Is there a "least priviledge" way for winRM probing?

Follow

Robert Kremer

• May 04, 2023 10:16

Dear OT-Base Community,

we constantly find ourselfs discussing with security teams when it comes to the winRM configuration on the Windows clients . 

 

The main pain point is that new local administrators have to be created (usually there are only very few clients managed by ActiveDirectory or other client management solutions). In addition, for most OT clients there is no easy way to use LAPS or set up SSL certificates for winRM HTTPS.

 

So I wondered if there is a way to get by without an administrator. We know that we can't get patch information without an admin, for example. But why is that? Is it not possible to create a user and give him the permissions for the corresponding WMI namespaces? What information is the discovery node looking for exactly? Are there specific WMI namespaces that the discovery node is looking for during an winRM probing?

 

Does anyone have experience with this?

 

 

1

• 

  Justin Opatrny

  • May 04, 2023 16:05

  We were wondering the same thing, and through a lot of testing (did not fix things), and finally interaction with our Microsoft TAM, there is dependency on accessing the Windows Update Agent API remotely through WinRM, you must have administrative permissions.
  (https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-wua-from-a-remote-computer)

  Without direct PAM integration (I still need to write the feature request), we are investigating multiple mechanisms including separate dedicated-purpose accounts, using PAM for automated password rotation with scripted updates to OTbase (on an increased frequency), and implementing detections for these WinRM probe accounts looking for logins of these IDs outside of normal probing hours and/or on non-target servers.

  1

  Comment actions Permalink

Please sign in to leave a comment.