WPAD Vulnerability Fix

1. Disable LLMNR via GPO
2. Startup Script to disable NetBios

$regkey = "HKLM:SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces"

Get-ChildItem $regkey |foreach { Set-ItemProperty -Path "$regkey\$($_.pschildname)" -Name NetbiosOptions -Value 2 -Verbose}

3. Enable SMB Signing (Test this with a small batch of computers and note that it won’t take effect until a reboot. Should encounter any issues unless they have older systems like Vista and 2003. Here is the reference article: https://blogs.technet.microsoft.com/josebda/2010/12/01/the-basics-of-smb-signing-covering-both-smb1-and-smb2/)
4. Add DNS Entry
   1. Check block list: dnscmd /info /GlobalQueryBlockList
   2. remove wapd and make sure isatap is still in the list: dnscmd /config /GlobalQueryBlockList isatap
   3. Created DNS A record for wpad pointing to the internal IP address of the sonicwall firewall
5. Create Sonicwall rule to drop wpad request
   1. Navigate to Firewall | Match Objects and click on “Add New Match Object”.
   2. Set Match Object Type to “Custom”.
   3. Match type : exact match
   4. Content wpad.dat
   5. Navigate to Firewall | App Rules.
   6. Create an app rule using the match object to drop the connection