Windows 2022

Get-WindowsUpdateLog triggers Microsoft Attack Surface Reduction (ASR) Rules

by

We were trying to diagnose a problem with Windows Updates today using Get-WindowsUpdateLog on Windows Server 2019. We kept getting blocked by ASR rule C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB (Block use of copied or impersonated system tools) which kept tripping on the script’s use of tracerpt.exe which is supposed to be located in C:\Windows\System32. We kept getting this: Looking … Read more

Script for detecting potentially vulnerable Log4j jars [CVE-2021-44228] on Windows Server

by

Update 2021-12-18 – This looks like a much more competent script for detecting this vulnerability and there is a python version for Linux: https://github.com/CERTCC/CVE-2021-44228_scanner Updated 2021-12-17 – Script is v1.4 and looks for .war files now too Original post below Inspired by the one-liner here: https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#find-vulnerable-software-windows I wrote a script to expand on the command, … Read more