a project first, and 4 belong only on restricted builds — while 39 of the 50 are invisible or near-invisible to users and only 4 genuinely change how people work.

50controls
9default protects
25default enables
18in the MS baseline
19beyond the baseline
39invisible to users

Sources: static analysis of SHA256 be99857449d2856d… (sample not executed), and Microsoft Security Blog, 31 July 2026.

What the defaults already bought you

The clearest evidence that a default works is an attacker spending code to defeat it. This sample does that five times over, and the developer's own comments name the controls:

App-Bound Encryption forces SYSTEM token impersonation and NCrypt to reach the browser master key. Chromium v120+ cookie-file locking forces a VSS shadow copy. Browser auto-de-elevation forces the browser to be launched through Task Scheduler COM instead of directly. AMSI forces a reflection bypass that dodges the known [Ref].Assembly signature. Defender behaviour monitoring forces every network call through a WinHttp COM object, because Behavior:Win32/ClickFix.SZZ only fires when a PowerShell web cmdlet and ScriptBlock::Create appear in the same process.

Three of those five push the attacker into needing administrator rights. That is the whole argument for the control below.

Local admin: what dies, what survives

Users here hold local administrator rights by default. ChocoShell branches on exactly that check — IsAdmin and membership of S-1-5-32-544 — so it is the single variable that decides how much of the chain runs. Microsoft's write-up confirms the fallback: with no local admin the silent bypasses fail and it resorts to a visible RunAs prompt.

Dies without local admin

Requires elevation, so the capability is simply unavailable

  • Silent UAC bypass — all three paths (SilentCleanup, wsreset COM, sdclt /KickOffElev) need a split admin token
  • SYSTEM token impersonation — and with it Chrome/Edge App-Bound Encryption master key decryption
  • VSS shadow copy — the fallback for reading locked cookie databases
  • Elevated re-run stub — the second-stage escalated payload

Survives regardless

Runs entirely in user context — removing admin does not touch it

  • CDP cookie theft — --remote-debugging-port reads cookies already decrypted in memory, bypassing ABE completely
  • Firefox family cookies — cookies.sqlite is unencrypted, including Waterfox, LibreWolf, Floorp and Zen
  • Microsoft 365 SSO tokens — .tbres files in the user's own TokenBroker cache
  • Wi-Fi credentials — user-scope profiles need no elevation

So removing local admin is necessary and not sufficient. It halves the chain; it does not stop credential theft. The controls that answer the surviving half are RemoteDebuggingAllowed and token protection.

Checked against Microsoft’s own baseline

Of the 50 controls here, 18 are also set by the Microsoft Security Baselines for Windows 11 25H2 and Edge v139, and 19 go beyond them. Each control below shows which, with the exact value the baseline sets.

The clearest confirmation is the control this page is built around: the baseline sets ConsentPromptBehaviorAdmin = 2, which is precisely “prompt for consent on the secure desktop” — the setting that breaks all three UAC bypasses at once. It also sets EnableLUA = 1, FilterAdministratorToken = 1, ApplicationBoundEncryptionEnabled = 1 and every SmartScreen control recommended here.

The most important gap runs the other way. The Edge v139 baseline does not set RemoteDebuggingAllowed — its 20 settings do not include it. The single highest-value change on this page is therefore not something Microsoft’s baseline will do for you, and neither are the two password-reuse controls that implement Microsoft’s own written advice for this campaign.

One reading trap worth knowing: the baseline enables Defender features by setting an inverted value — DisableBehaviorMonitoring = 0 means behaviour monitoring is on. Comparing raw numbers across such a pair reads as disagreement when it is agreement, so the effect is spelled out rather than left as a bare number.

Keeping Wi-Fi, captive portals and the browser usable

None of the recommended wireless controls stop a traveller getting online, and that is a design constraint here rather than a happy accident. Checking each against its own documentation:

Captive portals keep working

Quoted from the policy definitions themselves

  • Hotspot authentication off — the ADMX states users then authenticate to WLAN hotspots using a web browser. That is the normal hotel and airport flow; what goes away is automated WISPr credential submission and silent reconnect on commercial roaming hotspots. It does not touch WPA2-PSK, WPA3 or 802.1X: WISPr runs at the application layer after association, so it cannot affect link-layer Wi-Fi security. Nothing in the 4,741 Windows policies configures PSK at all — that lives in Wireless Network (802.11) Policies or an Intune profile.
  • Minimize simultaneous connections (1) — blocks new automatic connections only. The ADMX is explicit that users can still manually connect to any network.
  • Prohibit non-domain when domain-connected — automatic attempts are blocked, but a manual Wi-Fi connection is still allowed and simply drops the existing one. A traveller can always get online.
  • No auto-connect to open hotspots — removes drive-by association only. Manual connection is untouched.

Worth testing before you ship

Interactions that are easy to miss

  • Always-on VPN plus non-domain blocking — if the tunnel presents as a domain-authenticated network, reconnecting Wi-Fi mid-session can behave unexpectedly. Test the sequence a traveller actually performs.
  • The portal sign-in happens before the tunnel — there is always a window on the untrusted network. That is why the browser controls and ASR matter rather than relying on VPN alone.
  • Remote debugging off — invisible to everyone except web developers. Exempt that group by OU rather than leaving it enabled estate-wide.
  • Sign-in risk policies — travellers legitimately look like impossible travel. Tune before enforcing, or you will lock out the people you are protecting.

