Batch file from symposium sorry for poor quality
(media.communities.win)
Comments (10)
sorted by:
As well there is a folder called GPO that is a group policy object. This would indicate it is getting updates via group policy a windows domain service.
seems to
change configuration file for a database
copy group policies files from the local directory to the windows one
add something to the registry (not clear what or where)
messages
add a key in the registry and parameters for dominion EMS
messages
add a key in the registry for SQL server (superSocket it's related to the network / certificates )
stop sql
start sql
start sqlagent
This is a script to make sure a group policy is set, It then pulls sql settings from registry, It then Restarts Sql
so what we need is a copy of that group policy.
It looks like it is turning off or replacing security configurations and restarts services.
Yeah, analyzing this stuff live isn't a good approach at all, unless they're trying to spook the bad guys. Drip, drip, drip. Analyzing all of this stuff and what is going on sometimes takes days. You want to be very certain of what you see, what you understand, and what you can prove before making an accusation.
You got it. This show is only partly for us.
Been watching.
"ECHO --SQL Server de-hardening--" (this prints "--SQL Server de-hardening--" to the command line session)
Might be something. Might be nothing. Sometimes you might need to de-harden something to do an upgrade or such. But where is the re-hardening?
kinda means nothing in the grand scheme of things. i'm pretty sure this is just whats going to be used in Lindells defense against Dominion