Skip to content

HardeningKitty - Checks and hardens your Windows configuration

License

Notifications You must be signed in to change notification settings

ataumo/HardeningKitty

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

42 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

HardeningKitty

This is the stable version of HardeningKitty from the Windows Hardening Project by Michael Schneider. The stable version of HardeningKitty is signed with the code signing certificate of scip AG. Since this is the stable version, we do not accept pull requests in this repo, please send them to the development repo.

HardeningKitty supports hardening of a Windows system. The configuration of the system is retrieved and assessed using a finding list. In addition, the system can be hardened according to predefined values. HardeningKitty reads settings from the registry and uses other modules to read configurations outside the registry.

The script was developed for English systems. It is possible that in other languages the analysis is incorrect. Please create an issue if this occurs.

How to Run

Run the script with administrative privileges to access machine settings. For the user settings it is better to execute them with a normal user account. Ideally, the user account is used for daily work.

Download HardeningKitty and copy it to the target system (script and lists). Then HardeningKitty can be imported and executed:

PS C:\tmp> Import-Module .\HardeningKitty.psm1
PS C:\tmp> Invoke-HardeningKitty -EmojiSupport


         =^._.^=
        _(      )/  HardeningKitty 0.9.0-1662273740


[*] 9/4/2022 8:54:12 AM - Starting HardeningKitty


[*] 9/4/2022 8:54:12 AM - Getting user information
[*] Hostname: DESKTOP-DG83TOD
[*] Domain: WORKGROUP

...

[*] [*] 9/4/2022 8:54:12 AM - Starting Category Account Policies
[😺] ID 1103, Store passwords using reversible encryption, Result=0, Severity=Passed
[😺] ID 1100, Account lockout threshold, Result=10, Severity=Passed
[😺] ID 1101, Account lockout duration, Result=30, Severity=Passed

...

[*] 9/4/2022 8:54:12 AM - Starting Category User Rights Assignment
[😿] ID 1200, Access this computer from the network, Result=BUILTIN\Administrators;BUILTIN\Users, Recommended=BUILTIN\Administrators, Severity=Medium

...

[*] 9/4/2022 8:54:14 AM - Starting Category Administrative Templates: Printer
[🙀] ID 1764, Point and Print Restrictions: When installing drivers for a new connection (CVE-2021-34527), Result=1, Recommended=0, Severity=High
[🙀] ID 1765, Point and Print Restrictions: When updating drivers for an existing connection (CVE-2021-34527), Result=2, Recommended=0, Severity=High

...

[*] 9/4/2022 8:54:19 AM - Starting Category MS Security Guide
[😿] ID 2200, LSA Protection, Result=, Recommended=1, Severity=Medium
[😼] ID 2201, Lsass.exe audit mode, Result=, Recommended=8, Severity=Low

...

[*] 9/4/2022 8:54:25 AM - HardeningKitty is done
[*] 9/4/2022 8:54:25 AM - Your HardeningKitty score is: 4.82. HardeningKitty Statistics: Total checks: 325 - Passed: 213, Low: 33, Medium: 76, High: 3.

How To Install

First create the directory HardeningKitty and for every version a sub directory like 0.9.0 in a path listed in the PSModulePath environment variable.

Copy the module HardeningKitty.psm1, HardeningKitty.psd1, and the lists directory to this new directory.

PS C:\tmp> $Version = "0.9.0"
PS C:\tmp> New-Item -Path $Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty\$Version -ItemType Directory
PS C:\tmp> Copy-Item -Path .\HardeningKitty.psd1,.\HardeningKitty.psm1,.\lists\ -Destination $Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty\$Version\ -Recurse

For more information see Microsoft's article Installing a PowerShell Module.

Examples

Audit

HardeningKitty performs an audit, saves the results in a CSV file and creates a log file. The files are automatically named and receive a timestamp. Using the parameters ReportFile or LogFile, it is also possible to assign your own name and path.

The Filter parameter can be used to filter the hardening list. For this purpose the PowerShell ScriptBlock syntax must be used, for example { $_.ID -eq 4505 }. The following elements are useful for filtering: ID, Category, Name, Method, and Severity.