Considered and rejected

Recorded so they do not get proposed again. Both look attractive against ClickFix and neither survives contact with the documentation.

hack the planet

Getting on the wire

5 controls · 4 where the default works in the attacker's favour

Initial access — T1557 Adversary-in-the-Middle

Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services set to Disabled
Windows ADMX Default enables this Holds against a local admin Broadly deployable No user-visible change General hardening, not evidenced here Microsoft baseline sets this
Left unset the user chooses, and auto-connect to open hotspots is exactly how a traveller lands on an attacker-controlled network without deciding to. Note this is one of the 33 tattooed settings: it writes outside a Policies branch, so Group Policy cannot cleanly revert it.
Counters
Automatic association with a hostile open network
Cost of deploying
Negligible. Users connect to hotspots deliberately instead of automatically.
Registry
HKLM\Software\Microsoft\wcmsvc\wifinetworkmanager\config!AutoConnectAllowedOEM
Where
Network\WLAN Service\WLAN Settings
Scope
Machine
MITRE
T1557 Adversary-in-the-Middle
Microsoft Security Baseline setsAutoConnectAllowedOEM = 0
Microsoft's wording for the unset stateIf this policy setting is not configured or is enabled, users can choose to enable or disable either "Connect to suggested open hotspots" or "Connect to networks shared by my contacts".
Prohibit connection to non-domain networks when connected to domain authenticated network set to Enabled
Windows ADMX Default enables this Holds against a local admin Broadly deployable Barely noticeable General hardening, not evidenced here Microsoft baseline sets this
Stops the machine bridging a hotel network and the corporate network at the same time. Automatic connections are blocked; a manual connection over Wi-Fi is still allowed and simply drops the existing one, so a traveller can always get online.
Counters
Simultaneous hostile-network and corporate-network attachment
Cost of deploying
Manual connection still works but disconnects the current network first. Test against always-on VPN, where the tunnel may present as a domain-authenticated network.
Registry
HKLM\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy!fBlockNonDomain
Where
Network\Windows Connection Manager
Scope
Machine
MITRE
T1557 Adversary-in-the-Middle
Microsoft Security Baseline setsfBlockNonDomain = 1
Microsoft's wording for the unset stateIf this policy setting is not configured or is disabled, computers are allowed to connect simultaneously to both domain and non-domain networks.
Minimize the number of simultaneous connections to the Internet or a Windows Domain set to 1
Windows ADMX Default not stated Holds against a local admin Broadly deployable Barely noticeable General hardening, not evidenced here Beyond the Microsoft baseline
Value 1 blocks new automatic internet connections when the machine already has one over a preferred medium, narrowing the window in which a hostile Wi-Fi network sits alongside a trusted one. The ADMX is explicit that users can still manually connect to any network, so it does not strand a traveller.
Counters
Simultaneous hostile-network attachment
Cost of deploying
Blocks automatic secondary connections only. Manual connection to any network still works.
Registry
HKLM\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy!fMinimizeConnections
Where
Network\Windows Connection Manager
Scope
Machine
MITRE
T1557 Adversary-in-the-Middle
Restrict Wi-Fi to MDM-provisioned networks set to High-assurance builds only
Not Group Policy Default enables this Holds against a local admin High-assurance builds only Changes how people work
Microsoft frames this as something organisations can choose to do, not as general guidance, and the qualification matters. A device that will only associate with provisioned SSIDs cannot join a hotel, airport or conference network at all — which is precisely the situation this campaign targets, so the control removes the use case rather than protecting it. Sound for restricted builds that never need public Wi-Fi. For everyone else the cellular-first and always-on-VPN approach below addresses the same risk without grounding the traveller.
Counters
Entire captive-portal initial access vector
Cost of deploying
Grounds the traveller. A device that will only join provisioned SSIDs cannot use a hotel, airport or conference network at all.
Where
Intune Wi-Fi profile / WLAN policy
MITRE
T1557 Adversary-in-the-Middle
Always-on VPN or corporate travel router set to Deploy - preferred control for travelling users
Not Group Policy Default enables this Holds against a local admin Broadly deployable Barely noticeable
The workable answer for a general corporate estate, and the one Microsoft leads with: prefer private connectivity — mobile hotspot, eSIM or satellite — over public Wi-Fi, and where public Wi-Fi is unavoidable bring up an encrypted tunnel to trusted infrastructure before touching anything sensitive. That defeats the DNS and HTTP manipulation the compromised portal relies on while leaving the user able to work. Note the captive-portal sign-in itself happens before the tunnel comes up, so pair it with the auto-connect and hotspot-probe controls above.
Counters
DNS/HTTP redirection to the lure infrastructure
Cost of deploying
Needs capacity planning and a captive-portal sign-in window before the tunnel comes up.
Where
Intune VPN profile / hardware travel router
MITRE
T1557 Adversary-in-the-Middle

