{"id":8568,"date":"2020-08-05T14:33:45","date_gmt":"2020-08-05T12:33:45","guid":{"rendered":"http:\/\/tajdini.net\/blog\/?p=8568"},"modified":"2026-01-13T01:47:05","modified_gmt":"2026-01-12T23:47:05","slug":"digital-forensics-and-incident-response","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/dfir-and-incident-response\/digital-forensics-and-incident-response\/","title":{"rendered":"Digital Forensics and Incident Response"},"content":{"rendered":"\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.jaiminton.com\/cheatsheet\/DFIR\/#introduction\">Introduction<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disclaimer\">Disclaimer<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#artifact-locations\" class=\"\">Artifact locations<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#get-an-object-of-forensic-artifacts\">Get an object of forensic artifacts<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#query-object-for-relevant-registry-keys\" class=\"\">Query object for relevant registry keys:<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#query-object-for-relevant-file-paths\">Query object for relevant file paths:<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#windows-cheat-sheet\" class=\"\">Windows Cheat Sheet<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#order-of-volatility\" class=\"\">Order of Volatility<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#memory-files-locked-by-os-during-use\">Memory Files (Locked by OS during use)<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#binalyze-irec-evidence-collector-gui-or-commandline\">Binalyze IREC Evidence Collector (GUI or CommandLine)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#belkasoft-live-ram-capturer\">Belkasoft Live RAM Capturer<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#redline\">Redline<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#memoryze\">Memoryze<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#comae-dumpit\">Comae DumpIT<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#magnet-forensics-mostly-gui\">Magnet Forensics (Mostly GUI)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#volexity-surge\">Volexity Surge<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#microsoft-livekd\">Microsoft LiveKd<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#winpmem\">Winpmem<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#imaging-live-machines\">Imaging Live Machines<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#ftk-imager-cmd-version-mostly-gui-for-new-versions\">FTK Imager (Cmd version, mostly GUI for new versions)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dd\">DD<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#x-ways-imager\">X-Ways Imager<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#encase-forensic\">Encase Forensic<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#tableau-imager\">Tableau Imager<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#guymager\">Guymager<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#live-windows-irtriage\" class=\"\">Live Windows IR\/Triage<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#interact-with-remote-machine\">Interact with remote machine<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#system-information\">System information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-list-of-all-files-on-a-computer\">Obtain list of all files on a computer<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#user-and-admin-information\">User and admin information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#logon-information\">Logon information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#nt-domainnetwork-client-information\">NT Domain\/Network Client Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#firewall-information\">Firewall Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#firewall-changes\">Firewall Changes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#pagefile-information\">Pagefile information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#group-and-access-information\">Group and access information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#cookies\">Cookies<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recentdocs-information\">RecentDocs Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#startup-process-information\">Startup process information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#startup-process-information-by-pathfile-name\">Startup process information by path\/file name<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scheduled-taskjob-information\">Scheduled task\/job information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#remediate-malicious-scheduled-tasks\">Remediate malicious scheduled tasks<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#uac-bypass-fodhelper\">UAC Bypass Fodhelper<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#quick-overview-of-persistent-locations-autoruns\">Quick overview of persistent locations (AutoRuns)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#persistence-and-automatic-loadrun-reg-keys\">Persistence and Automatic Load\/Run Reg Keys<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1015-accessibility-features\">T1015 Accessibility Features<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1098-account-manipulation\">T1098 Account Manipulation<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1182-appcert-dlls\">T1182 AppCert DLLs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1103-appinit-dlls\">T1103 AppInit DLLs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1138-application-shimming\">T1138 Application Shimming<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1197-bits-jobs\">T1197 BITS Jobs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1067-bootkit\">T1067 Bootkit<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#general-driver-enumeration\">General Driver Enumeration<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#unsigned-drivers\">Unsigned Drivers<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#unload-malicious-filter-driver\">Unload malicious filter driver<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1176-browser-extensions\">T1176 Browser Extensions<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#chrome\">Chrome<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#firefox\">Firefox<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#edge\">Edge<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#internet-explorer\">Internet Explorer<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1109-component-firmware\">T1109 Component Firmware<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1122-component-object-model-com-hijacking\" class=\"\">T1122 Component Object Model (COM) Hijacking<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#get-list-of-all-com-objects\">Get list of all COM Objects<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1136-create-account\">T1136 Create Account<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1038-dll-search-order-hijacking\">T1038 DLL Search Order Hijacking<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1133-external-remote-services\">T1133 External Remote Services<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1044-file-system-permissions-weakness\">T1044 File System Permissions Weakness<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1158-hidden-files-and-directories\">T1158 Hidden Files and Directories<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1179-hooking\">T1179 Hooking<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#finding-easyhook-injection\">Finding EasyHook Injection<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1062-hypervisor\">T1062 Hypervisor<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1183-image-file-execution-options-injection\">T1183 Image File Execution Options Injection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1037-logon-scripts\">T1037 Logon Scripts<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1177-lsass-driver\">T1177 LSASS Driver<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1031-modify-existing-service\">T1031 Modify Existing Service<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1128-netsh-helper-dll\">T1128 Netsh Helper DLL<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1050-new-service\">T1050 New Service<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1137-office-application-startup\" class=\"\">T1137 Office Application Startup<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1034-path-interception\">T1034 Path Interception<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1013-port-monitors\">T1013 Port Monitors<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1504-powershell-profile\">T1504 PowerShell Profile<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1108-redundant-access\">T1108 Redundant Access<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1060-registry-run-keys--startup-folder\">T1060 Registry Run Keys \/ Startup Folder<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1053-scheduled-task\">T1053 Scheduled Task<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1180-screensaver\">T1180 Screensaver<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1101-security-support-provider\">T1101 Security Support Provider<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1505-server-software-component\">T1505 Server Software Component<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1058-service-registry-permissions-weakness\">T1058 Service Registry Permissions Weakness<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1023-shortcut-modification\">T1023 Shortcut Modification<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1198-sip-and-trust-provider-hijacking\">T1198 SIP and Trust Provider Hijacking<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1019-system-firmware\">T1019 System Firmware<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1209-time-providers\">T1209 Time Providers<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1078-valid-accounts\">T1078 Valid Accounts<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1100-web-shell\">T1100 Web Shell<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1084-windows-management-instrumentation-event-subscription\">T1084 Windows Management Instrumentation Event Subscription<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#get-wmi-namespaces\">Get WMI Namespaces<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#query-wmi-persistence\">Query WMI Persistence<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1004-winlogon-helper-dll\">T1004 Winlogon Helper DLL<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#other---winsock-persistence\">Other &#8211; Winsock Persistence<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-disabled-task-manager-often-from-malware\">Check disabled task manager (often from malware)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#review-hivelist\">Review Hivelist<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-all-user-registry-keys\">Locate all user registry keys<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#load-all-users-registry-keys-from-their-ntuserdat-file-perform-above-first\">Load all users registry keys from their ntuser.dat file (perform above first)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#query-all-users-run-key\">Query all users run key<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#unload-all-users-registry-keys\">Unload all users registry keys<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#remediate-automatic-loadrun-reg-keys\">Remediate Automatic Load\/Run Reg Keys<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-registry-for-ie-enhanced-security-modification\">Check Registry for IE Enhanced Security Modification<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-registry-for-disabling-of-uac-1uac-disabled\">Check Registry for disabling of UAC (1=UAC Disabled)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#review-software-keys-for-malicious-entries\">Review Software Keys for malicious entries<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scan-registry-keys-for-specified-text\">Scan Registry keys for specified text<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#persistent-file-locations-of-interest\">Persistent file locations of interest<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-lnk-files-with-a-particular-string-special-thanks-to-the-notorious\">Locate LNK Files with a particular string (Special thanks to the notorious)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#master-file-table\">Master File Table<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#determine-timestomping\">Determine Timestomping<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#enable-date-accessed-timestamps\">Enable Date Accessed Timestamps<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#remove-bitsadmin-persistence\">Remove BITSAdmin Persistence<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-system-directories-for-executables-not-signed-as-part-of-an-operating-system-release\">Check system directories for executables not signed as part of an operating system release<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-possible-trickbot\">Locate Possible Trickbot<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#determine-if-user-trusted-a-docspreadsheet-etc-and-ran-a-macro\">Determine if user Trusted a doc\/spreadsheet etc and ran a macro<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-office-security-settings\">Check Office Security Settings<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-outlook-temporary-files\">Check Outlook Temporary Files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-ms-office-logs-for-high-risk-file-names\">Check MS Office Logs for high risk file names<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#prevent-cve-2017-11882-cve-2018-0802-cve-2018-0804-cve-2018-0805-cve-2018-0806-cve-2018-0807-eqnedt32exe-exploitation\">Prevent CVE-2017-11882, CVE-2018-0802, CVE-2018-0804, CVE-2018-0805, CVE-2018-0806, CVE-2018-0807 (EQNEDT32.EXE) Exploitation<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#determine-if-user-opened-a-document\">Determine if user opened a document<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#prevent-executable-from-running\">Prevent Executable from Running.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#show-known-file-extensions-and-hidden-files-excluding-os-hidden-files\">Show known file extensions and hidden files (excluding OS hidden files)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#open-file-extension-eg-scripts-with-certain-application-elevated-cmd\">Open File Extension (e.g. scripts) with certain application (elevated cmd)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-command-prompt\">Disable Command Prompt<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-possible-dll-search-order-hijacking\">Locate Possible DLL Search Order Hijacking<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#search-order-for-desktop-applications\">Search order for desktop applications:<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-possible-dll-side-loading\">Locate Possible Dll Side Loading<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#unique-sideload-dll-hashes-may-take-some-time\">Unique Sideload DLL hashes (may take some time)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#unsigned-or-invalid-sideload-dlls-there-will-be-a-lot\">Unsigned or Invalid Sideload DLLs (there will be a lot)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#unsigned-sideload-dlls-less-noise\">Unsigned Sideload DLLs (Less noise)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#hash-of-unsigned-sideload-dlls\">Hash of Unsigned Sideload DLLs<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-files-without-extensions\">Find files without extensions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#remediate-malicious-files\">Remediate malicious files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#detect-persistent-wmi-subscriptions\">Detect Persistent WMI Subscriptions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#remediate-persistent-wmi-subscriptions\">Remediate Persistent WMI Subscriptions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#enumerate-wmi-namespaces\">Enumerate WMI Namespaces<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#mimikatzcredential-extraction-detection\">Mimikatz\/Credential Extraction Detection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#netntlm-downgrade-attack-detection\" class=\"\">NetNTLM Downgrade Attack Detection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#putty-detection\">Putty Detection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#installed-updates\">Installed Updates<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#installed-softwarepackages\">Installed Software\/Packages<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-information\" class=\"\">Process information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#current-process-execution-or-module-loads-from-temporary-directories\">Current Process execution or module loads from temporary directories<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#current-process-execution-or-module-loads-from-temporary-directories--hash\">Current Process execution or module loads from temporary directories + hash<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scan-for-malware-with-windows-defender\">Scan for malware with Windows Defender<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-windows-defender-for-excluded-files-and-default-actions\">Check Windows Defender for excluded files and default actions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#delete-windows-defender-excluded-files\">Delete Windows Defender excluded files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-and-set-access-control-lists\">Check and Set Access Control Lists<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#change-ace-for-everyone-on-folder-and-subfilesfolders\" class=\"\">Change ACE for \u201ceveryone\u201d on folder and subfiles\/folders<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#grant-everyone-full-access\">Grant everyone full access<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#remove-ace-entries-for-everyone\" class=\"\">Remove ACE entries for \u201ceveryone\u201d<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-unwanted-windows-binaries-via-base64-encoding-and-removal\">Disable unwanted windows binaries (via Base64 encoding and removal)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#enable-windows-binaries-via-base64-decoding-and-removal\">Enable windows binaries (via Base64 decoding and removal)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#make-multiple-files-visible-and-remove-superhidden\">Make multiple files visible and remove \u2018superhidden\u2019<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-security-descriptor-definition-language-sddl-and-access-control-entries-ace-for-services\">Check Security Descriptor Definition Language (SDDL) and Access Control Entries (ACE) for services<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#kill-unstoppable-serviceprocess\">Kill \u201cUnstoppable\u201d