PROJECT TOPIC NAME

Exploring Latest
Windows Vulnerabilities and Exploits

CDAC, Noida
CYBER GYAN VIRTUAL INTERNSHIP
PROGRAM

Submitted By:
SAUMYA SARNGAL
Project Trainee, (JAN-MARCH) 2025
 BONAFIDE CERTIFICATE
This is to certify that this project report entitled
Exploring Latest Windows Vulnerabilities and Exploits
submitted to CDAC Noida, is a Bonafede record of work
done by Saumya Sarngal under my supervision from 20
March to 8 March 2025
 Declaration by Author(s)
This is to declare that this report has been written by
me/us. No part of the report is plagiarized from other
sources. All information included from other sources
have been duly acknowledged. I/We aver that if any part
of the report is found to be plagiarized, I/we are shall
take full responsibility for it.

Name of Author(S): Saumya Sarngal

 TABLE OF CONTENTS
1. Introduction ............................................................ 1
1.1 Problem addressed ............................................... 1
1.1.1 ............................................................................ 3
1.1.2 ............................................................................ 5
1.2 Related literature .................................................. 7
1.2.1 ............................................................................ 7
1.2.2 ............................................................................ 9
1.2.3 ........................................................................... 10
 ACKNOWLEDGEMENT
I would like to express my sincere
gratitude to everyone who contributed to
the completion of this presentation.
First and foremost, I extend my heartfelt
thanks to Varun Sir for their invaluable
guidance and support throughout this
project. Their insights and feedback have
been instrumental in shaping the content.
PROBLEM STATEMENT:
This project aims to delve into recent known
vulnerabilities affecting Windows operating systems
and explore their exploitation methods. By analyzing
these vulnerabilities and understanding how they can
be exploited, students will gain insights into the
importance of vulnerability management and security
patching in cybersecurity.
Learning Objective
1. Understand Common Windows Vulnerabilities –
Learn about security flaws that affect Windows OS,
including unpatched software, weak authentication,
and malware threats.
2. Explore Exploitation Techniques – Gain insights into
how attackers exploit system weaknesses through
malware, phishing, and privilege escalation.
3. Learn About Security Patch Management –
Understand the importance of timely updates and
patching to prevent known exploits.
4. Identify Risk Mitigation Strategies – Develop skills
to implement best practices such as firewalls, strong
authentication, and endpoint protection to secure
systems.
5. Enhance Network Security Awareness – Learn about
securing remote access (e.g., RDP security) and
protecting against network-based attacks.
[Link] Cybersecurity Best Practices – Learn
how to apply security frameworks, access controls, and
backup strategies to strengthen Windows system
defenses.
APPROACH:
 Vulnerability Databases (e.g., CVE, NVD) for
identifying known vulnerabilities.
 Exploit Frameworks (e.g., Metasploit, Exploit-DB)
for exploring exploit techniques.
 Virtualization Software (e.g., VMware,
VirtualBox) for setting up vulnerable Windows
environments.
 Network Sniffing Tools (e.g., Wireshark) for
analyzing exploit traffic.
 Security Blogs and Forums for staying updated
on recent vulnerabilities and exploits.
IMPLEMENTATION:
Step 1: Identify and Analyze Vulnerabilities
 Use tools like Microsoft Security Scanner, Nessus,
or OpenVAS to detect known vulnerabilities.
 Check for missing Windows security updates via
Settings > Update & Security > Windows Update.
 Look at Common Vulnerabilities and Exposures
(CVE) reports related to Windows.
Step 2: Check for Exploitation Attempts
 Use Windows Event Viewer ([Link]) to
analyze logs under:
o Security (Event ID 4625 for failed logins, Event
ID 4673 for privilege escalation).
o System logs for unusual system crashes.
 Monitor network traffic using Wireshark for
suspicious activity.
Step 3: Patch and Secure the System
 Update Windows via Settings > Update & Security.
 Patch third-party software like browsers, Java, and
Adobe software.
 Enable Windows Defender or install an antivirus
and perform a full system scan.
Step 4: Secure User Authentication & Access Control
 Implement Multi-Factor Authentication (MFA).
 Use strong password policies ([Link] >
Computer Configuration > Windows Settings >
Security Settings).
 Restrict admin privileges using User Account
Control (UAC).
Step 5: Strengthen Network Security
 Disable unused ports and services via Windows
Firewall ([Link]).
 Configure Remote Desktop Protocol (RDP) to allow
only authorized users.
 Set up Intrusion Detection Systems (IDS) like Snort.
Step 6: Perform Incident Response (If Attack Has
Occurred)
 Isolate infected machines from the network.
 Use Windows Defender Offline Scan for malware
removal.
 Restore the system from a secure backup.