The lure and the paste

9 controls · 5 where the default works in the attacker's favour

Initial access — T1204.002 User Execution

SmartScreenEnabled set to Enabled
Edge policy Default protects Weakened by local admin Broadly deployable No user-visible change Microsoft baseline sets this
SmartScreen is on by default, but unset it is a user preference. Setting it by policy removes the toggle so the lure page cannot be reached by a user who has previously turned it off.
Counters
Reputation check on the fake update/verification landing page
Cost of deploying
Removes the user's ability to turn SmartScreen off.
Registry
Software\Policies\Microsoft\Edge!SmartScreenEnabled
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1204.002 User Execution
Microsoft Security Baseline setsSmartScreenEnabled = 1
Microsoft's wording for the unset stateIf you don't configure this setting, users can choose whether to use Microsoft Defender SmartScreen.
Stated defaultBy default, Microsoft Defender SmartScreen is turned on.
PreventSmartScreenPromptOverride set to Enabled
Edge policy Default enables this Weakened by local admin Broadly deployable Barely noticeable Microsoft baseline sets this
Unset, the user can click straight through a SmartScreen warning to the lure. Under pressure from a fake driver-repair prompt that is exactly what they do.
Counters
User click-through on the ClickFix landing page
Cost of deploying
Users can no longer click through a warning; expect occasional false-positive escalations.
Registry
Software\Policies\Microsoft\Edge!PreventSmartScreenPromptOverride
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1204.002 User Execution
Microsoft Security Baseline setsPreventSmartScreenPromptOverride = 1 (SmartScreenPromptOverride off)
Microsoft's wording for the unset stateIf you disable or don't configure this setting, users can ignore Microsoft Defender SmartScreen warnings and continue to the site.
PreventSmartScreenPromptOverrideForFiles set to Enabled
Edge policy Default enables this Weakened by local admin Broadly deployable Barely noticeable Microsoft baseline sets this
Unset, the user can complete a download SmartScreen flagged as unverified. The campaign delivers fake utilities and updaters this way.
Counters
Download of the fake updater/driver utility
Cost of deploying
Blocks completion of downloads SmartScreen flags. Have an exception route.
Registry
Software\Policies\Microsoft\Edge!PreventSmartScreenPromptOverrideForFiles
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1204.002 User Execution
Microsoft Security Baseline setsPreventSmartScreenPromptOverrideForFiles = 1 (SmartScreenPromptOverrideForFiles off)
Microsoft's wording for the unset stateIf you disable or don't configure this policy, users can ignore Microsoft Defender SmartScreen warnings and complete unverified downloads.
SmartScreenPuaEnabled set to Enabled
Edge policy Default is neutral Weakened by local admin Broadly deployable Barely noticeable Microsoft baseline sets this
Potentially unwanted app blocking is off by default, so this layer is simply absent until you turn it on. Catches the fake system utility class of payload.
Counters
Fake system utility and updater downloads
Cost of deploying
Occasional false positives on grey-area utilities.
Registry
Software\Policies\Microsoft\Edge!SmartScreenPuaEnabled
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1204.002 User Execution
Microsoft Security Baseline setsSmartScreenPuaEnabled = 1
Microsoft's wording for the unset stateIf you don't configure this setting, users can choose whether to use potentially unwanted app blocking with Microsoft Defender SmartScreen.
Stated defaultPotentially unwanted app blocking with Microsoft Defender SmartScreen is turned off by default.
DownloadRestrictions set to 1 (2 for stricter builds)
Edge policy Default is neutral Weakened by local admin Broadly deployable Barely noticeable Beyond the Microsoft baseline
Blocks dangerous and unwanted downloads outright rather than warning. The ADMX does not state a default, so no default claim is made.
Counters
Delivery of the executable payload variants
Cost of deploying
Level 1 blocks malicious and dangerous file types. Level 2 also blocks unwanted downloads and is noticeably stricter.
Registry
Software\Policies\Microsoft\Edge!DownloadRestrictions
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1204.002 User Execution
Microsoft's wording for the unset stateIf you don't configure this policy or set the 'DefaultDownloadSecurity' option, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.
Configure Windows Defender SmartScreen set to Enabled - Warn and prevent bypass
Windows ADMX Default enables this Weakened by local admin Broadly deployable Barely noticeable Microsoft baseline sets this
The shell-level check catches the downloaded binary after the browser hands it off. Unset the user is prompted and may choose to run anyway.
Counters
Execution of the downloaded Golang RAT variants
Cost of deploying
Users cannot override the shell warning; needs an exception route.
Registry
HKLM\Software\Policies\Microsoft\Windows\System!EnableSmartScreen
Where
Windows Components\Windows Defender SmartScreen\Explorer
Scope
Machine
MITRE
T1204.002 User Execution
Microsoft Security Baseline setsEnableSmartScreen = 1
Microsoft's wording for the unset stateIf you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings.
Prevent bypassing Windows Defender SmartScreen prompts for files set to Enabled
Windows ADMX Default enables this Weakened by local admin Broadly deployable Barely noticeable Beyond the Microsoft baseline
Removes the user's ability to override the shell warning on a downloaded file.
Counters
Execution of the downloaded payload
Cost of deploying
As above.
Registry
HKLM\Software\Policies\Microsoft\MicrosoftEdge\PhishingFilter!PreventOverrideAppRepUnknown
Where
Windows Components\Microsoft Edge
Scope
Machine
MITRE
T1204.002 User Execution
Microsoft's wording for the unset stateIf you disable or don't configure this setting, employees can ignore Windows Defender SmartScreen warnings and continue the download process.
Remove Run menu from Start Menu set to Enabled
Windows ADMX Default enables this Weakened by local admin High-assurance builds only Changes how people work General hardening, not evidenced here Beyond the Microsoft baseline
Closes the Win+R paste target used by many ClickFix lures. Weigh it carefully for this campaign specifically: Microsoft's write-up describes lures instructing users to run the verification script via Windows Terminal, which this does not touch. Meaningful against other ClickFix variants, not against the one documented here.
Counters
The paste-and-run step of the ClickFix lure
Cost of deploying
Removes Win+R for everyone, which is significant friction for technical staff, and leaves Windows Terminal and PowerShell reachable anyway.
Registry
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRun
Where
Start Menu and Taskbar
Scope
Machine
MITRE
T1059.001 PowerShell
Microsoft's wording for the unset stateIf you disable or do not configure this setting, users will be able to access the Run command in the Start menu and in Task Manager and use the Internet Explorer Address Bar.
User awareness of paste-and-run lures set to Train
Not Group Policy Default is neutral Holds against a local admin Broadly deployable No user-visible change
Microsoft's guidance names this directly: teach users to treat fake verification prompts that invoke cmd.exe, PowerShell, rundll32.exe or mshta.exe as malicious. The chain requires a human to act; this is the only control at that layer.
Counters
The social engineering step itself
Cost of deploying
Ongoing programme rather than a one-off.
Where
Security awareness programme
MITRE
T1204.002 User Execution