Service\/Process<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-hash-for-all-running-executables\">Obtain hash for all running executables<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-hash-and-established-network-connections-for-running-executables-with-dns-cache\">Obtain hash and established network connections for running executables with dns cache<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-hash-and-listening-network-connections-for-running-executables\">Obtain hash and listening network connections for running executables<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-hash-and-possible-tunneled-network-connections-for-running-executables\">Obtain hash and possible tunneled network connections for running executables<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-workstation-name-for-tunneled-authentication\">Obtain workstation name for tunneled authentication<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-hash-of-dlls-currently-loaded-by-processes\">Obtain hash of DLLs currently loaded by processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-processes-where-binaries-file-version-doesnt-match-os-release\">Obtain processes where binaries file version doesn\u2019t match OS Release<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-process-binary-file-external-names\">Obtain process binary file external names<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-processes-running-which-are-running-a-dll\">Obtain processes running which are running a DLL<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-hash-of-unsigned-or-invalid-dlls-currently-loaded-by-processes\">Obtain hash of unsigned or invalid DLLs currently loaded by processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-list-of-unsigned-dlls-currently-loaded-by-processes\">Obtain list of unsigned DLLs currently loaded by processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-dll-information-listdlls\">Obtain DLL information ListDLLs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-unsigned-dll-information-loaded-by-processes\">Obtain unsigned DLL information loaded by processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-dlls-in-use-by-processes\">Obtain DLLs in use by processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#determine-handles-on-a-file\">Determine handles on a file<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#verify-eternalblue-patch-ms17-010-is-installed---microsoft\">Verify EternalBlue Patch (MS17-010) is installed &#8211; Microsoft<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-txt-records-from-recently-resolved-domains\">Obtain TXT records from recently resolved domains<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-all-appdata-files-for-unsigned-or-invalid-executables\">Check all Appdata files for unsigned or invalid executables<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-for-execuables-in-local-system-user-profile-and-files\">Check for execuables in Local System User Profile and Files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#investigate-wmi-usage\">Investigate WMI Usage<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-executables-and-scripts-in-path-directories-envpath\">Find executables and scripts in Path directories ($env:Path)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-files-createdwritten-based-on-date\">Find files created\/written based on date<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-running-executables-for-malware-via-virustotal\">Check running executables for malware via VirusTotal<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scan-systems-for-ioaioc-yara\">Scan systems for IOA\/IOC (Yara)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#kill-malicious-process\">Kill malicious process<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dump-full-process-memory\">Dump full process memory<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#live-triage-of-memory\">Live Triage of Memory<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-possible-shellcode-within-process-via-injected-thread\">Locate Possible Shellcode within process via Injected Thread<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-possible-shellcode-within-process-as-hex\">Obtain Possible Shellcode within process as Hex<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-possible-shellcode-within-process-as-hex-1\">Obtain Possible Shellcode within process as Hex<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#basic-memory-analysis-via-powershellarsenal\">Basic Memory Analysis via PowerShellArsenal<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-possible-shellcode-address-space\">Locate Possible Shellcode Address Space<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-meterpreter-in-process-memory\">Find Meterpreter in Process Memory:<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-cobalt-strike-in-process-memory\">Find Cobalt Strike in Process Memory:<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#network-connections\">Network connections<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#routing-table-and-arp-cache\">Routing table and ARP cache<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#contents-of-dns-resolver\">Contents of DNS resolver<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#enable-dns-logging\">Enable DNS Logging<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scan-dns-logs\">Scan DNS Logs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scan-dns-logs-and-output-unique-dns-queries\">Scan DNS Logs and output unique DNS Queries<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#hostname-to-corresponding-ips-from-list\">Hostname to corresponding IPs from list<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#t1074-data-staging\">T1074 Data Staging<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#latest-system-activities\">Latest system activities<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#driver-information\">Driver information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-and-extra-information\">Process and extra information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#hosts-file-and-serviceport-mapping\">Hosts file and service>port mapping<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recycle-bin-forensics\">Recycle Bin Forensics<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dcom-information\">DCOM Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#service-information\">Service Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#stop-and-disabledelete-malicious-service\">Stop and disable\/delete malicious service<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-internet-explorer\">Disable Internet Explorer<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#cmd-history\">cmd history<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#files-greater-than-a-10mb\">Files greater than a 10mb<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#temp-files-greater-than-10mb\">Temp files greater than 10mb<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-process-handles-eg-files-open-by-process\">Locate process handles (e.g. files open by process)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#close-process-handles-eg-files-open-by-process\">Close process handles (e.g. files open by process)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#event-logs-between-a-timeframe\">Event logs between a timeframe<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-audit-policies\">Check audit policies<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#set-logging-on-all-successfailure-events\">Set logging on all success\/failure events<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#enable-logging-of-process-creation\">Enable logging of process creation<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scan-process-creation-logs-for-appdata\">Scan process creation logs for \u2018appdata\u2019<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-for-windows-security-logging-bypass\">Check for Windows Security Logging Bypass<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-group-policies\">Check group policies<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#obtain-mode-settings-for-ports\">Obtain mode settings for ports<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#event-logs-for-offline-analysis\">Event Logs for offline analysis<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#quickly-scan-event-logs-with-deepbluecli\">Quickly scan event logs with DeepblueCLI<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#event-tracing-for-windows-etw\">Event Tracing for Windows (ETW).<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#list-running-trace-sessions\">List Running Trace Sessions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#list-providers-that-a-trace-session-is-subscribed-to\">List Providers That a Trace Session is Subscribed to<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#list-all-etw-providers\">List all ETW Providers<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#view-providers-process-is-sending-events-to\">View providers process is sending events to<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#setup-custom-log-tracing\">Setup Custom Log Tracing<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#query-providers-available-and-their-keyword-values\">Query Providers Available and their keyword values<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#initiate-tracing-session\">Initiate Tracing Session<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#update-trace-with-wanted-providers\">Update trace with wanted providers<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#delete-subscription-and-providers\">Delete Subscription and Providers<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#event-logtracing-tampering-detection\">Event Log\/Tracing Tampering Detection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#timeline-windows-event-logs\">Timeline Windows Event Logs.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#super-timeline-a-host\">Super Timeline a host:<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#security-log-information\">Security log information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#logon-type-information\">Logon type information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#special-logon-information-4672\">Special logon information (4672)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#system-log-information\">System log information:<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#sysmon-log-information\">Sysmon log information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#active-directory-investigation\">Active Directory Investigation<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#nt-directory-services-directory-information-tree-file-ntdsdit\">NT Directory Services Directory Information Tree File (ntds.dit)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#edblog\">Edb.log<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#edbxxxxxlog\">Edbxxxxx.log<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#edbchk\">Edb.chk<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#resxlogresxjrs\">Resx.log\/Resx.jrs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#tempedb\">Temp.edb<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#schemaini\">Schema.ini<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#investigation-of-ntdsdit\">Investigation of ntds.dit<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#origami-pdf-malicious-pdf-analysis\">Origami-PDF (Malicious PDF Analysis)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#more-malicious-pdfdoc-analysis\">More Malicious PDF\/Doc Analysis<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#exiftool-image-analysis\">Exiftool (Image Analysis)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#rdp-cache-images\">RDP Cache images<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#rdp-terminal-services-activity\">RDP (Terminal Services) Activity<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#rdp-terminal-services-configuration\">RDP (Terminal Services) Configuration<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-if-terminal-services-enabled\">Check if Terminal Services Enabled<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-if-one-session-per-user-has-been-modified\">Check if one session per user has been modified<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-if-port-number-has-been-modified\">Check if port number has been modified<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#host-firewall-information\">Host Firewall information:<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#model-of-motherboard-and-hardware-information\">Model of motherboard and hardware information:<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#monitoring-of-open-files\">Monitoring of open files:<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-bitlocker-encryption\">Check Bitlocker Encryption<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#list-open-files\">List open files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#display-proxy-information\">Display proxy information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disconnect-open-files-based-on-username\">Disconnect open files based on username:<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#powershell-commands\">Powershell Commands<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#service-information-1\">Service information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#view-named-pipes\">View Named Pipes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#harden-system-from-lateral-movement\">Harden System from Lateral Movement<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-remote-interaction-with-services\">Disable remote interaction with services<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-remote-interaction-with-scheduled-tasks\">Disable remote interaction with scheduled tasks<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-rdp-access\">Disable RDP access<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-dcom\">Disable DCOM<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-admin-shares\">Disable Admin Shares<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#stop-server-responsible-for-inter-process-communication-calls\">Stop Server Responsible for Inter-process Communication Calls<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#delete-admin-shares\">Delete Admin Shares<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-anonymous-access-to-named-pipes\">Disable Anonymous Access to Named Pipes<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-wmi-objects\">Process WMI objects<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-information-1\">Process information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#baseline-processes-and-services\">Baseline processes and services<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#view-and-interact-with-shadow-copies-must-be-run-from-elevated-cmdexe\">View and interact with shadow copies (MUST BE RUN FROM ELEVATED CMD.exe)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#create-shadow-copy-for-c-drive\">Create Shadow Copy for C: drive<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#other-shadow-copy-techniques\">Other Shadow Copy Techniques<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#tcp-connections\">TCP Connections<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#list-of-ipv4-addresses-who-have-connected-rdp\">List of IPV4 addresses who have connected (RDP)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#powershell-logs\">Powershell logs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#event-logs-available\">Event logs available<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#event-logs-per-application-source\">Event Logs per Application Source<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#event-logs-per-severity-source\">Event Logs per Severity Source<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#critical-logs\">Critical Logs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#error-logs\">Error Logs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#warning-logs\">Warning Logs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#information-logs\">Information Logs<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#live-event-log-filtering\">Live Event Log Filtering<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-authenticating-userasset-for-remote-service-creation-lateral-movement\">Find Authenticating user\/asset for remote service creation (lateral movement)<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#locate-possible-kerberoastkerberos-based-attacks\">Locate possible Kerberoast\/Kerberos based attacks<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#extract-useful-fields-from-legacy-logs\">Extract useful fields from Legacy Logs<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-user-authenticating\">Find User Authenticating<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-ipport-authenticating\">Find IP\/Port Authenticating<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#remote-desktop-lateral-movement-detection-destinations\">Remote Desktop Lateral Movement Detection (Destinations)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#map-network-shares-lateral-movement-detection-destinations\">Map Network Shares Lateral Movement Detection (Destinations)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#psexec-lateral-movement-detection-destinations\">PsExec Lateral Movement Detection (Destinations)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scheduled-tasks-lateral-movement-detection-destinations\">Scheduled Tasks Lateral Movement Detection (Destinations)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#services-lateral-movement-detection-destinations\">Services Lateral Movement Detection (Destinations)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#wmiwmic-lateral-movement-detection-destinations\">WMI\/WMIC Lateral Movement Detection (Destinations)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#powershell-lateral-movement-detection-destinations\">PowerShell Lateral Movement Detection (Destinations)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#extra-information\">Extra Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#user-accounts-and-logon-information\">User accounts and logon information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#share-information\">Share information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#list-alternate-data-streams-in-current-dir-and-view-them\">List Alternate Data Streams in current Dir and view them<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#list-alternate-data-streams-in-text-files-within-appdata\">List Alternate Data Streams in text files within AppData<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#use-alternate-data-streams-to-find-download-location\">Use Alternate Data Streams to find download location<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#general-notes\">General Notes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#gather-artifacts\">Gather artifacts<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#powershell-execution-log\">Powershell