Invoke-HardeningKitty -Mode Audit -Log -Report

HardeningKitty can be executed with a specific list defined by the parameter FileFindingList. If HardeningKitty is run several times on the same system, it may be useful to hide the machine information. The parameter SkipMachineInformation is used for this purpose.

Invoke-HardeningKitty -FileFindingList .\lists\finding_list_0x6d69636b_user.csv -SkipMachineInformation

HardeningKitty uses the default list, and saves the results in a specific file.

Invoke-HardeningKitty -Mode Config -Report -ReportFile C:\tmp\my_hardeningkitty_report.csv

HardeningKitty uses the default list, and checks only tests with the severity Medium.

Invoke-HardeningKitty -Filter { $_.Severity -eq "Medium" }

Backup

Backups are important. Really important. Therefore, HardeningKitty also has a function to retrieve the current configuration and save it in a form that can be easily restored. The Backup switch specifies that the file is written in form of a finding list and can thus be used for the HailMary mode. The name and path of the backup can be specified with the parameter BackupFile.

Invoke-HardeningKitty -Mode Config -Backup

Please test this function to see if it really works properly on the target system before making any serious changes. A Schrödinger's backup is dangerous.

HailMary

The HailMary method is very powerful. It can be used to deploy a finding list on a system. All findings are set on this system as recommended in the list. With power comes responsibility. Please use this mode only if you know what you are doing. Be sure to have a backup of the system.

Invoke-HardeningKitty -Mode HailMary -Log -Report -FileFindingList .\lists\finding_list_0x6d69636b_machine.csv

HardeningKitty Score

Each Passed finding gives 4 points, a Low finding gives 2 points, a Medium finding gives 1 point and a High Finding gives 0 points.

The formula for the HardeningKitty Score is (Points achieved / Maximum points) * 5 + 1.

Rating

Score Rating Casual Rating Professional
6 😹 Excellent Excellent
5 😺 Well done Good
4 😼 Sufficient Sufficient
3 😿 You should do better Insufficient
2 🙀 Weak Insufficient
1 😾 Bogus Insufficient

HardeningKitty Interface

ataumo build a web based interface for HardeningKitty. The tool can be used to create your own lists and provides additional information on the hardening settings. The source code is under AGPL license and there is a demo site.

Last Update

HardeningKitty can be used to audit systems against the following baselines / benchmarks:

