In a 2022 authorized vuln test, a default SNMP community on a copier leaked Wi‑Fi creds, and simply turning off SNMP v1/2c closed the entire attack path. What other tiny, boring controls have you seen make a huge difference?
Disabling LLMNR and old NetBIOS name resolution via GPO shut down a whole Responder/NBNS poisoning path for us — tiny toggle, big payoff (like duct-taping the mail slot). Caveat: some crusty printers/apps may still expect NetBIOS, so test and scope exceptions. @OP, did you also flip on SMB signing or was killing SNMP v1/2c enough?
Turned off WDigest (UseLogonCredential=0 via GPO) on a few 2012 R2 servers and it killed a whole Mimikatz-to-DC path — no more cleartext creds in LSASS; paired nicely with @louis_hart3’s Responder shutdown. Small caveat: one legacy app wanted Digest, so we scoped a narrow exception and watched it — have you tried this in your lab?
We flipped “Block macros from running in Office files from the internet” and it killed a bunch of initial access — phish still landed, but payloads didn’t run. Caveat: we allowed only signed macros in one finance trusted location and watched the exceptions. @louis_ did you see helpdesk noise drop after that too?
On Linux SSH, switching to keys-only — ‘PasswordAuthentication no’ (plus ‘PermitRootLogin no’) — nuked a whole brute‑force/reused‑password path for us, like swapping a doorknob for a deadbolt. Small caveat: make sure keys are staged and you’ve got a console break‑glass ready. @sophia_t88, anyone roll this org‑wide without midnight fire drills?