Taller 1.

Auditoria de Hardware, Software y Comunicaciones

Preguntas a Resolver después de la utilización del software WinAudit

 BERLI YORLEY MONROSI CABALLERO

 JHON ALEXANDER DIAZ PRADA

1. Qué tipo de software fue actualizado y en que fechas

Software Updates

Update ID Installed On Description

{AC76BA86-7AD7-0000-2550-
AC130C4E4300}
1f37d885-c61e-430e-acee-
6327db3f7aee
2c6f38f4-dd13-4e6a-a369-
e081cce15ed3
371cbfbb-3bea-40c6-9118-
aab4bd8dd927
390d908d-b439-4768-af05-
64f9ed1fa25c
39ab14b3-b945-4fe9-970d-
827c32fd3565
42bf8fa3-7a5b-4387-84a8-
1963568bbace
60f479fb-479b-4529-8cf1-
ad7f36811704
6c76859b-dc6b-49da-b152-
fed7b3550dcf
7b1231e3-3b5c-45a9-8606-
02eb4902a3b4
835a66e7-3d2e-47b9-af4a-
9ca55133f22c
9a0eb409-4d7d-45b7-8db1-
e7e366495220
9a91b64d-ddd6-4a6f-a701-
0ed1c102f632
20190724 Adobe Acrobat Reader DC
(19.012.20035)
2019-08-15 2019-08 Actualización
acumulativa para Windows 10
Version 1903 para sistemas
basados en x64 (KB4512508)
2019-07-23 Intel(R) Corporation - MEDIA
- 4/16/2016 12:00:00 AM -
8.20.0.922
2019-07-23 Intel - System - 4/11/2018
12:00:00 AM -
1815.12.0.2021
2019-07-23 Actualización de definición
para Windows Defender
Antivirus – KB2267602
(Definición 1.299.343.0)
2019-07-23 Realtek Semiconductor Corp.
- Net - 3/22/2019 12:00:00
AM - 2024.0.4.108
2019-07-23 2019-07 Actualización
acumulativa para Windows 10
Version 1903 para sistemas
basados en x64 (KB4507453)
2019-07-23 2019-07 Cumulative Update
for .NET Framework 3.5, 4.8
for Windows 10 Version 1903
for x64 (KB4506991)
2019-07-23 Realtek Semiconductor Corp.
- Bluetooth - 6/7/2019
12:00:00 AM - 1.6.1015.3008
2019-07-23 Intel - Other hardware -
Mobile 6th/7th Generation
Intel(R) Processor Family I/O
SMBUS - 9D23
2019-07-23 Realtek Semiconductor Corp.
- MEDIA - 10/2/2018
12:00:00 AM - 6.0.1.8549
2019-07-23 Herramienta de eliminación
de software malintencionado
de Windows x64, julio de
2019 (KB890830)
2019-07-24 Actualización de definición
para Windows Defender
 Antivirus – KB2267602
(Definición 1.299.420.0)
a31a271f-d897-4a7f-b021- 2019-07-23 Actualización de la plataforma
d3739a17bd15 antimalware de Windows
Defender Antivirus -
KB4052623 (versión
4.18.1906.3)
a5992788-cc98-45c5-9b7b- 2019-07-23 Intel Corporation - Display -
393a2e2cc95b 11/19/2018 12:00:00 AM -
25.20.100.6446
d0bf3ffb-d01a-4877-b5df- 2019-08-15 Herramienta de eliminación
be5d48ff898c de software malintencionado
de Windows x64, agosto de
2019 (KB890830)
deadd591-aebc-4e14-a7eb- 2019-07-23 2019-06 Actualización de
64ac8b31720a seguridad de Adobe Flash
Player para Windows 10
Version 1903 para x64
sistemas basados en
(KB4503308)
KB4497727 4/1/2019 Security Update
KB4506991 7/23/2019 Update
2. Qué sistema operativo, versión y ID tiene el PC analizado
Item Value
Name 10
Edition Windows Home Single Language
Install Date 2019-07-23 09:20:26
Registered Owner SalaB3PC6
Registered Organization
Product ID 00327-30436-74608-AAOEM
Major Version Number 10
Minor Version Number 0
Build Number 18362
Service Pack
Service Pack Version 0.0
Plus! Version Number <null>
DirectX Version 12.0
Windows Directory C:\Windows\
System Directory C:\Windows\system32\
Temporary Directory C:\Users\SALAB3~1\AppData\Local\Temp\
Operating System Language Spanish
Number of Bits 64
3. Que permisos están habilitados

