my tweets are severely limited by my lack of understanding of what I am doing.
Windows 10 Enterprise with Secure Boot enabled with Credential Guard enabled stops Petya in its tracks. All built in features.
-
I was referring to the credential stealing, not SMB. You'd have to prevent execution from the network, using the policy Tay posted.
I've infected Win7 in a lab, works fine. Credential stealing limited if you block SMB and WMI - blocks Psexec (which needs admin$ share)