Indicators of Compromise (IoCs) After an Attack

1. Unusual System Behavior
  Slow system performance without a known
reason.
 Unexpected reboots or crashes.
2. Unauthorized Access & Privilege Escalation
 Unrecognized user accounts appearing in Local
Users and Groups.
 Event ID 4624 (Logon Success) for unusual
accounts in Event Viewer.
3. Suspicious Network Activity
 Unexpected outbound connections to unknown
IPs (netstat -ano).
 High CPU and network usage due to malware
(check in Task Manager).
4. File Integrity Issues
 Unauthorized file modifications or deletions.
 Presence of ransomware notes (e.g., .txt files
demanding payment).
5. Presence of Malware or Rootkits
 Unknown processes running in Task Manager
(taskmgr).
 Hidden scheduled tasks (schtasks /query /fo LIST).
CONCLUSION & RECOMMENDATIONS:
To mitigate vulnerabilities and prevent attacks on
Windows operating systems, the following solutions
and countermeasures can be implemented:
1. Regular Security Patching & Updates
 Keep Windows OS and all installed software up to
date.
 Enable automatic updates to ensure timely
patching of vulnerabilities.
2. Implement Strong Authentication Measures
 Enforce strong password policies (minimum
length, complexity, expiration).
 Use Multi-Factor Authentication (MFA) to add an
extra layer of security.
3. Improve Network Security
 Disable unnecessary network services and ports.
  Use firewalls (Windows Defender Firewall or third-
party firewalls) to monitor and control network
traffic.
 Implement Virtual Private Networks (VPNs) for
secure remote access.
4. Enhance Endpoint Security
 Install and maintain reputable antivirus and anti-
malware software.
 Enable Windows Defender and configure it for
real-time protection.
5. Secure Remote Desktop Protocol (RDP)
 Disable RDP if not needed or restrict access using
VPNs and firewalls.
 Enforce Network Level Authentication (NLA) for
RDP connections.
6. Train Users on Cybersecurity Best Practices
 Conduct regular cybersecurity awareness training
to help users recognize phishing attempts and
social engineering attacks.
 Implement policies against downloading files from
untrusted sources.
7. Use Application Whitelisting
  Allow only trusted applications to run using
Windows AppLocker or Microsoft Defender
Application Control.
8. Implement Access Control & Least Privilege Principle
 Restrict admin privileges to only necessary users
and processes.
 Use Role-Based Access Control (RBAC) to limit
system access.
9. Enable System & Network Monitoring
 Use Security Information and Event Management
(SIEM) tools to detect unusual activity.
 Enable Windows Event Logging to track security
incidents.
10. Backup Critical Data Regularly
 Maintain regular offline and cloud backups to
recover from ransomware or system failures.
 Use automated backup solutions with encryption
for security.
LIST OF REFERENCES:
1. Common Vulnerabilities and Exposures (CVE)
Database: CVE
2. National Vulnerability Database (NVD): NVD
3. Metasploit Framework: Metasploit
4. Exploit Database (Exploit-DB): Exploit-DB
5. VMware Workstation: VMware Workstation
6. Wireshark: Wireshark