cheat sheet attack/defense https://github.com/jmau111-org/powershell_commands

XSS without alert

Practical security guide that contains useful links to learn Linux internals and security (attack/defense).

I tried to summarize what I've learned so far, but, of course, it's neither exhaustive nor suited for targeted attacks.

I think your guide and HardeningKitty type solutions are good for non-targeted attacks and for your average user.

Main problem is that targeted attacks are rife in the software industry. Even small startups get frequently targeted by competitors.

In order to defend against the targeted attacks you need to plug hundreds of holes in the Windows, some of these can be plugged by HardeningKitty but to truly secure it:

- You need to figure out which services you can disable without crashing the OS and keep them at a minimum. This entirely depends on how you use OS and which type of software is installed at the endpoints.

- Use stuff like Windows Application Guard, disable lolbas as much as possible (https://lolbas-project.github.io/).

- Secure the WSL itself.

- Windows opens ports according to it's own mind. Only way to unplug these open ports is to add another hardware firewall separate from the endpoint itself. So you can't even trust the inbuilt firewall of Windows.

- Windows is a very dynamic OS and each update can result in more open holes or might just automatically discard previously applied settings. Thus, you need to keep monitoring this 24/7.

- Windows registry has a very large amount of paths for malware persistence. This amount is far beyond malware persistence paths on Linux. Unfortunately, Windows Defender doesn't care much about this, so you need to monitor this yourself.

And this is just the beginning, even if you plug all this stuff, you might get attacked by zero days. Monitoring all that will also require SIEM solutions on top of it. Most of the SIEM solutions are just focused on compliance. Building a SIEM solution for real security instead of compliance is also a very hard task.

Would you say kernel and privesc are worse or better on Linux? All else being "correct" I always had the feeling that this was handled well on mainline distros (Fedora, Ubuntu, Debian, OpenSuse) and some BSD distros (OpenBSD), maybe even better than Windows depending on what you're looking at.

Which scripts? Malicious scripts...yeah. But you can stop using wscript,mshta,bat,etc... and only allow powershell signed scripts with JEA restriction.