Script execution and visibility

8 controls · 1 where the default works in the attacker's favour

Defense evasion — T1562.001 Impair Defenses

AMSI script scanning set to Built in
Not Group Policy Default protects Weakened by local admin Broadly deployable No user-visible change
AMSI is on by default and there is no policy needed to enable it. The proof it matters is that the sample spends dedicated code on defeating it, setting amsiInitFailed via reflection on [PSObject].Assembly to dodge the known [Ref].Assembly signature.
Counters
ScriptBlock scanning of the downloaded Stage 3 module
Cost of deploying
On by default; nothing to deploy.
Where
Built into Windows
MITRE
T1562.001 Impair Defenses
Turn on script scanning set to Enabled
Windows ADMX Default protects Weakened by local admin Broadly deployable No user-visible change General hardening, not evidenced here Microsoft baseline sets this
Keeps Defender scanning scripts. The ADMX does not state the unset behaviour so no default claim is made.
Counters
Stage 3 tool module loaded via ScriptBlock::Create
Cost of deploying
On by default; confirm it has not been turned off.
Registry
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection!DisableScriptScanning
Where
Windows Components\Microsoft Defender Antivirus\Real-time Protection
Scope
Machine
MITRE
T1562.001 Impair Defenses
Microsoft Security Baseline setsDisableScriptScanning = 0 (ScriptScanning on)
Microsoft's wording for the unset stateIf you enable or do not configure this setting, script scanning will be enabled.
Turn on behavior monitoring set to Enabled
Windows ADMX Default protects Weakened by local admin Broadly deployable No user-visible change Microsoft baseline sets this
Behaviour monitoring is what raises Behavior:Win32/ClickFix.SZZ. The sample's author engineered around that specific signature by routing all network calls through the WinHttp COM object instead of PowerShell web cmdlets, because the signature requires a PS web cmdlet and ScriptBlock::Create in the same process.
Counters
The ClickFix behavioural detection the actor evades
Cost of deploying
On by default; confirm it has not been turned off.
Registry
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection!DisableBehaviorMonitoring
Where
Windows Components\Microsoft Defender Antivirus\Real-time Protection
Scope
Machine
MITRE
T1562.001 Impair Defenses
Microsoft Security Baseline setsDisableBehaviorMonitoring = 0 (BehaviorMonitoring on)
Microsoft's wording for the unset stateIf you enable or do not configure this setting, behavior monitoring will be enabled.
Turn on PowerShell Script Block Logging set to Enabled
Windows ADMX Default not stated Holds against a local admin Broadly deployable No user-visible change General hardening, not evidenced here Microsoft baseline sets this
The AMSI bypass silences scanning but not ETW script block logging, so 4104 events still capture the deobfuscated Stage 3 module. This is the highest-value forensic control for this chain and it is off unless you turn it on.
Counters
Post-incident reconstruction of what Stage 3 did
Cost of deploying
Event volume. Size the log and forward it off-host.
Registry
HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging!EnableScriptBlockLogging
Where
Windows Components\Windows PowerShell
Scope
Machine
MITRE
T1059.001 PowerShell
Microsoft Security Baseline setsEnableScriptBlockLogging = 1
Turn on PowerShell Transcription set to Enabled
Windows ADMX Default not stated Holds against a local admin Broadly deployable No user-visible change General hardening, not evidenced here Beyond the Microsoft baseline
Captures the session transcript including the pasted lure command. Send transcripts off-host: the sample deletes %TEMP%\upd.ps1 and zeroes memory during cleanup.
Counters
Anti-forensic cleanup of on-host artefacts
Cost of deploying
Produces a lot of files. Set an output path off the local disk.
Registry
HKLM\Software\Policies\Microsoft\Windows\PowerShell\Transcription!EnableTranscripting
Where
Windows Components\Windows PowerShell
Scope
Machine
MITRE
T1059.001 PowerShell
Stated defaultBy default, Windows PowerShell will record transcript output to each users' My Documents directory, with a file name that includes 'PowerShell_transcript', along with the computer name and time started. If you disable this policy setting, transcripting of PowerShell-based applications is disabled by default, although transcripting can still be enabled through the Start-Transcript cmdlet.
Turn on Module Logging set to Enabled
Windows ADMX Default is neutral Holds against a local admin Broadly deployable No user-visible change General hardening, not evidenced here Beyond the Microsoft baseline
Records pipeline execution detail for the modules the Stage 3 tool module brings in.
Counters
Invoke-PowerChrome / DecryptWithNCrypt / Invoke-Impersonate-System
Cost of deploying
Noisiest of the three. Enable selectively if volume is a problem.
Registry
HKLM\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging!EnableModuleLogging
Where
Windows Components\Windows PowerShell
Scope
Machine
MITRE
T1059.001 PowerShell
Microsoft's wording for the unset stateIf this policy setting is not configured, the LogPipelineExecutionDetails property of a module or snap-in determines whether the execution events of a module or snap-in are logged.
Stated defaultBy default, the LogPipelineExecutionDetails property of all modules and snap-ins is set to False.
WDAC or AppLocker enforcing Constrained Language Mode set to Enforce
Not Group Policy Default enables this Holds against a local admin Needs a project first Users will notice
CLM blocks the .NET reflection the AMSI bypass depends on and blocks ScriptBlock::Create on downloaded content. This breaks the chain at Stage 2 entry rather than mitigating it later, and it is the single most effective non-default control in this theme.
Counters
AMSI bypass and Stage 3 module load together
Cost of deploying
Significant app-compat work. Audit mode first, and expect to maintain exceptions. Highest value in this theme once done.
Where
WDAC policy / AppLocker
MITRE
T1562.001 Impair Defenses
Configure Attack Surface Reduction rules set to Enabled - Block
Windows ADMX Default is neutral Holds against a local admin Broadly deployable Barely noticeable General hardening, not evidenced here Microsoft baseline sets this
ASR rules are not applied until configured. Relevant rules here: block executable content from email and webmail, block JavaScript/VBScript from launching downloaded executable content, and block process creations from PSExec and WMI commands.
Counters
Payload execution and script-launched executables
Cost of deploying
Run in audit mode first; some rules have known false positives.
Registry
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR!ExploitGuard_ASR_Rules
Where
Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction
Scope
Machine
MITRE
T1059.001 PowerShell
Microsoft Security Baseline setsExploitGuard_ASR_Rules = 1
Microsoft's wording for the unset stateAfter enabling this setting, you can set each rule to the following in the Options section: - Block: the rule will be applied - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) - Off: the rule will not be applied - Not Configured: the rule is enabled with default values - Warn: the rule will be applied and the end-user will have the option to bypass the block Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. Enter each rule on a new line as a name-value pair: - Name column: Enter a valid ASR rule ID - Value column: Enter the status ID that relates to state you want to specify for the associated rule The following status IDs are permitted under the value column: - 1 (Block) - 0 (Off) - 2 (Audit) - 5 (Not Configured) - 6 (Warn) Example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 0 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 1 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 2 Disabled: No ASR rules will be configured.

