How to Mitigate Microsoft Windows 10, 11 SeriousSAM Vulnerability

Microsoft Windows 10 and Windows 11 users are at risk of a new
unpatched vulnerability that was recently disclosed publicly.

As we reported last week, the vulnerability — SeriousSAM^[1]
— allows attackers with low-level permissions to access Windows
system files to perform a Pass-the-Hash (and potentially Silver
Ticket) attack.

Attackers can exploit this vulnerability to obtain hashed
passwords stored in the Security Account Manager (SAM) and
Registry, and ultimately run arbitrary code with SYSTEM
privileges.

SeriousSAM vulnerability, tracked as CVE-2021-36934,
exists in the default configuration of Windows 10 and Windows 11,
specifically due to a setting that allows ‘read’ permissions to the
built-in user’s group that contains all local users.

As a result, built-in local users have access to read the SAM
files and the Registry, where they can also view the hashes. Once
the attacker has ‘User’ access, they can use a tool such as
Mimikatz to gain access to the Registry or SAM, steal the hashes
and convert them to passwords. Invading Domain users that way will
give attackers elevated privileges on the network.

Because there is no official patch available yet from Microsoft,
the best way to protect your environment from SeriousSAM
vulnerability is to implement hardening measures.

Mitigating SeriousSAM

According to Dvir Goren, CTO at CalCom, there are three optional
hardening measures:

1. Delete all users from the built-in users’
   group — this is a good place to start from, but won’t
   protect you if Administrator credentials are stolen.
2. Restrict SAM files and Registry permissions —
   allow access only for Administrators. This will, again, only solve
   part of the problem, as if an attacker steals Admin credentials,
   you will still be vulnerable to this vulnerability.
3. Don’t allow the storage of passwords and credentials
   for network authentication — this rule is also recommended
   in the CIS benchmarks^[2]. By implementing this
   rule, there will be no hash stored in the SAM or registry, thereby
   mitigating this vulnerability completely.

When using GPOs for implementation, make sure the following UI
Path is Enabled:

Despite the fact that the last recommendation offers a good
solution for SeriousSAM, it may negatively impact your production
if not properly tested before it is pushed. When this setting is
enabled, applications that use scheduled tasks and need to store
users’ hashes locally will fail.

Mitigating SeriousSAM without risking causing damage to
production

The following are Dvir’s recommendations for mitigating without
causing downtime:

1. Set up a test environment that will simulate your production
   environment. Simulate all possible dependencies of your network as
   accurately as you can.
2. Analyze the impact of this rule on your test environment. In
   this way, if you have applications that rely on hashes that are
   stored locally, you’ll know in advance and prevent production
   downtime.
3. Push the policy where possible. Make sure new machines are also
   hardened and that the configuration doesn’t drift over time.

These three tasks are complex and require a lot of resources and
in-house expertise. Therefore, Dvir’s final recommendation is to
automate the entire hardening
process^[3] to save the need to
perform stages 1, 2 and 3.

Here is what you will gain from a Hardening Automation Tool^[4]:

• Automatically generate the most accurate possible impact
  analysis report – hardening automation tools ‘learns’ your
  production dependencies and report to you the potential impact of
  each policy rule.
• Automatically enforce your policy on your entire production
  from a single point of control – using these tools, you won’t need
  to do manual work, such as using GPOs. You can control and be
  certain all your machines are hardened.
• Maintain your compliance posture and monitor your machines in
  real-time – hardening automation tools will monitor your compliance
  posture, alert and remediate any unauthorized changes in
  configurations, therefore preventing configuration drifts.

Hardening automation tools^[5] will learn the
dependencies directly from your network and automatically generate
an accurate impact analysis report. A hardening automation tool
will also help you orchestrate the implementation and monitoring
process.