execution log<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#analyse-document-for-macros\">Analyse document for macros<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#capture-powershell-memdump-and-analyse\">Capture powershell memdump and analyse<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recent-execution-of-programs\">Recent execution of programs<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#windows-indexing-service\">Windows Indexing Service<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#programs-accessing-windows-features-such-as-webcam-and-microphone\">Programs Accessing Windows Features such as Webcam and Microphone<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#all-windows-features-including-start-and-stop-timestamps\">All Windows Features Including Start and Stop Timestamps<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#programs-using-webcam\">Programs Using Webcam<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#programs-using-microphone\">Programs Using Microphone<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#usn-journal-any-changes-to-ntfs-volume\">USN Journal (any changes to NTFS volume)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#link-file-analysis\">Link File Analysis<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#jump-lists-analysis\">Jump Lists Analysis<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#srum-analysis\">SRUM Analysis<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#background-activity-moderator-bamdam\">Background Activity Moderator (BAM\/DAM)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#windows-10-mail-app-forensics\">Windows 10 Mail App Forensics<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#capture-packets-with-netsh\">Capture packets with netsh<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#capture-packets-with-powershell\">Capture Packets with PowerShell<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#stop-capturing-packets-with-powershell\">Stop Capturing Packets with PowerShell<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#convert-etl-file-to-pcap\">Convert ETL File to PCAP<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#ntuserdat-important-registry-entries\">NTUSER.DAT Important Registry entries:<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recent-execution-of-programs-gui\">Recent execution of programs (GUI)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recent-appslast-visited-mru\">Recent Apps\/Last Visited MRU<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#execution-of-sysinternals-tool\">Execution of Sysinternals Tool<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recent-internet-explorer-history\">Recent Internet Explorer History<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recent-chrome-history\">Recent Chrome History<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recent-firefox-history\">Recent Firefox History<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recent-edge-history\">Recent Edge History<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-root-certificate-store\">Check Root Certificate Store<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#thumbnail-cache\">Thumbnail Cache<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#shellbags\">Shellbags<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#usrclassdat-shellbags\">UsrClass.dat Shellbags<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#usb-information\">USB Information<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#software-hive-registry-entries\">SOFTWARE Hive Registry Entries<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#common-startup-locations\">Common startup locations<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#network-information\">Network Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#gather-wifi-passwords\">Gather WiFi Passwords<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#networks-connecteddisconnected-tofrom-and-mac-address\">Networks connected\\disconnected to\\from and mac address<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#get-host-mac-addresses\">Get host Mac Addresses<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#lookup-mac-addressorganizationally-unique-identifier-oui\">Lookup MAC Address\/Organizationally Unique Identifier (OUI)<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#useful-wireshark-filters\">Useful Wireshark filters<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#all-traffic-to-or-from-an-ip\">All traffic to or from an IP<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#all-tcp-traffic-on-a-port\">All TCP traffic on a port<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#all-traffic-from-an-ip\">All traffic from an IP<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#all-traffic-to-an-ip\">All traffic to an IP<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#http-or-dns-traffic\">HTTP or DNS Traffic<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#clientdc-traffic-filtering-noise\">Client>DC traffic filtering noise<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#tcp-issues-flags\">TCP issues (flags)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#tcp-protocol-flags-present\">TCP protocol flags (present)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#encrypted-traffic\">Encrypted Traffic<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#follow-tcp-stream\">Follow TCP Stream<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#tcp-packets-for-string\">TCP packets for string<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#http-codes\">HTTP codes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#user-agent-withoutwith-case-sensitivity\">User agent, without\/with case sensitivity<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#addresses-on-subnet-by-iphostname\">Addresses on subnet by IP\/Hostname<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#wireshark-key-tips-and-tricks-by-brad-duncan\">Wireshark Key Tips and Tricks by Brad Duncan<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#decrypting-encrypted-packets\">Decrypting Encrypted Packets<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#system-hive-registry-entries\">SYSTEM Hive Registry Entries<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#usb-information-1\">USB Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#os-information\">OS Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#network-information-1\">Network Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#prefetch-information\">Prefetch Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#superfetch-information\">Superfetch Information<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#powershell-host-based-investigation-and-containment-techniques\">PowerShell Host Based Investigation and Containment Techniques<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#powerforensics\">PowerForensics<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#google-rapid-response\">Google Rapid Response<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#kansa-powershell-ir-framework\">Kansa PowerShell IR Framework<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#enable-ps-remoting-using-psexec\">Enable PS Remoting using PsExec<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#confirm-trusted-hosts-list-if-required\">Confirm trusted hosts list if required<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#quick-remote-response-no-auditlogging\">Quick Remote Response (no audit\/logging)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#setup-logging-for-ir\">Setup logging for IR<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#establish-remote-session\">Establish Remote Session<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#enter-or-exit-remote-session\">Enter or exit remote session<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#issuing-remote-commandshell\">Issuing remote command\/shell<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#retrievingdownloading-files\">Retrieving\/downloading files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#checking-for-running-processes\">Checking for running processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#query-registry-keys\">Query Registry Keys<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#pcap-collection\">PCAP collection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#blocking-a-domain\">Blocking a domain<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#blocking-an-ip\">Blocking an IP<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#unblocking-an-ip\">Unblocking an IP<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#quarantining-a-host-using-firewall\">Quarantining a host using Firewall<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#creating-an-ou-to-quarantine-a-host-into\">Creating an OU to quarantine a host into<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#moving-an-ad-object-into-a-quarantine-ou\">Moving an AD Object into a quarantine OU<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#quarantining-a-host-using-dcom\">Quarantining a host using DCOM<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#remove-a-quarantined-host\">Remove a quarantined host<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-admin-shares-1\">Disable Admin Shares<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#credentials-and-exposure\">Credentials and Exposure<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#kerberos-tickets-and-exposure\">Kerberos Tickets and Exposure<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#windows-memory-forensics\" class=\"\">Windows Memory Forensics<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#volatility-2x-basics\" class=\"\">Volatility 2.x Basics<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-out-what-profiles-you-have-available\">Find out what profiles you have available<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#find-out-the-originating-os-profile-to-be-used-from-the-memory-dump\">Find out the originating OS profile to be used from the memory dump.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#determine-what-plugins-are-available-for-use\">Determine what plugins are available for use.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-what-processes-were-running\" class=\"\">Check what processes were running.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-what-commands-have-been-run-and-their-output\">Check what commands have been run and their output.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dump-process-files-which-were-running-from-memory\">Dump process files which were running from memory.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dump-the-memory-associated-with-a-process-file\">Dump the memory associated with a process file.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dump-all-cached-files-from-memory\">Dump all cached files from memory.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-what-drivers-or-kernal-modules-were-unloaded-or-hidden\">Check what drivers or kernal modules were unloaded or hidden.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-what-network-connectivity-has-occurred\">Check what network connectivity has occurred.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-what-network-connectivity-has-occurred-windows-xpserver-2003\">Check what network connectivity has occurred (Windows XP\/Server 2003).<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-what-information-exists-within-registry-from-memory\">Check what information exists within registry from memory.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scan-memory-with-yara-rule\" class=\"\">Scan memory with Yara Rule<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#duplicate-image-space-out-as-a-raw-dd-file\">Duplicate image space out as a raw DD file<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dump-timelined-artifacts-from-memory\">Dump timelined artifacts from memory.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#detect-persistence-mechanisms-using-winesap\" class=\"\">Detect persistence mechanisms using Winesap<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#compare-memory-dump-to-known-good-memory-dump\">Compare memory dump to known good memory dump.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#output-visual-dot-file-to-view-process-tree\" class=\"\">Output visual .dot file to view process tree<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#volatility-3x-basics\" class=\"\">Volatility 3.x Basics<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-memory-image-information\">Check Memory Image Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-list-of-kernel-drivers\">Check List of Kernel Drivers<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-list-of-kernel-drivers-incl-previously-unloaded-and-hidden\">Check List of Kernel Drivers (incl previously unloaded and hidden)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dump-list-of-kernel-drivers-to-files\">Dump List of Kernel Drivers to Files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dump-list-of-running-processes-to-files\">Dump List of Running Processes to Files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-process-list-of-running-processes\">Check Process List of Running Processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-process-tree-of-running-processes\">Check Process Tree of Running Processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-running-processes-from-eprocess-blocks\">Check Running Processes from EPROCESS blocks<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-running-processes-for-possible-shellcodeinjection-via-page_execute_readwrite\">Check Running Processes for possible shellcode\/injection via PAGE_EXECUTE_READWRITE<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-processes-and-their-command-lines\">Check processes and their command lines<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#check-for-files-which-exist-in-memory\">Check for files which exist in memory<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#miscellaneous-tools-and-notes\" class=\"\">Miscellaneous Tools and Notes<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#regripper\">RegRipper<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#kape\">Kape<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#shimcaheparser\">ShimCaheParser<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#appcompatcacheparser\">AppCompatCacheParser<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#amcacheparser\">AmCacheParser<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#windows-10-timeline-database-parser\">Windows 10 Timeline Database Parser<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#bulk-extractor\">Bulk Extractor<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#forensicdots\" class=\"\">ForensicDots<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#cyber-chef\">Cyber Chef<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#urlscan\">URLScan<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#osquery\">OSQuery<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#velociraptor\">Velociraptor<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#vipermonkey\">ViperMonkey<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#parse-and-interpret-vba-macros\">Parse and interpret VBA macros<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#faster-output\">Faster output<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#less-verbose-output\">Less verbose output<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#xlm-macro-deobfuscator\">XLM Macro Deobfuscator<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#parse-and-interpret-hidden-xlm-macros-excel-40-macros\">Parse and interpret hidden XLM Macros (Excel 4.0 Macros)<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#mounting-image-files-in-linux\">Mounting image files in linux<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#mounting-image-files-in-windows\">Mounting image files in Windows<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#unpack-binary-packed-with-upx\">Unpack binary packed with UPX<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scan-exchange-for-phishing-emails\">Scan exchange for phishing emails<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#common-dll-information\">Common DLL Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#show-processes-with-networking-functions\">Show processes with networking functions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#show-processes-importing-the-remote-access-api\">Show processes importing the Remote Access API<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#show-processes-importing-the-task-scheduler-api\">Show processes importing the task scheduler API<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#show-processes-importing-the-windows-media-instrumentation-api\">Show processes importing the Windows Media Instrumentation API<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#windows-memory-analysis-example-process-with-volatility\">Windows Memory Analysis (Example Process with Volatility)<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#windows-memory-analysis-using-windbg\">Windows Memory Analysis using Windbg<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#normal-process-relationship-hierarchy-geneology\">Normal Process Relationship Hierarchy (Geneology)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#extra-notes\">Extra notes<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#linux-cheat-sheet\" class=\"\">Linux Cheat Sheet<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#dumping-memory\" class=\"\">Dumping Memory<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#taking-image\">Taking Image<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#misc-useful-tools\">Misc Useful Tools<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#live-triage\">Live Triage<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#system-information-1\">System Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#account-information\">Account Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#current-user\">Current user<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#last-logged-on-users\">Last logged on users<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#initialisation-files\">Initialisation Files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#environment-and-startup-programs\">Environment and Startup Programs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#scheduled-tasks\">Scheduled Tasks<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#ssh-keys-and-authorised-users\">SSH Keys and Authorised Users<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#sudoers-file-who-who-can-run-commands-as-a-different-user\">Sudoers File (who who can run commands as a different user)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#configuration-information\">Configuration Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#network-connections--socket-stats\">Network Connections \/ Socket Stats<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#ip-table-information\">IP Table Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#network-configuration\">Network