Elevation - the branch point

8 controls · 3 where the default works in the attacker's favour

Privilege escalation — T1548.002 Bypass UAC

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode set to Prompt for consent on the secure desktop
Security Option Default enables this Holds against a local admin Broadly deployable Users will notice Microsoft baseline sets this
This is the control that breaks all three UAC bypasses at once. The default auto-elevates signed Windows binaries without prompting, which is precisely what SilentCleanup, wsreset.exe and sdclt.exe /KickOffElev abuse. Requiring a prompt turns three silent escalations into three visible ones.
Counters
SilentCleanup task hijack / wsreset COM hijack / sdclt KickOffElev
Cost of deploying
More prompts for admin users, which on an estate where everyone is an admin is a visible change. That visibility is the point.
Registry
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
Where
Computer Configuration\Windows Settings\Local Policies\Security Options
Scope
Machine
MITRE
T1548.002 Bypass UAC
Microsoft Security Baseline setsConsentPromptBehaviorAdmin = 2
NoteThe Security Options worksheet documents no unset behaviour, so no default is quoted. The verdict here comes from the incident evidence.
User Account Control: Run all administrators in Admin Approval Mode set to Enabled
Security Option Default protects Holds against a local admin Broadly deployable No user-visible change Microsoft baseline sets this
On by default. If this is disabled, every admin process runs fully elevated and the bypass chain is not even needed. Verify it has not been turned off.
Counters
The split-token model the whole UAC branch depends on
Cost of deploying
On by default; verify only.
Registry
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
Where
Computer Configuration\Windows Settings\Local Policies\Security Options
Scope
Machine
MITRE
T1548.002 Bypass UAC
Microsoft Security Baseline setsEnableLUA = 1
NoteThe Security Options worksheet documents no unset behaviour, so no default is quoted. The verdict here comes from the incident evidence.
User Account Control: Switch to the secure desktop when prompting for elevation set to Enabled
Security Option Default protects Holds against a local admin Broadly deployable No user-visible change General hardening, not evidenced here Beyond the Microsoft baseline
On by default. Prevents the elevation prompt being spoofed or automated by the calling process.
Counters
Automated consent to the fallback RunAs prompt
Cost of deploying
On by default; verify only.
Registry
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop
Where
Computer Configuration\Windows Settings\Local Policies\Security Options
Scope
Machine
MITRE
T1548.002 Bypass UAC
NoteThe Security Options worksheet documents no unset behaviour, so no default is quoted. The verdict here comes from the incident evidence.
User Account Control: Admin Approval Mode for the Built-in Administrator account set to Enabled
Security Option Default is neutral Holds against a local admin Broadly deployable No user-visible change General hardening, not evidenced here Microsoft baseline sets this
Ensures the built-in Administrator is also subject to Admin Approval Mode rather than running unrestricted.
Counters
Escalation via the built-in Administrator account
Cost of deploying
Affects the built-in account only.
Registry
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken
Where
Computer Configuration\Windows Settings\Local Policies\Security Options
Scope
Machine
MITRE
T1548.002 Bypass UAC
Microsoft Security Baseline setsFilterAdministratorToken = 1
NoteThe Security Options worksheet documents no unset behaviour, so no default is quoted. The verdict here comes from the incident evidence.
User Account Control: Only elevate executables that are signed and validated set to Enabled
Security Option Default is neutral Weakened by local admin Needs a project first Users will notice General hardening, not evidenced here Beyond the Microsoft baseline
Restricts elevation to signed binaries. Note the bypasses here abuse legitimately signed Microsoft binaries, so this narrows the surface without closing this particular path.
Counters
Elevation of unsigned attacker binaries
Cost of deploying
Breaks unsigned line-of-business installers. Inventory first.
Registry
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures
Where
Computer Configuration\Windows Settings\Local Policies\Security Options
Scope
Machine
MITRE
T1548.002 Bypass UAC
NoteThe Security Options worksheet documents no unset behaviour, so no default is quoted. The verdict here comes from the incident evidence.
Always install with elevated privileges set to Disabled
Windows ADMX Default protects Holds against a local admin Broadly deployable No user-visible change General hardening, not evidenced here Microsoft baseline sets this
Disabled by default and must stay that way. If enabled it hands any user a trivial SYSTEM escalation that makes the UAC bypass chain redundant.
Counters
An easier escalation path than the one the sample uses
Cost of deploying
Disabled by default; verify only.
Registry
HKLM\Software\Policies\Microsoft\Windows\Installer!AlwaysInstallElevated
Where
Windows Components\Windows Installer
Scope
Machine
MITRE
T1548.002 Bypass UAC
Microsoft Security Baseline setsAlwaysInstallElevated = 0
Microsoft's wording for the unset stateIf you disable or do not configure this policy setting, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.
Remove local administrator rights from standard users set to Enforce
Not Group Policy Default enables this This is the admin control Needs a project first Users will notice
The organising control for this incident. The sample explicitly checks IsAdmin and the S-1-5-32-544 membership and branches on the answer. Microsoft's write-up confirms it: with no local admin the silent bypasses fail and the malware falls back to a visible RunAs prompt the user cannot satisfy. Read the what-dies-what-survives split before treating this as sufficient.
Counters
Silent escalation / SYSTEM impersonation / VSS access
Cost of deploying
A programme, not a setting: app compat, install workflows and a privilege-elevation story for genuine admin tasks. Still the highest-value item here.
Where
Entra or AD group membership
MITRE
T1078.003 Valid Accounts
Windows LAPS for local administrator passwords set to Deploy
Not Group Policy Default enables this Holds against a local admin Broadly deployable No user-visible change General hardening, not evidenced here
Where local admin must exist, unique per-device managed passwords stop one harvested credential becoming lateral movement across the estate.
Counters
Reuse of a shared local admin credential
Cost of deploying
Straightforward to deploy alongside admin-rights work.
Where
Windows LAPS
MITRE
T1078.003 Valid Accounts