Name System Version Version
0x6d69636b (Machine) 20H2, 21H1
0x6d69636b (User) 20H2, 21H1
BSI SiSyPHuS Windows 10 hoher Schutzbedarf Domänenmitglied (Machine) 1809 1.0
BSI SiSyPHuS Windows 10 hoher Schutzbedarf Domänenmitglied (User) 1809 1.0
BSI SiSyPHuS Windows 10 normaler Schutzbedarf Domänenmitglied (Machine) 1809 1.0
BSI SiSyPHuS Windows 10 normaler Schutzbedarf Domänenmitglied (User) 1809 1.0
BSI SiSyPHuS Windows 10 normaler Schutzbedarf Einzelrechner (Machine) 1809 1.0
BSI SiSyPHuS Windows 10 normaler Schutzbedarf Einzelrechner (User) 1809 1.0
CIS Microsoft Windows 10 Enterprise (Machine) 1809 1.6.1
CIS Microsoft Windows 10 Enterprise (User) 1809 1.6.1
CIS Microsoft Windows 10 Enterprise (Machine) 1903 1.7.1
CIS Microsoft Windows 10 Enterprise (User) 1903 1.7.1
CIS Microsoft Windows 10 Enterprise (Machine) 1909 1.8.1
CIS Microsoft Windows 10 Enterprise (User) 1909 1.8.1
CIS Microsoft Windows 10 Enterprise (Machine) 2004 1.9.1
CIS Microsoft Windows 10 Enterprise (User) 2004 1.9.1
CIS Microsoft Windows 10 Enterprise (Machine) 20H2 1.10.1
CIS Microsoft Windows 10 Enterprise (User) 20H2 1.10.1
CIS Microsoft Windows 10 Enterprise (Machine) 21H1 1.11.0
CIS Microsoft Windows 10 Enterprise (User) 21H1 1.11.0
CIS Microsoft Windows 10 Enterprise (Machine) 21H2 1.12.0
CIS Microsoft Windows 10 Enterprise (User) 21H2 1.12.0
CIS Microsoft Windows 11 Enterprise (Machine) 21H2 1.0.0
CIS Microsoft Windows 11 Enterprise (User) 21H2 1.0.0
CIS Microsoft Windows Server 2012 R2 (Machine) R2 2.4.0
CIS Microsoft Windows Server 2012 R2 (User) R2 2.4.0
CIS Microsoft Windows Server 2016 (Machine) 1607 1.2.0
CIS Microsoft Windows Server 2016 (User) 1607 1.2.0
CIS Microsoft Windows Server 2016 (Machine) 1607 1.3.0
CIS Microsoft Windows Server 2016 (User) 1607 1.3.0
CIS Microsoft Windows Server 2019 (Machine) 1809 1.1.0
CIS Microsoft Windows Server 2019 (User) 1809 1.1.0
CIS Microsoft Windows Server 2019 (Machine) 1809 1.2.1
CIS Microsoft Windows Server 2019 (User) 1809 1.2.1
CIS Microsoft Windows Server 2022 (Machine) 21H2 1.0.0
CIS Microsoft Windows Server 2022 (User) 21H2 1.0.0
DoD Microsoft Windows 10 STIG (Machine) 20H2 v2r1
DoD Microsoft Windows 10 STIG (User) 20H2 v2r1
DoD Windows Server 2019 Domain Controller STIG (Machine) 20H2 v2r1
DoD Windows Server 2019 Domain Controller STIG (User) 20H2 v2r1
DoD Windows Server 2019 Member Server STIG (Machine) 20H2 v2r1
DoD Windows Server 2019 Member Server STIG (User) 20H2 v2r1
DoD Windows Defender Antivirus STIG 20H2 v2r1
DoD Windows Firewall STIG 20H2 v1r7
Microsoft Security baseline for Microsoft Edge 87 Final
Microsoft Security baseline for Microsoft Edge 88, 89, 90, 91 Final
Microsoft Security baseline for Microsoft Edge 92 Final
Microsoft Security baseline for Microsoft Edge 93, 94 Final
Microsoft Security baseline for Microsoft Edge 95 Final
Microsoft Security baseline for Microsoft Edge 96 Final
Microsoft Security baseline for Microsoft Edge 97 Final
Microsoft Security baseline for Microsoft Edge 98, 99, 100, 101, 102, 103, 104, 105, 106 Final
Microsoft Security baseline for Microsoft Edge 107, 108 Final
Microsoft Security baseline for Windows 10 2004 Final
Microsoft Security baseline for Windows 10 20H2, 21H1 Final
Microsoft Security baseline for Windows 10 21H2 Final
Microsoft Security baseline for Windows 10 (Machine) 22H2 Final
Microsoft Security baseline for Windows 10 (User) 22H2 Final
Microsoft Security baseline for Windows 11 21H2 Final
Microsoft Security baseline for Windows 11 (Machine) 22H2 Final
Microsoft Security baseline for Windows 11 (User) 22H2 Final
Microsoft Security baseline for Windows Server (DC) 2004 Final
Microsoft Security baseline for Windows Server (Member) 2004 Final
Microsoft Security baseline for Windows Server (DC) 20H2 Final
Microsoft Security baseline for Windows Server (Member) 20H2 Final
Microsoft Security baseline for Windows Server 2022 (DC) 21H2 Final
Microsoft Security baseline for Windows Server 2022 (Member) 21H2 Final
Microsoft Security baseline for Office 365 ProPlus (Machine) Sept 2019 Final
Microsoft Security baseline for Office 365 ProPlus (User) Sept 2019 Final
Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) v2104, v2106 Final
Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) v2104, v2106 Final
Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) v2112 Final
Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) v2112 Final
Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) v2206 Final
Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) v2206 Final
Microsoft Windows Server TLS Settings 1809 1.0
Microsoft Windows Server TLS Settings (Future Use with TLSv1.3) 1903 1.0

About

HardeningKitty - Checks and hardens your Windows configuration

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • PowerShell 100.0%