Configuration<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#browser-plugin-information\">Browser Plugin Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#kernel-modules-and-extensions\">Kernel Modules and Extensions\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-information-2\">Process Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#search-files-recursively-in-directory-for-keyword\">Search files recursively in directory for keyword<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-tree\">Process Tree<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#open-files-and-space-usage\">Open Files and space usage<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#pluggable-authentication-modules-pam\">Pluggable Authentication Modules (PAM)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disk--partition-information\">Disk \/ Partition Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#system-calls--network-traffic\">System Calls \/ Network Traffic<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#detailed-process-information\">Detailed Process Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#recover-deleted-binary-which-is-currently-running\">Recover deleted binary which is currently running<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#capture-binary-data-for-review\">Capture Binary Data for Review<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#binary-hash-information\">Binary hash information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-command-line-information\">Process Command Line Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-environment-variables-incl-user-who-ran-binary\">Process Environment Variables (incl user who ran binary)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-file-descriptorsmaps-what-the-process-is-accessing-or-using\">Process file descriptors\/maps (what the process is \u2018accessing\u2019 or using)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-stackstatus-information-may-reveal-useful-elements\">Process stack\/status information (may reveal useful elements)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#deleted-binaries-which-are-still-running\">Deleted binaries which are still running<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#process-working-directories-including-common-targeted-directories\">Process Working Directories (including common targeted directories)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#hidden-directories-and-files\">Hidden Directories and Files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#immutable-files-and-directories-often-suspicious\">Immutable Files and Directories (Often Suspicious)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#suidsgid-and-sticky-bit-special-permissions\">SUID\/SGID and Sticky Bit Special Permissions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#file-and-directories-with-no-usergroup-name\">File and Directories with no user\/group name<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#file-types-in-current-directory\">File types in current directory<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#executables-on-file-system\">Executables on file system<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#hidden-executables-on-file-system\">Hidden Executables on file system<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#files-modified-within-the-past-day\">Files modified within the past day<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#persistent-areas-of-interest\">Persistent Areas of Interest<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#audit-logs\">Audit Logs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#installed-software-packages\">Installed Software Packages<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#macos-cheat-sheet\">MacOS Cheat Sheet<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#live-mac-ir--triage\">Live Mac IR \/ Triage<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#system-information-2\">System Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#network-connections-1\">Network Connections<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#routing-table\">Routing Table<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#network-information-2\">Network Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#open-files\">Open Files<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#file-system-usage\">File System Usage<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#bash-history\">Bash History<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#user-logins\" class=\"\">User Logins<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#running-processes\">Running Processes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#system-profiler\">System Profiler<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#persistent-locations\">Persistent Locations<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#quick-overview-knockknock\">Quick Overview (KnockKnock)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#xpc-services\">XPC Services<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#launch-agents--launch-daemons\">Launch Agents &amp; Launch Daemons<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#loginitems\">LoginItems<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disable-persistent-launch-daemon\">Disable Persistent Launch Daemon<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#web-browsing-preferences\">Web Browsing Preferences<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#safari-internet-history\">Safari Internet History<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#chrome-internet-history\">Chrome Internet History<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#firefox-internet-history\">Firefox Internet History<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#apple-email\">Apple Email<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#temporary--cached\">Temporary \/ Cached<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#system-and-audit-logs\">System and Audit Logs<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#specific-log-analysis\">Specific Log Analysis<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#files-quarantined\">Files Quarantined<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#user-accounts--password-shadows\">User Accounts \/ Password Shadows<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#pluggable-authentication-modules-pam-1\">Pluggable Authentication Modules (PAM)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#file-fingerprintingreversing\">File Fingerprinting\/Reversing<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#connected-disks-and-partitions\">Connected Disks and Partitions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#disk-file-image-information\" class=\"\">Disk File Image Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#user-keychain-information\">User Keychain Information<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/tajdini.net\/blog\/forensics-and-security\/digital-forensics-and-incident-response\/#spotlight-metadata\">Spotlight Metadata<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"411\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2020\/08\/VVEhibvNMP-1-1024x411.jpg\" alt=\"\" class=\"wp-image-8571\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2020\/08\/VVEhibvNMP-1-1024x411.jpg 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2020\/08\/VVEhibvNMP-1-300x120.jpg 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2020\/08\/VVEhibvNMP-1-768x308.jpg 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2020\/08\/VVEhibvNMP-1.jpg 1088w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"introduction\">Introduction<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">This post is inspired by all the hard working DFIR, and more broadly security professionals, who have put in the hard yards over the years to discuss in depth digital forensics and incident response.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"disclaimer\">Disclaimer<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">This page contains a variety of commands and concepts which are known through experience, higher education, tutorials, online blogs, YouTube Videos, professional training, reading the manual, and more. All references to original posts or material will aim to be documented in the \u2018Special Thanks\u2019 section.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is not designed as a manual on how to perform DFIR, and serves only as a quick reference sheet for commands, tools, and common items of interest when performing Incident Response. If you need to undertake Digital Forensics for legal proceedings, seek specialist advice as this requires more rigor around Identification, Preservation, Collection, Examination, Analysis, and Presentation of findings.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"artifact-locations\">Artifact locations<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">A number of forensic artifacts are known for a number of operating systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A large number of these are covered on the Digital Forensics Artifact Repository, and can be ingested both by humans and systems given the standard YAML format.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/ForensicArtifacts\/artifacts\/tree\/master\/data\">ForensicArtifacts<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">One action you can take is to parse this for items of interest and then directly spit out areas for investigation. For example if you have the PowerShell <a href=\"https:\/\/github.com\/cloudbase\/powershell-yaml\">ConvertFrom-Yaml module<\/a>, you can query this directly.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"get-an-object-of-forensic-artifacts\">Get an object of forensic artifacts<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$WindowsArtifacts=$(curl https:\/\/raw.githubusercontent.com\/ForensicArtifacts\/artifacts\/master\/data\/windows.yaml)\n$obj = ConvertFrom-Yaml $WindowsArtifacts.Content -AllDocuments\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now that it is stored within a format we can use the below will give us information at a glance.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$count=0;\nforeach ($Artifact in $obj){\n$Artifacts = &#91;pscustomobject]&#91;ordered]@{\n\tName = $obj.name&#91;$count]\n\tDescription = $obj.doc&#91;$count]\n\tReferences = $obj.urls&#91;$count]\n\tAttributes = $obj.sources.attributes&#91;$count]\n}\n$count++;\n$Artifacts | FL;\n}\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"query-object-for-relevant-registry-keys\">Query object for relevant registry keys:<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$obj.sources.attributes.keys|Select-String \"HKEY\"\n$obj.sources.attributes.key_value_pairs\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"query-object-for-relevant-file-paths\">Query object for relevant file paths:<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$obj.sources.attributes.paths\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"windows-cheat-sheet\">Windows Cheat Sheet<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"order-of-volatility\">Order of Volatility<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If performing Evidence Collection rather than IR, respect the order of volatility as defined in: rfc3227<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>registers, cache<\/li>\n\n\n\n<li>routing table, arp cache, process table, kernel statistics, memory<\/li>\n\n\n\n<li>temporary file systems<\/li>\n\n\n\n<li>disk<\/li>\n\n\n\n<li>remote logging and monitoring data that is relevant to the system in question<\/li>\n\n\n\n<li>physical configuration, network topology<\/li>\n\n\n\n<li>archival media<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"memory-files-locked-by-os-during-use\">Memory Files (Locked by OS during use)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Note: To obtain these files while they\u2019re in use you can use a low level file extractor such as <a href=\"https:\/\/github.com\/jschicht\/RawCopy\">RawCopy<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">hiberfil.sys (RAM stored during machine hibernation)<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemRoot%\\hiberfil.sys<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">pagefile.sys (Virtual memory used by Windows)<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemDrive%\\pagefile.sys<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">swapfile.sys (Virtual memory used by Windows Store Apps)<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemDrive%\\swapfile.sys<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"binalyze-irec-evidence-collector-gui-or-commandline\"><a href=\"https:\/\/binalyze.com\/products\/irec\">Binalyze IREC Evidence Collector<\/a> (GUI or CommandLine)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>IREC.exe --license AAAA-BBBB-CCDD-DDDD --profile memory\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Can be used as an all in one collector (License required for full collection, free version available).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/irec.readthedocs.io\/en\/latest\/commandline.html\">Latest documentation<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"belkasoft-live-ram-capturer\"><a href=\"https:\/\/belkasoft.com\/get?product=ram\">Belkasoft Live RAM Capturer<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>RamCapture64.exe \"output.mem\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">OR for 32 bit OS<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RamCapture32.exe \"output.mem\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"redline\">Redline<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Excellent resource:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">https:\/\/resources.infosecinstitute.com\/memory-analysis-using-redline\/<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"memoryze\">Memoryze<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>MemoryDD.bat --output &#91;LOCATION]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"comae-dumpit\">Comae DumpIT<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>DumpIt.exe \/O &#91;LOCATION]\n\n\t- Used for getting a memory crash file (Useful for analysis with both windbg and volatility)\n\t\nDumpIt.exe \/O &#91;LOCATION]\\mem.raw \/T RAW\n\n\t- Used for getting a raw memory dump (Considered a legacy format)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These can be bundled with PSEXEC to execute on a remote PC; however, this will copy the file to the remote PC for executing. There\u2019s limitations if the tool requires other drivers or files to execute (such as RamCapture). An example command may be:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>psexec \\\\remotepcname -c DumpIt.exe\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"magnet-forensics-mostly-gui\">Magnet Forensics (Mostly GUI)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.magnetforensics.com\/resources\/?cat=Free%20Tool\">Magnet Forensics Tools<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.magnetforensics.com\/free-tool-magnet-ram-capture\">Magnet RAM Capture<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.magnetforensics.com\/resources\/magnet-process-capture\/\">Magnet Process Capture<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"volexity-surge\"><a href=\"https:\/\/www.volexity.com\/blog\/2018\/06\/12\/surge-collect-provides-reliable-memory-acquisition-across-windows-linux-and-macos\/\">Volexity Surge<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"microsoft-livekd\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/livekd\">Microsoft LiveKd<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"winpmem\"><a href=\"https:\/\/github.com\/Velocidex\/c-aff4\/releases\">Winpmem<\/a><\/h3>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/winpmem.velocidex.com\/docs\/memory\n<\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>winpmem.exe -o test.aff4 -dd\nwinpmem.exe -o test.raw --format raw -dd\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"imaging-live-machines\">Imaging Live Machines<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ftk-imager-cmd-version-mostly-gui-for-new-versions\"><a href=\"https:\/\/accessdata.com\/product-download\">FTK Imager (Cmd version, mostly GUI for new versions)<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ftkimager --list-drives\nftkimager \\\\.\\PHYSICALDRIVE0 \"&#91;Location]\\Case\" --e01\nftkimager &#91;source] &#91;destination]\nftkimager \\\\.\\PHYSICALDRIVE0 \"&#91;Location]\\Case\" --e01 --outpass securepasswordinsertedhere \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"dd\">DD<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>dd.exe --list\ndd.exe if=\/dev\/&lt;drive&gt; of=Image.img bs=1M\ndd.exe if=\\\\.\\&lt;OSDrive&gt;: of=&lt;drive&gt;:\\&lt;name&gt;.img bs=1M --size --progress\n(LINUX) sudo dd if=\/dev\/&lt;OSDrive&gt; of=\/mnt\/&lt;name&gt;.ddimg bs=1M conv=noerror,sync\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"x-ways-imager\"><a href=\"https:\/\/www.x-ways.net\/order.html\">X-Ways Imager<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"encase-forensic\"><a href=\"https:\/\/www.guidancesoftware.com\/encase-forensic\">Encase Forensic<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"tableau-imager\"><a href=\"https:\/\/www.guidancesoftware.com\/tableau\/download-center\">Tableau Imager<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"guymager\"><a href=\"https:\/\/guymager.sourceforge.io\/\">Guymager<\/a><\/h3>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"live-windows-irtriage\">Live Windows IR\/Triage<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CMD and WMIC (Windows Management Instrumentation Command-Line) Note: less information can be gathered by using \u2018list brief\u2019.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"interact-with-remote-machine\">Interact with remote machine<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Enable Powershell remoting:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic \/node:&#91;IP] process call create \"powershell enable-psremoting -force\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Powershell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Enter-PSSession -ComputerName &#91;IP]\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">PSExec:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PsExec: psexec \\\\IP -c cmd.exe\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/docs.