Browser secret extraction

13 controls · 7 where the default works in the attacker's favour

Credential access — T1539 Steal Web Session Cookie

RemoteDebuggingAllowed set to Disabled
Edge policy Default enables this Weakened by local admin Broadly deployable No user-visible change Beyond the Microsoft baseline
The highest-value non-default change on this page. Unset, remote debugging is available, and the sample launches Edge with --remote-debugging-port via Task Scheduler COM then calls Network.getAllCookies to read cookies already decrypted in browser memory. This bypasses App-Bound Encryption entirely and needs no administrator rights, so it is the one route that removing local admin does not touch. Marked partial only because a local administrator could remove the policy key itself.
Counters
CDP cookie theft against Edge
Cost of deploying
Breaks browser remote debugging for web developers. Exempt that group by OU rather than leaving it on for everyone.
Registry
Software\Policies\Microsoft\Edge!RemoteDebuggingAllowed
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1539 Steal Web Session Cookie
Microsoft's wording for the unset stateIf you enable or don't configure this policy, users can use remote debugging by specifying --remote-debug-port and --remote-debugging-pipe command line switches.
ApplicationBoundEncryptionEnabled set to Enabled
Edge policy Default not stated Weakened by local admin Broadly deployable No user-visible change Microsoft baseline sets this
Keep App-Bound Encryption on. The ADMX does not state its unset behaviour so no default claim is made here, but the incident evidence is unambiguous: the sample needs SYSTEM token impersonation and NCrypt to get past it, which is what makes that route admin-only.
Counters
ABE v20 master key decryption
Cost of deploying
On in practice; verify it has not been turned off.
Registry
Software\Policies\Microsoft\Edge!ApplicationBoundEncryptionEnabled
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1555.003 Credentials from Web Browsers
Microsoft Security Baseline setsApplicationBoundEncryptionEnabled = 1
Microsoft's wording for the unset stateEnabling this policy or leaving it unset binds the encryption keys used for local data storage to Microsoft Edge whenever possible.
PasswordManagerEnabled set to Leave enabled unless a managed password manager exists
Edge policy Default enables this Weakened by local admin Needs a project first Users will notice Beyond the Microsoft baseline
Tempting, and wrong for most organisations. The Edge store is the one credential location on this list that is actually defended: it sits behind App-Bound Encryption, and the attacker needed SYSTEM token impersonation to reach it. Turning it off without a managed alternative does not remove the credentials, it moves them somewhere with no protection at all — reuse, a text file, a personal password manager outside your control. Most organisations do not have enterprise password management, so for them the correct action here is to leave this alone and take the four cheaper password controls below instead. Disable it only once a managed alternative is actually in users' hands.
Counters
Extraction of saved passwords from Login Data
Cost of deploying
If you disable it without a replacement you push credentials into stores you cannot see or defend, which is a net loss. The prerequisite is a deployed and adopted password manager, not merely a purchased one.
Registry
Software\Policies\Microsoft\Edge!PasswordManagerEnabled
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1555.003 Credentials from Web Browsers
Microsoft's wording for the unset stateIf you enable or don't configure this policy, users can save and add their passwords in Microsoft Edge.
PasswordProtectionLoginURLs set to Your corporate sign-in URLs
Edge policy Default is neutral Weakened by local admin Broadly deployable Barely noticeable Beyond the Microsoft baseline
Captures salted hashes of the passwords users type on your own sign-in pages, so Edge can recognise the same password being reused elsewhere. This is what turns Microsoft's advice for this campaign — do not reuse corporate credentials on hotel, conference or guest-network registration pages — from a poster into a control that actually fires. Unset, no fingerprints are captured and nothing can be detected.
Counters
Corporate password reuse on a hostile captive-portal registration page
Cost of deploying
Requires listing your sign-in URLs. No effect on users until a reuse actually happens.
Registry
Software\Policies\Microsoft\Edge!
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1555.003 Credentials from Web Browsers
Microsoft's wording for the unset stateIf you disable this policy or don't configure it, no password fingerprints are captured.
PasswordProtectionWarningTrigger set to 1
Edge policy Default is neutral Weakened by local admin Broadly deployable Barely noticeable Beyond the Microsoft baseline
The trigger half of the pair above: warns the user at the moment they reuse a protected corporate password on a suspicious site. Useless on its own — set PasswordProtectionLoginURLs as well or there are no fingerprints to match against.
Counters
Corporate password reuse on a hostile captive-portal registration page
Cost of deploying
An occasional warning at the moment of reuse. Invisible the rest of the time.
Registry
Software\Policies\Microsoft\Edge!PasswordProtectionWarningTrigger
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1555.003 Credentials from Web Browsers
Microsoft's wording for the unset stateIf you disable or don't configure this policy, then the warning trigger isn't shown.
PasswordExportEnabled set to Disabled
Edge policy Default enables this Weakened by local admin Broadly deployable Barely noticeable General hardening, not evidenced here Beyond the Microsoft baseline
Removes the Export Password button, closing the one-click bulk extraction route out of the password store. It does not stop this sample, which reads the Login Data file directly, but it costs almost nothing and closes an obvious adjacent path. Unset, any user or anyone at their unlocked machine can export the lot.
Counters
Bulk export of the saved-password store
Cost of deploying
Users cannot self-serve a password export during a browser migration; IT does it instead.
Registry
Software\Policies\Microsoft\Edge!PasswordExportEnabled
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1555.003 Credentials from Web Browsers
Microsoft's wording for the unset stateIf enabled or not configured, users can export saved passwords.
PasswordMonitorAllowed set to Enabled
Edge policy Default is neutral Weakened by local admin Broadly deployable No user-visible change General hardening, not evidenced here Beyond the Microsoft baseline