Delete, Read Permissions, Change Permissions, Take Ownership, Manage Documents

4. Como están configurados los parámetros de seguridad

 Registry Security Values

Subkey Setting
CodeIdentifiers\AuthenticodeEnabled 0
Driver Signing\Policy 00000000
Eventlog\Application\RestrictGuestAccess 1
Eventlog\Security\RestrictGuestAccess
Eventlog\System\RestrictGuestAccess 1
Eventlog\Application\Retention 0
Eventlog\Security\Retention
Eventlog\System\Retention 0
Eventlog\Application\MaxSize 20971520
Eventlog\Security\MaxSize
Eventlog\System\MaxSize 20971520
LanManServer\Parameters\AutoDisconnect 15
LanManServer\Parameters\EnableForcedLogOff 1
LanManServer\Parameters\EnableSecuritySign 0
ature
LanManServer\Parameters\NullSessionPipes
LanManServer\Parameters\RequireSecuritySign 0
ature
LanManServer\Parameters\RestrictNullSessAcc 1
ess
LanmanWorkstation\Parameters\EnablePlainTe 0
xtPassword
LanmanWorkstation\Parameters\EnableSecurit 1
ySignature
LanmanWorkstation\Parameters\RequireSecurit 0
ySignature
LDAP\LDAPClientIntegrity 1
Lsa\AuditBaseObjects 0
Lsa\CrashOnAuditFail 0
Lsa\DisableDomainCreds 0
Lsa\EveryoneIncludesAnonymous 0
Lsa\FIPSAlgorithmPolicy\Enabled
Lsa\ForceGuest 0
Lsa\FullPrivilegeAuditing 00
Lsa\LimitBlankPasswordUse 1
Lsa\LmCompatibilityLevel
Lsa\MSV1_0\NTLMMinClientSec 536870912
Lsa\MSV1_0\NTLMMinServerSec 536870912
Lsa\NoLMHash 1
Lsa\RestrictAnonymous 0
Lsa\RestrictAnonymousSAM 1
Netlogon\Parameters\DisablePasswordChange 0
Netlogon\Parameters\MaximumPasswordAge 30
Netlogon\Parameters\RequireSignOrSeal 1
Netlogon\Parameters\RequireStrongKey 1
Netlogon\Parameters\SealSecureChannel 1
Netlogon\Parameters\SignSecureChannel 1
NTDS\Parameters\LDAPServerIntegrity
Session Manager\Kernel\ObCaseInsensitive 1
Session Manager\ProtectionMode 1
Session Manager\SubSystems\optional
System\ConsentPromptBehaviorAdmin 5
System\ConsentPromptBehaviorUser 3
System\DisableCAD
System\DontDisplayLastUserName 0
System\EnableInstallerDetection 1
System\EnableLUA 1
System\EnableSecureUIAPaths 1
System\EnableUIADesktopToggle 0
System\EnableVirtualization 1
System\FilterAdministratorToken
System\LegalNoticeCaption
System\LegalNoticeText
System\PromptOnSecureDesktop 1
System\ScForceOption 0
System\ShutdownWithoutLogon 1
System\UndockWithoutLogon 1
System\ValidateAdminCodeSignatures 0
Winlogon\CachedLogonsCount
Winlogon\ForceUnlockLogon
Winlogon\PasswordExpiryWarning
Winlogon\ScRemoveOption

Security Settings

Item Name Setting

Accounts Administrator account status Disabled
Accounts Guest account status Disabled
Accounts Rename administrator Administrador
account
Accounts Rename guest account Invitado
Account Lockout Policy Account lockout duration Not Applicable
Account Lockout Policy Account lockout threshold 0 Attempts
Account Lockout Policy Reset account lockout counter Not Applicable
after
AutoLogon Enabled
Automatic Updates Update status Scheduled installation
Automatic Updates Update schedule
Internet Explorer Run script Allow
Internet Explorer Run ActiveX Allow
Internet Explorer Run Java Allow
Internet Explorer Download files Allow
Internet Explorer Install desktop items
Internet Explorer Launch applications Prompt user
Network Access Allow anonymous SID/name Disabled
translation
Network Security Do not store LAN Manager Enabled
hash value on next password
change
Password Policy Enforce password history 0 remembered
Password Policy Maximum password age 42
Password Policy Minimum password age 0
Password Policy Minimum password length 0 Characters
Screen Saver Enabled 1
Screen Saver Timeout 0
Screen Saver Password protected
 5. Analice los resultados del Firewall, que está permitido y que no

Windows Firewall

Name Setting
Firewall Enabled No
Authorised Application Skype for Business UcMapi
Authorised Application Skype for Business
Authorised Application OpenJDK Platform binary
Authorised Service Compartir archivos e impresoras
Authorised Service Detección de redes
Authorised Service Escritorio remoto

6. Que tipos de usuarios hay habilitados y que acciones pueden realizar

Administradores
Item Value
Group Type Local
Group Name Administradores
Comment Los administradores tienen acceso completo y sin restricciones
al equipo o dominio

Administradores de Hyper-V
Item Value
Group Type Local
Group Name Administradores de Hyper-V
Comment Los miembros de este grupo tienen acceso completo y sin
restricciones a todas las características de Hyper-V.