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.core\/enter-pssession?view=powershell-6\n<\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"system-information\">System information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>get-computerinfo\necho %DATE% %TIME%\ndate \/t\ntime \/t\nreg query \"HKLM\\System\\CurrentControlSet\\Control\\TimeZoneInformation\"\nsysteminfo\nwmic computersystem list full\nwmic \/node:localhost product list full \/format:csv\nwmic softwarefeature get name,version \/format:csv\nwmic softwareelement get name,version \/format:csv\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" \/s\necho %PATH%\n(gci env:path|Select -exp Value).split(';')\nSET\nwmic bootconfig get \/all \/format:List\nwmic computersystem get name, domain, manufacturer, model, numberofprocessors,primaryownername,username,roles,totalphysicalmemory \/format:list\nwmic timezone get Caption, Bias, DaylightBias, DaylightName, StandardName\nwmic recoveros get \/all \/format:List\nwmic os get \/all \/format:list\nwmic partition get \/all \/format:list\nwmic logicaldisk get \/all \/format:list\nwmic diskdrive get \/all \/format:list\nfsutil fsinfo drives\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">(psinfo requires sysinternals psinfo.exe):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>psinfo -accepteula -s -h -d\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-list-of-all-files-on-a-computer\">Obtain list of all files on a computer<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tree C:\\ \/F &gt; output.txt\ndir C:\\ \/A:H \/-C \/Q \/R \/S \/X\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"user-and-admin-information\">User and admin information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>whoami\nwhoami \/user\nnet users\nnet localgroup administrators\nnet group \/domain &#91;groupname]\nnet user \/domain &#91;username]\nwmic sysaccount\nwmic useraccount get name,SID\nwmic useraccount list\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"logon-information\">Logon information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic netlogin list \/format:List\nGet-WmiObject Win32_LoggedOnUser\nGet-WmiObject win32_logonsession\nquery user\nqwinsta\nklist sessions\nklist -li\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"nt-domainnetwork-client-information\">NT Domain\/Network Client Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic ntdomain get \/all \/format:List\nwmic netclient get \/all \/format:List\nnltest \/trusted_domains\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"firewall-information\">Firewall Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>netsh Firewall show state\nnetsh advfirewall firewall show rule name=all dir=in type=dynamic\nnetsh advfirewall firewall show rule name=all dir=out type=dynamic\nnetsh advfirewall firewall show rule name=all dir=in type=static\nnetsh advfirewall firewall show rule name=all dir=out type=static\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"firewall-changes\">Firewall Changes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Firewall With Advanced Security\/Firewall';} | FL TimeCreated, Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"pagefile-information\">Pagefile information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic pagefile\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"group-and-access-information\">Group and access information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(Accesschk requires accesschk64.exe or accesschk.exe from sysinternals):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>net localgroup\naccesschk64 -a *\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"cookies\">Cookies<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCookies\nC:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\nC:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recentdocs-information\">RecentDocs Information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/twitter.com\/barnabyskeggs\">Special thanks Barnaby Skeggs<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">*Note: Run with Powershell, get SID and user information with \u2018wmic useraccount get name,SID\u2019<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$SID = \"S-1-5-21-1111111111-11111111111-1111111-11111\"; $output = @(); Get-Item -Path \"Registry::HKEY_USERS\\$SID\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\" | Select-Object -ExpandProperty property | ForEach-Object {$i = &#91;System.Text.Encoding]::Unicode.GetString((gp \"Registry::HKEY_USERS\\$SID\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\" -Name $_).$_); $i = $i -replace '&#91;^a-zA-Z0-9 \\.\\-_\\\\\/()~ ]', '\\^'; $output += $i.split('\\^')&#91;0]}; $output | Sort-Object -Unique\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">More information on recent documents may be found:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\&#91;username]\\AppData\\Local\\Microsoft\\Windows\\FileHistory\\Data\ngci \"REGISTRY::HKU\\*\\Software\\Microsoft\\Office\\*\\Word\\Reading Locations\\*\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"startup-process-information\">Startup process information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic startup list full\nwmic startup list brief\nGet-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | FL\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"startup-process-information-by-pathfile-name\">Startup process information by path\/file name<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This will search common persistence areas but not all of them, change the $Malware variable value to a term of your choosing.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Malware = \"appdata\";\n$Processes = gps |?{$_.Path -match $Malware -or $_.Name -match $Malware} | FL Name,Path,Id;\n$Tasks = schtasks \/query \/fo csv \/v | ConvertFrom-Csv | ?{\"$_.Task To Run\" -match $Malware}| FL \"Taskname\",\"Task To Run\",\"Run As User\";\n$Services = gwmi win32_service | ? {$_.PathName -match $Malware}| FL Name,PathName;\n$ServiceDLL = reg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"ServiceDLL\" | findstr \"$Malware\";\n$RunKey1 = Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run*' | ?{$_ -match $Malware};\n$RunKey2 = Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*' | ?{$_ -match $Malware};\n$UserProfiles = (gwmi Win32_UserProfile | ? { $_.SID -notmatch 'S-1-5-(18|19|20).*' }); $paths = $UserProfiles.localpath; $sids = $UserProfiles.sid; for ($counter=0; $counter -lt $UserProfiles.length; $counter++){$path = $UserProfiles&#91;$counter].localpath; $sid = $UserProfiles&#91;$counter].sid; reg load hku\\$sid $path\\ntuser.dat};\n$RunKey3 = Get-ItemProperty -Path Registry::HKU\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run* | ?{$_ -match $Malware};\n$Startup = Select-String -Path 'C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*' -Pattern $Malware | Select Path;\n$Startup2 = Select-String -Path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*' -Pattern $Malware | Select Path;\nif ($Processes) {echo \"Process Found!\";$Processes} else {echo \"No Running Processes Found.\"};\nif ($Tasks) {echo \"Tasks Found!\";$Tasks} else {echo \"No Tasks Found.\"};\nif ($Services) {echo \"Services Found!\";$Services} else {echo \"No Services Found.\"};\nif ($ServiceDLL) {echo \"ServiceDLL Found!\";$ServiceDll} else {echo \"No Service Dlls Found.\"};\nif ($RunKey1) {echo \"Wow6432Node Run Key Found!\";$RunKey1} else {echo \"No Local Machine Wow6432Node Run Key Found.\"};\nif ($RunKey2) {echo \"Local Machine Run Key Found!\";$RunKey2} else {echo \"No Local Machine Run Key Found.\"};\nif ($RunKey3) {echo \"User Run Key Found!\";$RunKey3} else {echo \"No User Run Key Found.\"};\nif ($Startup) {echo \"AppData Startup Link Found!\";$Startup} else {echo \"No AppData Startups Found.\"};\nif ($Startup2) {echo \"ProgramData Startup Link Found!\";$Startup2} else {echo \"No ProgramData Startups Found.\"};\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scheduled-taskjob-information\">Scheduled task\/job information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>at (For older OS)\nschtasks\nschtasks \/query \/fo LIST \/v\nschtasks \/query \/fo LIST \/v | findstr \"Task To Run:\"\nschtasks \/query \/fo LIST \/v | findstr \"appdata\"\nschtasks \/query \/fo LIST \/v | select-string \"Enabled\" -CaseSensitive -Context 10,0 | findstr \"exe\"\nschtasks \/query \/fo LIST \/v | select-string \"Enabled\" -CaseSensitive -Context 10,0 | findstr \"Task\"\nschtasks \/query \/fo LIST \/v | Select-String \"exe\" -Context 2,27 \ngci -path C:\\windows\\system32\\tasks -recurse | Select-String Command | ? {$_.Line -match \"EXENAME\"} | FL Line, Filename\ngci -path C:\\windows\\system32\\tasks -recurse | where {$_.CreationTime -ge (get-date).addDays(-1)}|Select-String Command|FL Filename,Line\ngci -path C:\\windows\\system32\\tasks -recurse | where {$_.CreationTime -ge (get-date).addDays(-1)} | where {$_.CreationTime.hour -ge (get-date).hour-2}|Select-String Command|FL Line,Filename\nschtasks \/query \/fo csv \/v | ConvertFrom-Csv | ?{\"$_.Task To Run\" -match \"MALICIOUS\"}| FL \"Taskname\",\"Task To Run\"\nschtasks \/query \/fo csv \/v | ConvertFrom-Csv | ?{$_.Taskname -ne \"TaskName\"} | FL \"Taskname\",\"Task To Run\"\nwmic job get Name, Owner, DaysOfMonth, DaysOfWeek, ElapsedTime, JobStatus, StartTime, Status\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Powershell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask\ngci -path C:\\windows\\system32\\tasks -recurse | Select-String Command | FL Filename, Line\ngci -path C:\\windows\\system32\\tasks -recurse | Select-String Command | ? {$_.Line -match \"MALICIOUSNAME\"} | FL Filename, Line\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"remediate-malicious-scheduled-tasks\">Remediate malicious scheduled tasks<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>schtasks \/Delete \/TN &#91;taskname] \/F\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Powershell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unregister-ScheduledTask -TaskName &#91;taskname]\nUnregister-ScheduledTask -TaskPath &#91;taskname]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"uac-bypass-fodhelper\">UAC Bypass Fodhelper<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command\nreg query HKU\\{SID}\\Software\\Classes\\ms-settings\\shell\\open\\command\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"quick-overview-of-persistent-locations-autoruns\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/autoruns\">Quick overview of persistent locations (AutoRuns)<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>autorunsc.exe -accepteula -a * -c -h -v -m &gt; autoruns.csv\nautorunsc.exe -accepteula -a * -c -h -v -m -z 'E:\\Windows' &gt; autoruns.csv\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"persistence-and-automatic-loadrun-reg-keys\">Persistence and Automatic Load\/Run Reg Keys<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Replace: \u201creg query\u201d with \u201cGet-ItemProperty -Path HK<\/em>:&#8221; in Powershell*<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">e.g.: Get-Item -Path HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>User Registry (NTUSER.DAT HIVE)<\/strong> &#8211; Commonly located at:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\&#91;username]\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">*Note: These are setup for querying the current users registry only (HKCU), to query others you will need to load them from the relevant NTUSER.DAT file and then query them.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\"\nreg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run\"\nreg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run32\"\nreg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\StartupFolder\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" \/f run\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" \/f load\nreg query \"HKCU\\Environment\" \/v UserInitMprLogonScript\nreg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \/v RESTART_STICKY_NOTES\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Windows\\Scripts\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\RecentDocs\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\RunMRU\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\"\nreg query \"HKCU\\SOFTWARE\\AcroDC\"\nreg query \"HKCU\\SOFTWARE\\Itime\"\nreg query \"HKCU\\SOFTWARE\\info\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\User Shell Folders\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Command Processor\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Applets\\RegEdit\" \/v LastKey\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSavePidlMRU\" \/s\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\currentversion\\run\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Microsoft\\Windows\\CurrentVersion\\Run\"\nreg query \"HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\&#91;Random]\\StubPath\" \/s\nreg query \"HKCU\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components\\&#91;Random]\\StubPath\" \/s\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Office\\&#91;officeversion]\\&#91;word\/excel\/access etc]\\Security\\AccessVBOM\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\IEAK\\GroupPolicy\\PendingGPOs\" \/s\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs\"\nreg query \"HKCU\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs\"\n\treg query \"HKCU\\SOFTWARE\\Microsoft\\Office\\15.0\\Excel\\Security\\AccessVBOM\n\treg query \"HKCU\\SOFTWARE\\Microsoft\\Office\\15.0\\Word\\Security\\AccessVBOM\n\treg query \"HKCU\\SOFTWARE\\Microsoft\\Office\\15.0\\Powerpoint\\Security\\AccessVBOM\n\treg query \"HKCU\\SOFTWARE\\Microsoft\\Office\\15.0\\Access\\Security\\AccessVBOM\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Local Machine (SOFTWARE HIVE)<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices\"\nreg query \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" \/f AppInit_DLLs\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Win\\Userinit\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\" \/s\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\" \/s\nreg query \"HKLM\\SOFTWARE\\wow6432node\\Microsoft\\Windows\\CurrentVersion\\policies\\explorer\\run\"\nreg query \"HKLM\\SOFTWARE\\wow6432node\\Microsoft\\Windows\\CurrentVersion\\run\"\nreg query \"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Office\\&#91;officeversion]\\&#91;word\/excel\/access etc]\\Security\\AccessVBOM\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run32\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\StartupFolder\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\&#91;Random]\\StubPath\" \/s\nreg query \"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components\\&#91;Random]\\StubPath\" \/s\nreg query \"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\CPLs\"\n\treg query \"HKLM\\SOFTWARE\\Microsoft\\Office\\15.0\\Excel\\Security\\AccessVBOM\n\treg query \"HKLM\\SOFTWARE\\Microsoft\\Office\\15.0\\Word\\Security\\AccessVBOM\n\treg query \"HKLM\\SOFTWARE\\Microsoft\\Office\\15.0\\Powerpoint\\Security\\AccessVBOM\n\treg query \"HKLM\\SOFTWARE\\Microsoft\\Office\\15.0\\Access\\Security\\AccessVBOM\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Don\u2019t be afraid to use \u201cfindstr\u201d or \u2018\/f\u2019 to find entries of interest, for example file extensions which may also invoke malicious executables when run, or otherwise.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Classes\" | findstr \"file\"\nreg query \"HKLM\\SOFTWARE\\Classes\" \/f \"file\"\nreg query HKCR\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} \/s\nreg query HKCR\\AppID\\ \/s | findstr \"exe\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Local Machine (SYSTEM HIVE)<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This not only contains services, but also malicious drivers which may run at startup (these are in the form of \u201c.sys\u201d files and are generally loaded from here: \\SystemRoot\\System32\\drivers)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\&#91;Random_name]\\imagePath\"\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\ \/s \/f \"*.exe\"\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Services\" \/s \/v ImagePath \/f \"*.exe\"\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Services\" \/s \/v ImagePath \/f \"*.sys\"\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\" \/v BootExecute\nGet-Service -Name \"*MALICIOUSSERVICE*\"\ngwmi win32_service | ? {$_.PathName -match \"MALICIOUSSERVICE\"}|FL Name,PathName\nGet-ItemProperty \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\*\" | FL DisplayName,ImagePath,ObjectName\ngci -Path C:\\Windows\\system32\\drivers -include *.sys -recurse -ea 0 -force | Get-AuthenticodeSignature\ngci -Path C:\\Windows\\system32\\drivers -include *.sys -recurse -ea 0 -force | Get-FileHash\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Some useful commands to show relevant service information<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"ImagePath\"\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"ServiceDLL\"\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"FailureCommand\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1015-accessibility-features\">T1015 Accessibility Features<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe\" \/v \"Debugger\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\utilman.exe\" \/v \"Debugger\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AtBroker.exe\" \/v \"Debugger\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Narrator.exe\" \/v \"Debugger\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Magnify.exe\" \/v \"Debugger\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\DisplaySwitch.exe\" \/v \"Debugger\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\osk.exe\" \/v \"Debugger\"\nsfc \/VERIFYFILE=C:\\Windows\\System32\\sethc.exe\nsfc \/VERIFYFILE=C:\\Windows\\System32\\utilman.exe\nsfc \/VERIFYFILE=C:\\Windows\\System32\\AtBroker.exe\nsfc \/VERIFYFILE=C:\\Windows\\System32\\Narrator.exe\nsfc \/VERIFYFILE=C:\\Windows\\System32\\Magnify.exe\nsfc \/VERIFYFILE=C:\\Windows\\System32\\DisplaySwitch.exe\nsfc \/VERIFYFILE=C:\\Windows\\System32\\osk.exe\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1098-account-manipulation\">T1098 Account Manipulation<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>N\/A\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1182-appcert-dlls\">T1182 AppCert DLLs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\System\\CurrentControlSet\\Control\\Session Manager\" \/v AppCertDlls\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1103-appinit-dlls\">T1103 AppInit DLLs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" \/v Appinit_Dlls\nreg query \"HKLM\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" \/v Appinit_Dlls\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" \/v Appinit_Dlls\nreg query \"HKU\\{SID}\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" \/v Appinit_Dlls\nGet-WinEvent -FilterHashtable @{ LogName='System'; Id='11'} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1138-application-shimming\">T1138 Application Shimming<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\"\ndir %WINDIR%\\AppPatch\\custom\ndir %WINDIR%\\AppPatch\\AppPatch64\\Custom\nGet-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Kernel-ShimEngine\/Operational';}|FL\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1197-bits-jobs\">T1197 BITS Jobs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>bitsadmin \/list \/allusers \/verbose\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Bits-Client\/Operational'; Id='59'} | FL TimeCreated,Message\nls 'C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr.db'\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1067-bootkit\">T1067 Bootkit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This exists below the OS in the Master Boot Record or Volume Boot Record. The system must be booted through Advanced Startup Options with a Command Prompt, or through a recovery cd.