Does not prevent the theft; shortens the time before you learn about it. Alerts users when a stored password turns up in a known breach, which is how stolen credentials usually surface after an infostealer. Unset it is a user preference, so coverage is patchy exactly where you need it.
Counters
Post-theft detection of exposed credentials
Cost of deploying
A helpful user-facing feature. Sends password hashes to the Microsoft service - check against data-handling policy.
Registry
Software\Policies\Microsoft\Edge!PasswordMonitorAllowed
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1555.003 Credentials from Web Browsers
Microsoft's wording for the unset stateIf you don't configure the policy, users can turn this feature on or off.
BrowserSignin set to 0
Edge policy Default enables this Weakened by local admin High-assurance builds only Changes how people work General hardening, not evidenced here Beyond the Microsoft baseline
Limits how much corporate session material is resident in the browser profile at all. Consider carefully against usability.
Counters
Value of the stolen browser profile
Cost of deploying
Disabling browser sign-in removes Edge profile sync and much of the managed-browser story. For most estates token protection is the better answer.
Registry
Software\Policies\Microsoft\Edge!BrowserSignin
Where
Administrative Templates / Microsoft Edge
Scope
Machine + User
MITRE
T1539 Steal Web Session Cookie
Microsoft's wording for the unset stateIf you don't configure this policy, users can decide if they want to enable the browser sign-in option and use it as they see fit.
Stated defaultSigning in to the browser doesn't mean that sync is turned on by default; the user must separately opt in to use this feature. By default, this allows the user to choose whether they want to sync to their account, unless sync is disabled by the domain admin or with the 'SyncDisabled' policy.
Browser cookie-file locking and auto-de-elevation set to Built in
Not Group Policy Default protects Weakened by local admin Broadly deployable No user-visible change
Two shipping defaults doing real work. Chromium v120+ opens the cookie database with no sharing, which forces the attacker into a VSS shadow copy (admin only). Chromium also auto-de-elevates, which is why the sample has to launch the browser through Task Scheduler COM with an interactive token rather than directly.
Counters
Direct cookie file reads and elevated browser launch
Cost of deploying
Built into current Chromium; nothing to deploy.
Where
Built into Chromium browsers
MITRE
T1555.003 Credentials from Web Browsers
RemoteDebuggingAllowed set to Disabled
Chrome policy Default enables this Weakened by local admin Broadly deployable No user-visible change Beyond the Microsoft baseline
The same gap as Edge, on the browser this sample actually goes for first. Google's own wording: set to Enabled or not set, users may use remote debugging via --remote-debugging-port. That is the CDP route to cookies already decrypted in memory, it sidesteps App-Bound Encryption completely, and it needs no administrator rights. Chrome ships the same default as Edge, so covering only Edge leaves the primary target wide open.
Counters
CDP cookie theft against Chrome
Cost of deploying
Breaks remote debugging for web developers. Exempt that group by OU.
Registry
Software\Policies\Google\Chrome!RemoteDebuggingAllowed
Where
Administrative Templates / Google Chrome
Scope
Machine + User
MITRE
T1539 Steal Web Session Cookie
Microsoft's wording for the unset stateIf this policy is set to Enabled or not set, users may use remote debugging by specifying --remote-debugging-port and --remote-debugging-pipe command line switches.
ApplicationBoundEncryptionEnabled set to Enabled
Chrome policy Default protects Weakened by local admin Broadly deployable No user-visible change Beyond the Microsoft baseline
Keep App-Bound Encryption on. Google documents the default plainly where the Edge ADMX is silent: Enabled or unset binds the local-storage encryption keys to Chrome. That binding is what forces the sample into SYSTEM token impersonation and NCrypt against the 'Google Chromekey1' CNG key, which is what makes that whole route admin-only.
Counters
ABE v20 master key decryption on Chrome
Cost of deploying
On by default; setting it pins the behaviour so it cannot be turned off locally.
Registry
Software\Policies\Google\Chrome!ApplicationBoundEncryptionEnabled
Where
Administrative Templates / Google Chrome
Scope
Machine + User
MITRE
T1555.003 Credentials from Web Browsers
Microsoft's wording for the unset stateSetting the policy to Enabled or leaving it unset binds encryption keys used for local data storage to Google Chrome whenever that is possible.
PasswordManagerEnabled set to Leave enabled unless a managed password manager exists
Chrome policy Default enables this Weakened by local admin Needs a project first Users will notice Beyond the Microsoft baseline
Same judgement as the Edge entry and for the same reason: the Chrome store is defended by App-Bound Encryption, and turning it off without a managed alternative moves credentials somewhere with no protection at all. Google's wording is that if not set, the user can turn off password saving.
Counters
Extraction of saved passwords from Chrome Login Data
Cost of deploying
Needs a deployed and adopted password manager first, not merely a purchased one.
Registry
Software\Policies\Google\Chrome!PasswordManagerEnabled
Where
Administrative Templates / Google Chrome
Scope
Machine + User
MITRE
T1555.003 Credentials from Web Browsers
Microsoft's wording for the unset stateIf not set, the user can turn off password saving.
BrowserSignin set to 0
Chrome policy Default enables this Weakened by local admin High-assurance builds only Changes how people work General hardening, not evidenced here Beyond the Microsoft baseline
Limits how much corporate session material sits in the Chrome profile at all. Same trade as Edge: for most estates token protection is the better answer than removing sign-in.
Counters
Value of the stolen Chrome profile
Cost of deploying
Removes Chrome profile sync and much of the managed-browser story.
Registry
Software\Policies\Google\Chrome!BrowserSignin
Where
Administrative Templates / Google Chrome
Scope
Machine + User
MITRE
T1539 Steal Web Session Cookie
Microsoft's wording for the unset stateIf this policy is not set then the user can decide if they want to enable browser sign-in in the Google Chrome settings and use it as they see fit.
Stated defaultHowever, it does not mean that Google Chrome Sync will be turned on by default; the user must separately opt-in to use this feature.