IIS_IUSRS
Item Value
Group Type Local
Group Name IIS_IUSRS
Comment Grupo integrado usado por Internet Information Services.

Invitados
Item Value
Group Type Local
Group Name Invitados
Comment De forma predeterminada, los invitados tienen el mismo
acceso que los miembros del grupo Usuarios, excepto la
cuenta de invitado que tiene más restricciones

Lectores del registro de eventos

Item Value
Group Type Local
Group Name Lectores del registro de eventos
Comment Los miembros de este grupo pueden leer registros de eventos
del equipo local.

Ninguno
Item Value
Group Type Global
Group Name Ninguno
Comment Usuarios comunes

Propietarios del dispositivo

Item Value
Group Type Local
Group Name Propietarios del dispositivo
Comment Los miembros de este grupo pueden cambiar la configuración
de todo el sistema.

System Managed Accounts Group

Item Value
Group Type Local
Group Name System Managed Accounts Group
Comment Los miembros de este grupo los administra el sistema.

Usuarios
Item Value
Group Type Local
Group Name Usuarios
Comment Los usuarios no pueden hacer cambios accidentales o
intencionados en el sistema y pueden ejecutar la mayoría de
aplicaciones
Usuarios COM distribuidos
Item Value
Group Type Local
Group Name Usuarios COM distribuidos
Comment Los miembros pueden iniciar, activar y usar objetos de COM
distribuido en este equipo.

Usuarios de administración remota

Item Value
Group Type Local
Group Name Usuarios de administración remota
Comment Los miembros de este grupo pueden acceder a los recursos de
WMI mediante protocolos de administración (como WS-
Management a través del servicio Administración remota de
Windows). Esto se aplica solo a los espacios de nombres de
WMI que conceden acceso al usuario.

Usuarios del monitor de sistema

Item Value
Group Type Local
Group Name Usuarios del monitor de sistema
Comment Los miembros de este grupo tienen acceso a los datos del
contador de rendimiento de forma local y remota

Usuarios del registro de rendimiento

Item Value
Group Type Local
Group Name Usuarios del registro de rendimiento
Comment Los miembros de este grupo pueden programar contadores de
registro y rendimiento, habilitar proveedores de seguimiento y
recopilar seguimientos de eventos localmente y a través del
acceso remoto a este equipo

7. Que tareas hay programadas

Tareas programadas

Item Value
Task Name RTKCPL
Status Running
Schedule When a specific user logs on.
Next Run Time 1899-12-30 00:00:00
Run Command "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
Maximum Run Time PT0S
Last Run Time 2019-08-17 09:35:49
Last Result 267009

8. Que recursos de red están compartidos

Network Shares

Share Name Share Type Connections Share Path

ADMIN$ Disk Drive Admin 0 C:\Windows
C$ Disk Drive Admin 0 C:\
D$ Disk Drive Admin 0 D:\
G$ Disk Drive Admin 0 G:\
IPC$ Interprocess 0
Communication
Admin

9. Que puertos TCP y UDP están abiertos y que servicios se relacionan a cada puerto

TCP ::0:135
Item Value
Port Protocol TCP
Local Address ::0
Local Port 135
Caption TCP ::0:135
Service Name epmap
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 1144
Process Description
Process Manufacturer

TCP ::0:445
Item Value
Port Protocol TCP
Local Address ::0
Local Port 445
Caption TCP ::0:445
Service Name microsoft-ds
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 4
Process Description
Process Manufacturer

TCP ::0:7680
Item Value
Port Protocol TCP
Local Address ::0
Local Port 7680
Caption TCP ::0:7680
Service Name
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 1568
Process Description
Process Manufacturer

TCP ::0:49664
Item Value
Port Protocol TCP
Local Address ::0
Local Port 49664
Caption TCP ::0:49664
Service Name
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 68
Process Description
Process Manufacturer

TCP ::0:49665
Item Value
Port Protocol TCP
Local Address ::0
Local Port 49665
Caption TCP ::0:49665
Service Name
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 868
Process Description
Process Manufacturer

TCP ::0:49666
Item Value
Port Protocol TCP
Local Address ::0
Local Port 49666
Caption TCP ::0:49666
Service Name
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 1780
Process Description
Process Manufacturer

TCP ::0:49667
Item Value
Port Protocol TCP
Local Address ::0
Local Port 49667
Caption TCP ::0:49667
Service Name
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 2024
Process Description
Process Manufacturer

TCP ::0:49668
Item Value
Port Protocol TCP
Local Address ::0
Local Port 49668
Caption TCP ::0:49668
Service Name
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 3504
Process Description
Process Manufacturer