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bootrec \/FIXMBR\nbootrec \/FIXBOOT\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Extra: If your boot configuration data is missing or contains errors the below can fix this.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bootrec \/REBUILDBCD\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019re thinking of a bootkit more as malicious system drivers you can go with the below.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"general-driver-enumeration\">General Driver Enumeration<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>gci C:\\Windows\\*\\DriverStore\\FileRepository\\ -recurse -include *.inf | FL FullName,LastWriteTime,LastWriteTimeUtc\ngci -path C:\\Windows\\System32\\drivers -include *.sys -recurse -ea SilentlyContinue\nsc.exe query type=driver state=all\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"unsigned-drivers\">Unsigned Drivers<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-CodeIntegrity\/Operational'; Id='3001'} | FL TimeCreated,Message\ngci -path C:\\Windows\\System32\\drivers -include *.sys -recurse -ea SilentlyContinue | Get-AuthenticodeSignature | where {$_.status -ne 'Valid'}\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"unload-malicious-filter-driver\">Unload malicious filter driver<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>fltmc filters\nfltmc volumes\nfltmc instances\nfltmc unload &lt;filtername&gt;\nfltmc detach &lt;filtername&gt; &lt;volumeName&gt; &lt;instanceName&gt;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1176-browser-extensions\">T1176 Browser Extensions<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"chrome\">Chrome<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -path \"C:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\" -recurse -erroraction SilentlyContinue\nGet-ChildItem -path 'C:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions' -recurse -erroraction SilentlyContinue -include manifest.json | cat\nreg query \"HKLM\\Software\\Google\\Chrome\\Extensions\" \/s\nreg query \"HKLM\\Software\\Wow6432Node\\Google\\Chrome\\Extensions\" \/s\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"firefox\">Firefox<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -path \"C:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*\\extensions\" -recurse -erroraction SilentlyContinue\nGet-ChildItem -path \"C:\\Program Files\\Mozilla Firefox\\plugins\\\" -recurse -erroraction SilentlyContinue\nGet-ChildItem -path registry::HKLM\\SOFTWARE\\Mozilla\\*\\extensions\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"edge\">Edge<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -Path C:\\Users\\*\\AppData\\Local\\Packages\\ -recurse -erroraction SilentlyContinue\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"internet-explorer\">Internet Explorer<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -path \"C:\\Program Files\\Internet Explorer\\Plugins\\\" -recurse -erroraction SilentlyContinue\nreg query 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects'\nreg query 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Toolbar'\nreg query 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\URLSearchHooks'\nreg query 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Explorer Bars'\nreg query 'HKU\\{SID}\\Software\\Microsoft\\Internet Explorer\\Explorer Bars'\nreg query 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions'\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1109-component-firmware\">T1109 Component Firmware<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This is incredibly rare, and doesn\u2019t have an easy detection\/remediation mechanism. Using the Windows CheckDisk utility, System File Checker, or Deployment Image Servicing and Management may assist but isn\u2019t guaranteed.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chkdsk \/F\nsfc \/scannow\ndism \/Online \/Cleanup-Image \/ScanHealth\ndism \/Online \/Cleanup-Image \/RestoreHealth\ndism \/Online \/Cleanup-Image \/StartComponentCleanup \/ResetBase\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1122-component-object-model-com-hijacking\">T1122 Component Object Model (COM) Hijacking<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This involves replacing legitimate components with malicious ones, and as such the legitimate components will likely no longer function. If you have a detection based on DLLHost.exe with \/Processid:{xyz}, you can match xyz with the CLSID (COM Class Object) or AppID mentioned below to check for any malicious EXE or DLL.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{abc} \/v AppID \/t REG_SZ \/d {xyz}\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{abc} \/v AppID \/t REG_SZ \/d {xyz}\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{xyz}\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\AppID\\{xyz}\nHKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Classes\\AppID\\{xyz}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Example analysis:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\" \/s \/f \"{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}\"\nreg query \"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{178167bc-4ee3-403e-8430-a6434162db17}\" \/s\nreg query \"HKLM\\SOFTWARE\\Classes\\AppID\\{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Queries:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SOFTWARE\\Classes\\CLSID\\ \/s \/f \".dll\"\nreg query HKLM\\SOFTWARE\\Classes\\CLSID\\ \/s \/f \".exe\"\nreg query HKLM\\SOFTWARE\\Classes\\AppID\\ \/s \/f DllSurrogate\ngci -path REGISTRY::HKLM\\SOFTWARE\\Classes\\*\\shell\\open\\command \nreg query HKU\\{SID}\\SOFTWARE\\Classes\\CLSID\\ \/s \/f \".dll\"\nreg query HKU\\{SID}\\SOFTWARE\\Classes\\CLSID\\ \/s \/f \".exe\"\ngci 'REGISTRY::HKU\\*\\Software\\Classes\\CLSID\\*\\TreatAs'\ngci 'REGISTRY::HKU\\*\\Software\\Classes\\Scripting.Dictionary'\ngci \"REGISTRY::HKU\\*\\SOFTWARE\\Classes\\CLSID\\*\\LocalServer32\" -ea 0\ngci \"REGISTRY::HKU\\*\\SOFTWARE\\Classes\\CLSID\\*\\InprocServer32\" -ea 0\ngci \"REGISTRY::HKU\\*\\SOFTWARE\\Classes\\CLSID\\*\\InprocHandler*\" -ea 0\ngci \"REGISTRY::HKU\\*\\SOFTWARE\\Classes\\CLSID\\*\\*Server32\" -ea 0\ngci \"REGISTRY::HKU\\*\\SOFTWARE\\Classes\\CLSID\\*\\ScriptletURL\" -ea 0\nreg query HKU\\{SID}\\SOFTWARE\\Classes\\CLSID\\ \/s \/f \"ScriptletURL\"\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"get-list-of-all-com-objects\">Get list of all COM Objects<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">{Original by Jeff Atwood](https:\/\/stackoverflow.com\/questions\/660319\/where-can-i-find-all-of-the-com-objects-that-can-be-created-in-powershell)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gci HKLM:\\Software\\Classes -ea 0| ? {$_.PSChildName -match '^\\w+\\.\\w+$' -and(gp \"$($_.PSPath)\\CLSID\" -ea 0)} | select -ExpandProperty PSChildName\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1136-create-account\">T1136 Create Account<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>net user\nnet user \/domain\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1038-dll-search-order-hijacking\">T1038 DLL Search Order Hijacking<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\KnownDLLs\"\ngci -path C:\\Windows\\* -include *.dll | Get-AuthenticodeSignature | Where-Object Status -NE \"Valid\"\ngci -path C:\\Windows\\System32\\* -include *.dll | Get-AuthenticodeSignature | Where-Object Status -NE \"Valid\"\ngps | FL ProcessName, @{l=\"Modules\";e={$_.Modules|Out-String}}\ngps | ? {$_.Modules -like '*{DLLNAME}*'} | FL ProcessName, @{l=\"Modules\";e={$_.Modules|Out-String}}\n$dll = gps | Where {$_.Modules -like '*{DLLNAME}*' } | Select Modules;$dll.Modules;\n(gps).Modules.FileName\n(gps).Modules | FL FileName,FileVersionInfo\n(gps).Modules.FileName | get-authenticodesignature | ? Status -NE \"Valid\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1133-external-remote-services\">T1133 External Remote Services<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>N\/A\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1044-file-system-permissions-weakness\">T1044 File System Permissions Weakness<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WmiObject win32_service | FL name,PathName\nget-acl \"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" | FL | findstr \"FullControl\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1158-hidden-files-and-directories\">T1158 Hidden Files and Directories<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>dir \/S \/A:H\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1179-hooking\">T1179 Hooking<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"finding-easyhook-injection\">Finding EasyHook Injection<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist \/m EasyHook32.dll;tasklist \/m EasyHook64.dll;tasklist \/m EasyLoad32.dll;tasklist \/m EasyLoad64.dll;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">More Material:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.contextis.com\/en\/blog\/common-language-runtime-hook-for-persistence\">Contextis Blog<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/jay\/gethooks\/releases\/tag\/1.01\">GetHooks<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1062-hypervisor\">T1062 Hypervisor<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>N\/A\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1183-image-file-execution-options-injection\">T1183 Image File Execution Options Injection<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\" \/s \/f \"MonitorProcess\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\" \/s \/f \"Debugger\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1037-logon-scripts\">T1037 Logon Scripts<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKU\\{SID}\\Environment\\UserInitMprLogonScript\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1177-lsass-driver\">T1177 LSASS Driver<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4614';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='3033';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='3063';} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1031-modify-existing-service\">T1031 Modify Existing Service<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"ImagePath\"\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"ServiceDLL\"\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"FailureCommand\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1128-netsh-helper-dll\">T1128 Netsh Helper DLL<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SOFTWARE\\Microsoft\\Netsh\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1050-new-service\">T1050 New Service<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"ImagePath\"\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"ServiceDLL\"\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services \/s \/v \"FailureCommand\"\nGet-WmiObject win32_service | FL Name, DisplayName, PathName, State\nGet-WinEvent -FilterHashtable @{ LogName='System'; Id='7045';} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1137-office-application-startup\">T1137 Office Application Startup<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -path C:\\Users\\*\\Microsoft\\*\\STARTUP\\*.dotm\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Office test\\Special\\Perf\" \/s\nreg query \"HKLM\\Software\\Microsoft\\Office test\\Special\\Perf\" \/s\nGet-ChildItem -path registry::HKLM\\SOFTWARE\\Microsoft\\Office\\*\\Addins\\*\nGet-ChildItem -path registry::HKLM\\SOFTWARE\\Wow6432node\\Microsoft\\Office\\*\\Addins\\*\nGet-ChildItem -path registry::HKLM\\SOFTWARE\\Wow6432node\\Microsoft\\Office\\*\\Addins\\*\nGet-ChildItem -path \"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Templates\\*\" -erroraction SilentlyContinue\nGet-ChildItem -path \"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*\" -erroraction SilentlyContinue\nGet-ChildItem -path C:\\ -recurse -include Startup -ea 0\nls 'C:\\Program Files\\Microsoft Office\\root\\*\\XLSTART\\*'\nls 'C:\\Program Files\\Microsoft Office\\root\\*\\STARTUP\\*'\nreg query HKCU\\Software\\Microsoft\\Office\\&lt;Outlook Version&gt;\\Outlook\\WebView\\Inbox\nreg query HKCU\\Software\\Microsoft\\Office\\&lt;Outlook Version&gt;\\Outlook\\Security\nreg query HKCU\\Software\\Microsoft\\Office\\&lt;Outlook Version&gt;\\Outlook\\Today\\UserDefinedUrl\nreg query HKCU\\Software\\Microsoft\\Office\\&lt;Outlook Version&gt;\\Outlook\\WebView\\Calendar\\URL\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft Office Alerts'; Id='300';} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1034-path-interception\">T1034 Path Interception<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>N\/A\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1013-port-monitors\">T1013 Port Monitors<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\" \/s \/v \"Driver\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1504-powershell-profile\">T1504 PowerShell Profile<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Profile.ps1\nls C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.*Profile.ps1\nls C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.*Profile.ps1\ngci -path \"C:\\Users\\*\\Documents\\PowerShell\\Profile.ps1\"\ngci -path \"C:\\Users\\*\\Documents\\PowerShell\\Microsoft.*Profile.ps1\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1108-redundant-access\">T1108 Redundant Access<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>N\/A\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1060-registry-run-keys--startup-folder\">T1060 Registry Run Keys \/ Startup Folder<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\"\nreg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\nreg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\nreg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\"\nreg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\"\nreg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\"\nreg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\"\nreg query \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit\"\nreg query \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\"\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\" \/v BootExecute\ngci -path \"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*\" -include *.lnk,*.url\ngci -path \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*\" -include *.lnk,*.url\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Shell-Core\/Operational'; Id='9707'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Shell-Core\/Operational'; Id='9708'} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1053-scheduled-task\">T1053 Scheduled Task<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci -path C:\\windows\\system32\\tasks | Select-String Command | FT Line, Filename\ngci -path C:\\windows\\system32\\tasks -recurse | where {$_.CreationTime -ge (get-date).addDays(-1)} | Select-String Command | FL Filename,Line\ngci -path C:\\windows\\system32\\tasks -recurse | where {$_.CreationTime -ge (get-date).addDays(-1)} | where {$_.CreationTime.hour -ge (get-date).hour-2}| Select-String Command | FL Line,Filename\ngci -path 'registry::HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\'\ngci -path 'registry::HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\'\nls 'C:\\Windows\\System32\\WptsExtensions.dll'\n\tNote: thanks to &#91;Markus Pi\u00e9ton](https:\/\/twitter.com\/markus_pieton\/status\/1189559716453801991) for this one.\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1180-screensaver\">T1180 Screensaver<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKU\\{SID}\\Control Panel\\Desktop\" \/s \/v \"ScreenSaveActive\"\nreg query \"HKU\\{SID}\\Control Panel\\Desktop\" \/s \/v \"SCRNSAVE.exe\"\nreg query \"HKU\\{SID}\\Control Panel\\Desktop\" \/s \/v \"ScreenSaverIsSecure\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1101-security-support-provider\">T1101 Security Support Provider<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\" \/v \"Security Packages\"\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" \/v \"Security Packages\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1505-server-software-component\">T1505 Server Software Component<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>N\/A\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1058-service-registry-permissions-weakness\">T1058 Service Registry Permissions Weakness<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>get-acl REGISTRY::HKLM\\SYSTEM\\CurrentControlSet\\Services\\* |FL\nget-acl REGISTRY::HKLM\\SYSTEM\\CurrentControlSet\\Services\\servicename |FL\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1023-shortcut-modification\">T1023 Shortcut Modification<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Select-String -Path \"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.lnk\" -Pattern \"exe\"\nSelect-String -Path \"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.lnk\" -Pattern \"dll\"\nSelect-String -Path \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*\" -Pattern \"dll\"\nSelect-String -Path \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*\" -Pattern \"exe\"\ngci -path \"C:\\Users\\\" -recurse -include *.lnk -ea SilentlyContinue | Select-String -Pattern \"exe\" | FL\ngci -path \"C:\\Users\\\" -recurse -include *.lnk -ea SilentlyContinue | Select-String -Pattern \"dll\" | FL\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1198-sip-and-trust-provider-hijacking\">T1198 SIP and Trust Provider Hijacking<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\" \/s \/v \"Dll\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\" \/s \/v \"Dll\"\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\" \/s \/v \"`$DLL\"\nreg query \"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\" \/s \/v \"Dll\"\nreg query \"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\" \/s \/v \"Dll\"\nreg query \"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\" \/s \/v \"`$DLL\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1019-system-firmware\">T1019 System Firmware<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\HARDWARE\\DESCRIPTION\\System\\BIOS\nConfirm-SecureBootUEFI\nGet-WmiObject win32_bios\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1209-time-providers\">T1209 Time Providers<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\System\\CurrentControlSet\\Services\\W32Time\\TimeProviders\" \/s \/f \"Dll\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1078-valid-accounts\">T1078 Valid Accounts<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>N\/A\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1100-web-shell\">T1100 Web Shell<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci -path \"C:\\inetpub\\wwwroot\" -recurse -File -ea SilentlyContinue | Select-String -Pattern \"runat\" | FL\ngci -path \"C:\\inetpub\\wwwroot\" -recurse -File -ea SilentlyContinue | Select-String -Pattern \"eval\" | FL\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1084-windows-management-instrumentation-event-subscription\">T1084 Windows Management Instrumentation Event Subscription<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"get-wmi-namespaces\">Get WMI Namespaces<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Function Get-WmiNamespace ($Path = 