Identity and token theft

4 controls · 4 where the default works in the attacker's favour

Credential access — T1550.001 Application Access Token

Block OAuth device code flow set to Block
Not Group Policy Default enables this Holds against a local admin Broadly deployable Barely noticeable
Microsoft's guidance for this campaign states device code flow should be blocked wherever possible and only allowed where necessary. The campaign uses device code phishing to authenticate attacker sessions against legitimate Microsoft sign-in pages.
Counters
Device code phishing stage of the campaign
Cost of deploying
Allow-list the genuine device-code scenarios first, such as shared and headless devices.
Where
Entra Conditional Access
MITRE
T1550.001 Application Access Token
Token protection and continuous access evaluation set to Enable
Not Group Policy Default enables this Holds against a local admin Broadly deployable Barely noticeable General hardening, not evidenced here
Binds refresh tokens to the device so a stolen TokenBroker blob cannot be replayed from attacker infrastructure. This is the control that most directly answers the .tbres theft, which needs no administrator rights.
Counters
Replay of stolen M365 SSO and refresh tokens
Cost of deploying
Check client support before enforcing.
Where
Entra Conditional Access
MITRE
T1550.001 Application Access Token
Phishing-resistant MFA with passkeys set to Enforce
Not Group Policy Default enables this Holds against a local admin Needs a project first Users will notice
Microsoft's guidance names passkeys and phishing-resistant MFA directly. Reduces the value of stolen credentials, though note it does not by itself stop session cookie or refresh token replay.
Counters
Use of harvested credentials for sign-in
Cost of deploying
Rollout programme with a registration and fallback path.
Where
Entra ID
MITRE
T1539 Steal Web Session Cookie
Sign-in risk policy set to Enable
Not Group Policy Default enables this Holds against a local admin Broadly deployable Barely noticeable
Microsoft recommends automating response to risky sign-ins. Stolen tokens replayed from the C2 range present as impossible travel or unfamiliar infrastructure.
Counters
Attacker sign-in using stolen session material
Cost of deploying
Tune to avoid locking out legitimate travellers, who by definition look like impossible travel.
Where
Entra ID Protection
MITRE
T1539 Steal Web Session Cookie

Egress and C2

3 controls · 1 where the default works in the attacker's favour

Command and control — T1071.001 Web Protocols

Prevent users and apps from accessing dangerous websites set to Enabled - Block
Windows ADMX Default is neutral Holds against a local admin Broadly deployable Barely noticeable Microsoft baseline sets this
Defender network protection. Not applied until configured. Blocks the beacon and exfiltration calls to the C2 range at the network layer regardless of which process makes them, which matters because the sample deliberately uses the WinHttp COM object to avoid process-level detection.
Counters
70 beacon calls and the compressed exfil POST
Cost of deploying
Audit mode first.
Registry
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection!EnableNetworkProtection
Where
Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Network Protection
Scope
Machine
MITRE
T1071.001 Web Protocols
Microsoft Security Baseline setsEnableNetworkProtection = 1
Microsoft's wording for the unset stateNot configured: Same as Disabled.
Join Microsoft MAPS set to Enabled - Advanced MAPS
Windows ADMX Default is neutral Holds against a local admin Broadly deployable No user-visible change Microsoft baseline sets this
Cloud-delivered protection improves the chance of catching a novel Stage 3 module. The sample calls Invoke-SigLock to block Defender signature updates during collection, which tells you the actor considers signature freshness a real threat.
Counters
Stage 3 tool module and payload variants
Cost of deploying
Sends telemetry to Microsoft; check against data-handling policy.
Registry
HKLM\Software\Policies\Microsoft\Windows Defender\Spynet!SpynetReporting
Where
Windows Components\Microsoft Defender Antivirus\MAPS
Scope
Machine
MITRE
T1071.001 Web Protocols
Microsoft Security Baseline setsSpynetReporting = 2
Microsoft's wording for the unset stateIf you disable or do not configure this setting, you will not join Microsoft MAPS.
Egress filtering and TLS inspection set to Deploy
Not Group Policy Default enables this Holds against a local admin Needs a project first Barely noticeable
The sample disables TLS certificate validation via WinHttp Option(4)=13056 and posts to a hardcoded IP. Outbound control and inspection surface both the beacon pattern and the single-IP destination.
Counters
Exfiltration to 213.145.86.0/24
Cost of deploying
Egress filtering is broadly deployable. TLS inspection is invasive and has privacy and pinning implications.
Where
Network egress controls
MITRE
T1071.001 Web Protocols