TCP ::0:49669
Item Value
Port Protocol TCP
Local Address ::0
Local Port 49669
Caption TCP ::0:49669
Service Name
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 3736
Process Description
Process Manufacturer

TCP ::0:49672
Item Value
Port Protocol TCP
Local Address ::0
Local Port 49672
Caption TCP ::0:49672
Service Name
Remote Address ::0
Remote Port 0
Connection State Listening (LISTEN)
Process Name
Process ID 1004
Process Description
Process Manufacturer

UDP ::0:500
Item Value
Port Protocol UDP
Local Address ::0
Local Port 500
Caption UDP ::0:500
Service Name isakmp
Remote Address
Remote Port
Connection State
Process Name
Process ID 3728
Process Description
Process Manufacturer

UDP ::0:4500
Item Value
Port Protocol UDP
Local Address ::0
Local Port 4500
Caption UDP ::0:4500
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 3728
Process Description
Process Manufacturer

UDP ::0:5353
Item Value
Port Protocol UDP
Local Address ::0
Local Port 5353
Caption UDP ::0:5353
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 4300
Process Description
Process Manufacturer

UDP ::0:5353
Item Value
Port Protocol UDP
Local Address ::0
Local Port 5353
Caption UDP ::0:5353
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 4300
Process Description
Process Manufacturer

UDP ::0:5353
Item Value
Port Protocol UDP
Local Address ::0
Local Port 5353
Caption UDP ::0:5353
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 2200
Process Description
Process Manufacturer

UDP ::0:5355
Item Value
Port Protocol UDP
Local Address ::0
Local Port 5355
Caption UDP ::0:5355
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 2200
Process Description
Process Manufacturer

UDP ::1:1900
Item Value
Port Protocol UDP
Local Address ::1
Local Port 1900
Caption UDP ::1:1900
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 4624
Process Description
Process Manufacturer

UDP ::1:52285
Item Value
Port Protocol UDP
Local Address ::1
Local Port 52285
Caption UDP ::1:52285
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 4624
Process Description
Process Manufacturer

UDP FE80:0000:0000:0000:64BE:019A:2238:6626:1900
Item Value
Port Protocol UDP
Local Address FE80:0000:0000:0000:64BE:019A:2238:6626
Local Port 1900
Caption UDP FE80:0000:0000:0000:64BE:019A:2238:6626:1900
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 4624
Process Description
Process Manufacturer

UDP FE80:0000:0000:0000:64BE:019A:2238:6626:52283
Item Value
Port Protocol UDP
Local Address FE80:0000:0000:0000:64BE:019A:2238:6626
Local Port 52283
Caption UDP FE80:0000:0000:0000:64BE:019A:2238:6626:52283
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 4624
Process Description
Process Manufacturer

UDP FE80:0000:0000:0000:A4BD:A437:1F65:E132:1900
Item Value
Port Protocol UDP
Local Address FE80:0000:0000:0000:A4BD:A437:1F65:E132
Local Port 1900
Caption UDP FE80:0000:0000:0000:A4BD:A437:1F65:E132:1900
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 4624
Process Description
Process Manufacturer

UDP FE80:0000:0000:0000:A4BD:A437:1F65:E132:52284
Item Value
Port Protocol UDP
Local Address FE80:0000:0000:0000:A4BD:A437:1F65:E132
Local Port 52284
Caption UDP FE80:0000:0000:0000:A4BD:A437:1F65:E132:52284
Service Name
Remote Address
Remote Port
Connection State
Process Name
Process ID 4624
Process Description
Process Manufacturer

10. Que puertos de comunicaciones se muestran y que acciones permiten esos puertos

Puertos de comunicación

SHRFAX:
Item Value
Port Number 1
Port Name SHRFAX:
Monitor Name Microsoft Shared Fax Monitor
Description Puerto para supervisión de fax
Port Type Can write, Cannot read

COM1:
Item Value
Port Number 2
Port Name COM1:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

COM2:
Item Value
Port Number 3
Port Name COM2:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

COM3:
Item Value
Port Number 4
Port Name COM3:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

COM4:
Item Value
Port Number 5
Port Name COM4:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read
 FILE:
Item Value
Port Number 6
Port Name FILE:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

LPT1:
Item Value
Port Number 7
Port Name LPT1:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

LPT2:
Item Value
Port Number 8
Port Name LPT2:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

LPT3:
Item Value
Port Number 9
Port Name LPT3:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

PORTPROMPT:
Item Value
Port Number 10
Port Name PORTPROMPT:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

nul:
Item Value
Port Number 11
Port Name nul:
Monitor Name Local Monitor
Description Puerto local
Port Type Can write, Can read

Favor resolver las anteriores preguntas y elabore un informe de auditoría tome como base el
Formato de Auditoria publicado en el blog. Grupo de 2 personas.