'root')\n{\n\tforeach ($Namespace in (Get-WmiObject -Namespace $Path -Class __Namespace))\n\t{\n\t\t$FullPath = $Path + \"\/\" + $Namespace.Name\n\t\tWrite-Output $FullPath\n\t\tGet-WmiNamespace -Path $FullPath\n\t}\n}\nGet-WMINamespace -Recurse\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"query-wmi-persistence\">Query WMI Persistence<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WmiObject -Class __FilterToConsumerBinding -Namespace root\\subscription\nGet-WmiObject -Class __EventFilter -Namespace root\\subscription\nGet-WmiObject -Class __EventConsumer -Namespace root\\subscription\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1004-winlogon-helper-dll\">T1004 Winlogon Helper DLL<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKU\\{SID}\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\" \/s\nreg query \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\" \/s\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" \/v \"Userinit\"\nreg query \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" \/v \"Userinit\"\nreg query \"HKU\\{SID}\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" \/v \"Shell\"\nreg query \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" \/v \"Shell\"\nreg query \"HKLM\\Software\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" \/s\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"other---winsock-persistence\">Other &#8211; Winsock Persistence<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Winsock-WS2HELP\/Operational'; Id='1'} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-disabled-task-manager-often-from-malware\">Check disabled task manager (often from malware)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v DisableTaskMgr\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"review-hivelist\">Review Hivelist<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gp REGISTRY::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\hivelist | Select *USER*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"locate-all-user-registry-keys\">Locate all user registry keys<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$UserProfiles = Get-ItemProperty \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\*\" | Where {$_.PSChildName -match \"S-1-5-21-(\\d+-?){4}$\" } | Select-Object @{Name=\"SID\"; Expression={$_.PSChildName}}, @{Name=\"UserHive\";Expression={\"$($_.ProfileImagePath)\\ntuser.dat\"}}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"load-all-users-registry-keys-from-their-ntuserdat-file-perform-above-first\">Load all users registry keys from their ntuser.dat file (perform above first)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Foreach ($UserProfile in $UserProfiles) {If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS\\$($UserProfile.SID)) -eq $false) {reg load HKU\\$($UserProfile.SID) $($UserProfile.UserHive) | echo \"Successfully loaded: $($UserProfile.UserHive)\"}}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"query-all-users-run-key\">Query all users run key<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Foreach ($UserProfile in $UserProfiles) {reg query HKU\\$($UserProfile.SID)\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run};\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"unload-all-users-registry-keys\">Unload all users registry keys<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Foreach ($UserProfile in $UserProfiles) {reg unload HKU\\$($UserProfile.SID)};\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"remediate-automatic-loadrun-reg-keys\">Remediate Automatic Load\/Run Reg Keys<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg delete &#91;keyname] \/v &#91;ValueName] \/f\nreg delete &#91;keyname] \/f\nForeach ($UserProfile in $UserProfiles) {reg delete HKU\\$($UserProfile.SID)\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce \/f}\nForeach ($UserProfile in $UserProfiles) {reg delete HKU\\$($UserProfile.SID)\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run \/f}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Powershell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remove-ItemProperty -Path \"&#91;Path]\" -Name \"&#91;name]\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-registry-for-ie-enhanced-security-modification\">Check Registry for IE Enhanced Security Modification<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci 'REGISTRY::HKU\\*\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap'\ngci 'REGISTRY::HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap'\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-registry-for-disabling-of-uac-1uac-disabled\">Check Registry for disabling of UAC (1=UAC Disabled)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci REGISTRY::HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA \ngci REGISTRY::HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"review-software-keys-for-malicious-entries\">Review Software Keys for malicious entries<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci registry::HKLM\\Software\\*\ngci registry::HKU\\*\\Software\\*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scan-registry-keys-for-specified-text\">Scan Registry keys for specified text<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -path HKLM:\\ -Recurse -ea SilentlyContinue | where {$_.Name -match 'notepad' -or $_.Name -match 'sql'}\nGet-ChildItem -path HKLM:\\ -Recurse -ea SilentlyContinue | get-itemproperty | where {$_ -match 'notepad' -or $_ -match 'sql'}\nreg query HKLM\\SOFTWARE \/s \/f \".exe\"\nreg query HKLM\\SYSTEM \/s \/f \".exe\"\nreg query HKLM\\SECURITY \/s \/f \".exe\"\nreg query HKLM \/s \/f \".exe\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"persistent-file-locations-of-interest\">Persistent file locations of interest<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>%localappdata%\\&lt;random&gt;\\&lt;random&gt;.&lt;4-9 file ext&gt;\n%localappdata%\\&lt;random&gt;\\&lt;random&gt;.lnk\n%localappdata%\\&lt;random&gt;\\&lt;random&gt;.bat\n%appdata%\\&lt;random&gt;\\&lt;random&gt;.&lt;4-9 file ext&gt;\n%appdata%\\&lt;random&gt;\\&lt;random&gt;.lnk\n%appdata%\\&lt;random&gt;\\&lt;random&gt;.bat\n%appdata%\\&lt;random&gt;\\&lt;random&gt;.bat\n%SystemRoot%\\&lt;random 4 chars starting with digit&gt;\n%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*\n\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*\"\n%SystemRoot%\\System32\\&lt;randomnumber&gt;\\\n%SystemRoot%\\System32\\tasks\\&lt;randomname&gt;\n%SystemRoot%\\\\&lt;randomname&gt;\nC:\\Users\\&#91;user]\\appdata\\roaming\\&#91;random]\nC:\\Users\\&#91;user]\\appdata\\roaming\\&#91;random]\nC:\\Users\\Public\\*\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can scan these directories for items of interest e.g. unusual exe, dll, bat, lnk etc files with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dir \/s \/b %localappdata%\\*.exe | findstr \/e .exe\ndir \/s \/b %appdata%\\*.exe | findstr \/e .exe\ndir \/s \/b %localappdata%\\*.dll | findstr \/e .dll\ndir \/s \/b %appdata%\\*.dll | findstr \/e .dll\ndir \/s \/b %localappdata%\\*.bat | findstr \/e .bat\ndir \/s \/b \"%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" | findstr \/e .lnk\ndir \/s \/b \"C:\\Users\\Public\\\" | findstr \/e .exe\ndir \/s \/b \"C:\\Users\\Public\\\" | findstr \/e .lnk\ndir \/s \/b \"C:\\Users\\Public\\\" | findstr \/e .dll\ndir \/s \/b \"C:\\Users\\Public\\\" | findstr \/e .bat\nls \"C:\\Users\\&#91;User]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" | findstr \/e .lnk\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"locate-lnk-files-with-a-particular-string-special-thanks-to-the-notorious\">Locate LNK Files with a particular string (Special thanks to the notorious)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Select-String -Path 'C:\\Users\\&#91;User]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.lnk' -Pattern \"powershell\" | Select Path\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"master-file-table\">Master File Table<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Master File Table is an incredibly important artifact; however, this can only be read or obtained using low level disk reading. This contains an entry for every file or directory on the filesystem including metadata about these files, and may provide evidence on files which have been removed (MFT entries marked as \u2018free\u2019). More information can be found on MS Docs (https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/fileio\/master-file-table)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"determine-timestomping\">Determine Timestomping<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Within the Master File Table (Located at the Win root) there are 2 elements, $STANDARD_INFORMATION and $FILE_NAME, both of which have values for a file being created, modified, accessed and written.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These are known as MACB times (Modified, Accessed, Changed, Birth). The $STANDARD_INFORMATION element can be modified from a malicious process, but the $FILE_NAME element is left intact and cannot without some extra trickery.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These discrepancies generally indicate Timestomping with the $FILE_NAME entry being the source of truth. This can be determined by obtaining the MFT (e.g. using a tool such as Rawcopy), and comparing timestamps on the file (e.g. using a tool such as MFTExplorer).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/jschicht\/RawCopy\">Rawcopy<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RawCopy.exe \/FileNamePath:C:0 \/OutputPath:C:\\Audit \/OutputName:MFT_C.bin\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">MFTExplorer<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enable-date-accessed-timestamps\">Enable Date Accessed Timestamps<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\" \/v NtfsDisableLastAccessUpdate \/d 0 \/t REG_DWORD \/f\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"remove-bitsadmin-persistence\">Remove BITSAdmin Persistence<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>bitsadmin \/reset \/allusers\nimport-module bitstransfer\nGet-BitsTransfer -AllUsers | Remove-BitsTransfer\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-system-directories-for-executables-not-signed-as-part-of-an-operating-system-release\">Check system directories for executables not signed as part of an operating system release<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci C:\\windows\\*\\*.exe -File -force |get-authenticodesignature|?{$_.IsOSBinary -notmatch 'True'}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"locate-possible-trickbot\">Locate Possible Trickbot<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci -path C:\\Users\\*\\AppData\\Roaming\\*\\Data -recurse -force -ea SilentlyContinue\ngci -path C:\\Users\\*\\AppData\\Roaming\\*\\Modules -recurse -force -ea SilentlyContinue\ngci -path C:\\Users\\*\\AppData\\Local\\*\\Data -recurse -force -ea SilentlyContinue\ngci -path C:\\Users\\*\\AppData\\Local\\*\\Modules -recurse -force -ea SilentlyContinue\ngci -path C:\\Users\\*\\AppData\\Roaming\\*\\*\\Data -recurse -force -ea SilentlyContinue\ngci -path C:\\Users\\*\\AppData\\Roaming\\*\\*\\Modules -recurse -force -ea SilentlyContinue\ngci -path C:\\Users\\*\\AppData\\Local\\*\\*\\Data -recurse -force -ea SilentlyContinue\ngci -path C:\\Users\\*\\AppData\\Local\\*\\*\\Modules -recurse -force -ea SilentlyContinue\ngci -path C:\\Windows\\System32\\config\\systemprofile\\appdata\\roaming -recurse -force -include *.exe\nschtasks \/query \/fo LIST \/v | findstr \"appdata\"\t\nschtasks \/query \/fo LIST \/v | findstr \"programdata\"\t\nschtasks \/query \/fo LIST \/v | findstr \"public\"\t\ntasklist \/svc | findstr \"svchost\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"determine-if-user-trusted-a-docspreadsheet-etc-and-ran-a-macro\">Determine if user Trusted a doc\/spreadsheet etc and ran a macro<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Don\u2019t forget to load in user hives.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query 'HKU\\&#91;SID]\\Software\\Microsoft\\Office\\&#91;versionnumber]\\Word\\Security\\Trusted Documents\\TrustRecords';\ngci 'REGISTRY::HKU\\*\\Software\\Microsoft\\Office\\*\\*\\Security\\Trusted Documents\\TrustRecords' -ea 0 | foreach {reg query $_.Name}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This will show the file name\/location and metadata in Hex. If the last lot of hex is FFFFFF7F then the user enabled the macro.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-office-security-settings\">Check Office Security Settings<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci REGISTRY::HKU\\*\\Software\\Microsoft\\Office\\*\\*\\Security -rec\ngci REGISTRY::HKCU\\Software\\Microsoft\\Office\\*\\*\\Security -rec\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-outlook-temporary-files\">Check Outlook Temporary Files<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci ((gp REGISTRY::HKU\\*\\Software\\Microsoft\\Office\\&#91;VerNumber]\\Outlook\\Security\\ -ea 0).OutlookSecureTempFolder)\ngci (((gp REGISTRY::HKU\\*\\Software\\Microsoft\\Office\\*\\Outlook\\Security\\ -ea 0)|select -exp OutlookSecureTempFolder -ea 0))\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-ms-office-logs-for-high-risk-file-names\">Check MS Office Logs for high risk file names<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='OAlerts';} |Where { $_.Message -Match 'invoice' }| FL TimeCreated, Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"prevent-cve-2017-11882-cve-2018-0802-cve-2018-0804-cve-2018-0805-cve-2018-0806-cve-2018-0807-eqnedt32exe-exploitation\">Prevent CVE-2017-11882, CVE-2018-0802, CVE-2018-0804, CVE-2018-0805, CVE-2018-0806, CVE-2018-0807 (EQNEDT32.EXE) Exploitation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This is the \u201cEquation Editor\u201d exploit, either patch or mitigate. <a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4055535\/how-to-disable-equation-editor-3-0\">More information on the below process<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">64-Bit Windows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKLM\\SOFTWARE\\Microsoft\\Office\\Common\\COM Compatibility\\{0002CE02-0000-0000-C000-000000000046}\" \/v \"Compatibility Flags\" \/t REG_DWORD \/d 0x400\nreg delete \"HKEY_CLASSES_ROOT\\CLSID\\{0002CE02-0000-0000-C000-000000000046}\"\nreg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Equation.3\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">32-Bit Windows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\Common\\COM Compatibility\\{0002CE02-0000-0000-C000-000000000046}\" \/v \"Compatibility Flags\" \/t REG_DWORD \/d 0x400 \/f\nreg delete \"HKEY_CLASSES_ROOT\\WOW6432Node\\CLSID\\{0002CE02-0000-0000-C000-000000000046}\"\nreg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Equation.3\" \/f\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"determine-if-user-opened-a-document\">Determine if user opened a document<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci \"REGISTRY::HKU\\*\\Software\\Microsoft\\Office\\*\\Word\\Reading Locations\\*\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"prevent-executable-from-running\">Prevent Executable from Running.<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Load in hives and add particular SID to prevent users running named files, helps prevent for example your IIS service account from running cmd.exe or powershell.exe<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg ADD \"HKU\\{SID}\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" \/v DisallowRun \/t REG_DWORD \/d \"00000001\" \/f\nreg ADD \"HKU\\{SID}\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\" \/v malware.exe \/t REG_SZ \/d \"malware.exe\" \/f\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"show-known-file-extensions-and-hidden-files-excluding-os-hidden-files\">Show known file extensions and hidden files (excluding OS hidden files)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg ADD \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" \/v Hidden \/t REG_DWORD \/d \"1\" \/f\nreg ADD \"HKU\\{SID}\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" \/v HideFileExt \/t REG_DWORD \/d \"0\" \/f\nStop-Process -processname explorer\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"open-file-extension-eg-scripts-with-certain-application-elevated-cmd\">Open File Extension (e.g. scripts) with certain application (elevated cmd)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>FTYPE Custom=Notepad.exe \"%1\"\nASSOC .wsf=Custom\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"disable-command-prompt\">Disable Command Prompt<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg ADD \"HKCU\\SOFTWARE\\Microsoft\\Windows\\System\" \/v DisableCMD \/t REG_DWORD \/d 0 \/f\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"locate-possible-dll-search-order-hijacking\">Locate Possible <a href=\"https:\/\/attack.mitre.org\/techniques\/T1038\/\">DLL Search Order Hijacking<\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: A legitimate clean executable can be used to run malicious DLLs based on how the software searches for them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More information on <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/dlls\/dynamic-link-library-search-order\">Microsoft Docs<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\KnownDLLs\"\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\SafeDllSearchMode\"\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"search-order-for-desktop-applications\">Search order for desktop applications:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">If SafeDllSearchMode is enabled (is by default), the search order is as follows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The same directory from which the executable is run.<\/li>\n\n\n\n<li>The System Directory (Usually C:\\Windows\\System32).<\/li>\n\n\n\n<li>The 16-bit System Directory.<\/li>\n\n\n\n<li>The Windows Directory (Usually C:\\Windows).<\/li>\n\n\n\n<li>The Current Directory (From the process which executed the executable).<\/li>\n\n\n\n<li>The directories that are listed in the PATH environment variable.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If SafeDllSearchMode is disabled (SafeDllSearchMode has a reg value of 0), the search order is as follows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The same directory from which the executable is run.<\/li>\n\n\n\n<li>The Current Directory (From the process which executed the executable).<\/li>\n\n\n\n<li>The System Directory (Usually C:\\Windows\\System32).<\/li>\n\n\n\n<li>The 16-bit System Directory.<\/li>\n\n\n\n<li>The Windows Directory (Usually C:\\Windows).<\/li>\n\n\n\n<li>The directories that are listed in the PATH environment variable.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"locate-possible-dll-side-loading\">Locate Possible <a href=\"https:\/\/attack.mitre.org\/techniques\/T1073\/\">Dll Side Loading<\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: A legitimate clean executable can be used to run malicious DLLs based on issues with a manifest file used by the application to load DLLs.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\Winners\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">By placing a malicious DLL in the below locations legitimate binaries may have been used to sideload these malicious DLLs.