Web Proxy Auto-Discovery (WPAD) Security Bundle

Description

This dashboard addresses "aPAColypse now", a novel attack approach which chains multiple Windows vulnerabilities together as well as takes advantage of default Web Proxy Auto-discovery (WPAD) behavior. The attack approach is detailed here.

Installation Instructions

Load the bundle onto your Discover appliance.

Before using, please modify the trigger to whitelist the following (detailed instructions are included within the trigger):

• Approved DNS, HTTP, and DHCP server networks
  • Approved WPAD URI FQDNs

Once modified, assign the trigger to the DNS, HTTP, and DHCP clients which you would like to monitor.