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>C:\\Windows\\WinSxS<\/li>\n\n\n\n<li>C:\\Windows\\SXS<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"unique-sideload-dll-hashes-may-take-some-time\">Unique Sideload DLL hashes (may take some time)<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>(gci -path C:\\Windows\\WinSxS -recurse -include *.dll|gi -ea SilentlyContinue|filehash).hash|sort -u\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"unsigned-or-invalid-sideload-dlls-there-will-be-a-lot\">Unsigned or Invalid Sideload DLLs (there will be a lot)<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>gci -path C:\\Windows\\WinSxS -recurse -include *.dll | Get-AuthenticodeSignature | Where-Object Status -NE \"Valid\"\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"unsigned-sideload-dlls-less-noise\">Unsigned Sideload DLLs (Less noise)<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>gci -path C:\\Windows\\WinSxS -recurse -include *.dll | Get-AuthenticodeSignature | Where-Object Status -E \"NotSigned\"\ngci -path C:\\Windows\\WinSxS -recurse -include *.ocx | Get-AuthenticodeSignature | Where-Object Status -NE \"Valid\"\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"hash-of-unsigned-sideload-dlls\">Hash of Unsigned Sideload DLLs<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>gci -path C:\\Windows\\WinSxS -recurse -include *.dll | Get-AuthenticodeSignature | Where-Object Status -E \"NotSigned\" | Select Path | gi -ea SilentlyContinue | filehash | sort -u\ngci -path C:\\Windows\\WinSxS -recurse -include *.ocx | Get-AuthenticodeSignature | Where-Object Status -NE \"Valid\" | Select Path | gi -ea SilentlyContinue | filehash | sort -u\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"find-files-without-extensions\">Find files without extensions<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -Path C:\\Users\\&#91;user]\\AppData -Recurse -Exclude *.* -File -Force -ea SilentlyContinue\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"remediate-malicious-files\">Remediate malicious files<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>rmdir %localappdata%\\maliciousdirectory\\ \/s\ndel \/F %localappdata%\\maliciousdirectory\\malware.exe\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Powershell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remove-Item &#91;C:\\Users\\Public\\*.exe]\nRemove-Item -Path &#91;C:\\Users\\Public\\malware.exe] -Force\nGet-ChildItem * -Include *.exe -Recurse | Remove-Item\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"detect-persistent-wmi-subscriptions\">Detect Persistent WMI Subscriptions<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WmiObject -Class __FilterToConsumerBinding -Namespace root\\subscription\nGet-WmiObject -Class __EventFilter -Namespace root\\subscription\nGet-WmiObject -Class __EventConsumer -Namespace root\\subscription\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"remediate-persistent-wmi-subscriptions\">Remediate Persistent WMI Subscriptions<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WMIObject -Namespace root\\subscription -Class __EventFilter -Filter \"Name='&#91;Name]'\" | Remove-WmiObject\nGet-WMIObject -Namespace root\\subscription -Class CommandLineEventConsumer -Filter \"Name='&#91;Name]'\" | Remove-WmiObject\nGet-WMIObject -Namespace root\\subscription -Class __FilterToConsumerBinding -Filter \"__Path like '%&#91;Name]%'\" | Remove-WmiObject \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enumerate-wmi-namespaces\"><a href=\"https:\/\/learn-powershell.net\/2014\/05\/09\/quick-hits-list-all-available-wmi-namespaces-using-powershell\/\">Enumerate WMI Namespaces<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Function Get-WmiNamespace ($Path = 'root')\n{\n\tforeach ($Namespace in (Get-WmiObject -Namespace $Path -Class __Namespace))\n\t{\n\t\t$FullPath = $Path + \"\/\" + $Namespace.Name\n\t\tWrite-Output $FullPath\n\t\tGet-WmiNamespace -Path $FullPath\n\t}\n}\nGet-WMINamespace -Recurse\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mimikatzcredential-extraction-detection\">Mimikatz\/Credential Extraction Detection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The below represent registry keys which make it more difficult for Mimikatz to work. Modification of these keys may indicate an attacker trying to execute Mimikatz within an environment if they were set to their more secure state. Always test prior to changing registry keys such as these in a production environment to ensure nothing breaks.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\n\t- \u201cUseLogonCredential\u201d should be 0 to prevent the password in LSASS\/WDigest\nHKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\n\t- \u201cRunAsPPL\u201d should be set to dword:00000001 to enable LSA Protection which prevents non-protected processes from interacting with LSASS. \n\t- Mimikatz can remove these flags using a custom driver called mimidriver.\n\t\t- This uses the command **!+** and then **!processprotect \/remove \/process:lsass.exe** by default so tampering of this registry key can be indicative of Mimikatz activity.\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\/blob\/master\/kiwi_passwords.yar\">Mimikatz Yara rule<\/a> may also prove useful.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some techniques may involve loading lsasrv.dll or wdigest.dll to extract credentials and may be caught if this is loaded legitimately using:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist \/m wdigest.dll\ntasklist \/m lsasrv.dll\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You may be able to detect changes to the below registry keys which can be used to load an arbitrary DLL and extract credentials, more information from <a href=\"https:\/\/blog.xpnsec.com\/exploring-mimikatz-part-1\/\">Adam Chester<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS \/v LsaDbExtPt\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An adversary may also tamper with the number of cached logons a system holds (default of 10).<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" \/v CachedLogonsCount\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"netntlm-downgrade-attack-detection\">NetNTLM Downgrade Attack Detection<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa \/v LMCompatibilityLevel\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa \/v RestrictSendingNTLMTraffic \nreg query HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa \/v NTLMMinClientSec\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/fox-it\/danderspritz-evtx\">DanderSpritz eventlogedit<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"putty-detection\">Putty Detection<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKCU\\Software\\SimonTatham\\PuTTY\\Sessions \/s\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"installed-updates\">Installed Updates<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(WMI Quick Fix Engineering)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic qfe\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"installed-softwarepackages\">Installed Software\/Packages<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\ \/s \/f DisplayName\nreg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\ \/s \/f DisplayName\nwmic product get name,version \/format:csv\nwmic product get \/ALL\ndism \/online \/get-packages\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Powershell: Full List for all users using uninstall keys in registry<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$(Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*; Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*;New-PSDrive -Name HKU -PSProvider Registry -Root Registry::HKEY_USERS| Out-Null;$UserInstalls += gci -Path HKU: | where {$_.Name -match 'S-\\d-\\d+-(\\d+-){1,14}\\d+$'} | foreach {$_.PSChildName };$(foreach ($User in $UserInstalls){Get-ItemProperty HKU:\\$User\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*});$UserInstalls = $null;try{Remove-PSDrive -Name HKU}catch{};)|where {($_.DisplayName -ne $null) -and ($_.Publisher -ne $null)} | Select DisplayName,DisplayVersion,Publisher,InstallDate,UninstallString |FT\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-information\">Process information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(pslist requires sysinternals pslist.exe):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist -v\nwmic process list full \/format:csv\nwmic process get name,parentprocessid,processid \/format:csv\nwmic process get ExecutablePath,processid \/format:csv\nwmic process get name,ExecutablePath,processid,parentprocessid \/format:csv | findstr \/I \"appdata\"\nwmic process where processid=&#91;PID] get parentprocessid\nwmic process where processid=&#91;PID] get commandline\nwmic process where \"commandline is not null and commandline!=''\" get name,commandline \/format:csv\ngwmi win32_process -Filter \"name like 'powershell.exe'\" | select name,processId,commandline|FL\ngwmi win32_process | select name,processId,path,commandline|FL\ngwmi win32_process |FL ProcessID,ParentProcessID,CommandLine,@{e={$_.GetOwner().User}}\ngwmi win32_process | Sort-Object -Property ProcessID | FL ProcessID,Path,CommandLine,ParentProcessID,@{n=\"User\";e={$_.GetOwner().User}},@{n=\"ParentProcessPath\";e={gps -Id $_.ParentProcessID|Select -exp Path}}\npslist\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/gist.github.com\/JPMinty\/f4d60adafdfbc12b0e4226a27bf1dcb0\">PowerShell Module to show Process Tree<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import-module .\\Get-ProcessTree.ps1\nGet-ProcessTree -Verbose | FT Id, Level, IndentedName, ParentId,Path,CommandLine\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"current-process-execution-or-module-loads-from-temporary-directories\">Current Process execution or module loads from temporary directories<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This will likely have some false positives as it\u2019s just a wildcard. So in this case using \u2018temp\u2019 can come up in words such as \u2018ItemProvider\u2019.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(gps -Module -ea 0).FileName|Select-String \"Appdata\",\"ProgramData\",\"Temp\",\"Users\",\"public\"|unique\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"current-process-execution-or-module-loads-from-temporary-directories--hash\">Current Process execution or module loads from temporary directories + hash<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$A=((gps -Module -ea 0).FileName|Select-String \"Appdata\",\"ProgramData\",\"Temp\",\"Users\",\"public\"|sort|unique);foreach ($B in $A) {filehash $B};\n$A=((gps).Path|Select-String \"Appdata\",\"ProgramData\",\"Temp\",\"Users\",\"public\"|sort|unique);foreach ($B in $A) {filehash $B};\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scan-for-malware-with-windows-defender\">Scan for malware with Windows Defender<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>\"%ProgramFiles%\\Windows Defender\\MpCmdRun.exe\" -Scan -ScanType 1\n\"%ProgramFiles%\\Windows Defender\\MpCmdRun.exe\" -Scan -ScanType 2\n\"%ProgramFiles%\\Windows Defender\\MpCmdRun.exe\" -Scan -ScanType 3 -File C:\\Users\\&#91;username]\\AppData\\Local\\Temp\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Types are as follows<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>1: Quick scan<\/li>\n\n\n\n<li>2: Full system scan<\/li>\n\n\n\n<li>3: File and directory custom scan<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-windows-defender-for-excluded-files-and-default-actions\">Check Windows Defender for excluded files and default actions<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\" \/s\nGet-ChildItem 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions'\nGet-MpPreference | Select Exclusion*\nGet-MpPreference | Select *DefaultAction\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"delete-windows-defender-excluded-files\">Delete Windows Defender excluded files<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\" \/v \"&#91;RegkeyValue]\"\nreg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\"\nRemove-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths' -Name \"Paths\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-and-set-access-control-lists\">Check and Set Access Control Lists<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Acl -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths'|FL\nGet-Acl -Path &#91;FileWithRequiredAccess] | Set-Acl -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths'\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"change-ace-for-everyone-on-folder-and-subfilesfolders\">Change ACE for \u201ceveryone\u201d on folder and subfiles\/folders<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"grant-everyone-full-access\">Grant everyone full access<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>icacls \"C:\\{DESIREDFOLDERPATH}\" \/grant everyone:(CI)(OI)F \/T\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"remove-ace-entries-for-everyone\">Remove ACE entries for \u201ceveryone\u201d<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>icacls \"C:\\{DESIREDFOLDERPATH}\" \/remove everyone \/T\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"disable-unwanted-windows-binaries-via-base64-encoding-and-removal\">Disable unwanted windows binaries (via Base64 encoding and removal)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This is one method, not the only way.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>certutil -encode C:\\windows\\system32\\mshta.exe C:\\windows\\system32\\mshta.disabled\nGet-Acl -Path C:\\windows\\system32\\mshta.exe | Set-Acl -Path C:\\windows\\system32\\mshta.disabled\ntakeown \/f C:\\windows\\system32\\mshta.exe\nicacls C:\\windows\\system32\\mshta.exe \/grant administrators:F\nrm C:\\windows\\system32\\mshta.exe\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enable-windows-binaries-via-base64-decoding-and-removal\">Enable windows binaries (via Base64 decoding and removal)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>certutil -decode C:\\windows\\system32\\mshta.disabled C:\\windows\\system32\\mshta.exe\nGet-Acl -Path C:\\windows\\system32\\mshta.disabled | Set-Acl -Path C:\\windows\\system32\\mshta.exe\ntakeown \/f C:\\windows\\system32\\mshta.disabled\nicacls C:\\windows\\system32\\mshta.disabled \/grant administrators:F\nrm C:\\windows\\system32\\mshta.disabled\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"make-multiple-files-visible-and-remove-superhidden\">Make multiple files visible and remove \u2018superhidden\u2019<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gci C:\\{DESIREDFOLDERPATH} -force -recurse -ea 0 | foreach {$_.attributes = 'Normal'};\nattrib -s -h C:\\{DESIREDFOLDERPATH}\\*.*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-security-descriptor-definition-language-sddl-and-access-control-entries-ace-for-services\">Check Security Descriptor Definition Language (SDDL) and Access Control Entries (ACE) for services<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sc sdshow &lt;servicename&gt;\n$A=get-service;foreach ($service in $A){$service;sc.exe sdshow $service.Name}\n$A=get-service;foreach ($service in $A){$service;sc.exe sdshow $service.Name|Select-String \"A;*DC\"}\n$A=get-service;foreach ($service in $A){$service;sc.exe sdshow $service.Name|Select-String \"A;*WD\"}\n$A=get-service;foreach ($service in $A){$service;sc.exe sdshow $service.Name|Select-String \"A;*WO\"}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">More information on <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/secauthz\/ace-strings\">ACE Strings<\/a> and the level of access they can provide.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"kill-unstoppable-serviceprocess\">Kill \u201cUnstoppable\u201d Service\/Process<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\{SERVICENAME}\\XblAuthManager\\Parameters \/V start \/T reg_dword \/D 4 \/F\nsc.exe sdset {SERVICENAME} \"D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)\"\nGet-Service -Name {SERVICENAME} | Set-Service -Status Paused\nsc.exe config {SERVICENAME} start= disabled\nGet-Service -Name {SERVICENAME} | Set-Service -Status Stopped\ntasklist \/FI \"IMAGENAME eq {SERVICEEXENAME}\"\ntaskkill \/F \/t \/IM \"{SERVICEEXENAME}\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-hash-for-all-running-executables\">Obtain hash for all running executables<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Issues with spaces in names but supports CMD.exe<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>FOR \/F %i IN ('wmic process where \"ExecutablePath is not null\" get ExecutablePath') DO certutil -hashfile %i SHA256 | findstr -v : &gt;&gt; output.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Powershell (Special thanks Lee Holmes)<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(gps|gi -ea SilentlyContinue|filehash).hash|sort -u\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>My less efficient powershell<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>foreach ($process in Get-WmiObject win32_process | where {$_.ExecutablePath -notlike \"\"}) {Get-FileHash $process.ExecutablePath | Format-List}\n\nforeach ($process in Get-WmiObject win32_process | where {$_.ExecutablePath -notlike \"\"}) {Get-FileHash $process.ExecutablePath | select Hash -ExpandProperty Hash}\n\n$A = $( foreach ($process in Get-WmiObject win32_process | where {$_.ExecutablePath -notlike \"\"}) {Get-FileHash $process.ExecutablePath | select Hash -ExpandProperty Hash}) |Sort-Object| Get-Unique;$A\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-hash-and-established-network-connections-for-running-executables-with-dns-cache\">Obtain hash and established network connections for running executables with dns cache<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State Established | Select RemoteAddress, RemotePort, OwningProcess, @{n=\"Path\";e={(gps -Id $_.OwningProcess).Path}},@{n=\"Hash\";e={(gps -Id $_.OwningProcess|gi|filehash).hash}}, @{n=\"User\";e={(gps -Id $_.OwningProcess -IncludeUserName).UserName}},@{n=\"DNSCache\";e={(Get-DnsClientCache -Data $_.RemoteAddress -ea 0).Entry}}|sort|gu -AS|FT\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-hash-and-listening-network-connections-for-running-executables\">Obtain hash and listening network connections for running executables<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State LISTEN | Select LocalAddress, LocalPort, OwningProcess, @{n=\"Path\";e={(gps -Id $_.OwningProcess).Path}},@{n=\"Hash\";e={(gps -Id $_.OwningProcess|gi|filehash).hash}}, @{n=\"User\";e={(gps -Id $_.OwningProcess -IncludeUserName).UserName}}|sort|gu -AS|FT\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-hash-and-possible-tunneled-network-connections-for-running-executables\">Obtain hash and possible tunneled network connections for running executables<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State ESTABLISHED |? LocalAddress -Like \"::1\" | Select RemoteAddress, RemotePort, OwningProcess, @{n=\"Path\";e={(gps -Id $_.OwningProcess).Path}},@{n=\"Hash\";e={(gps -Id $_.OwningProcess|gi|filehash).hash}}, @{n=\"User\";e={(gps -Id $_.OwningProcess -IncludeUserName).UserName}},@{n=\"DNSCache\";e={(Get-DnsClientCache -Data $_.RemoteAddress).Entry}}|sort|gu -AS|FT\nGet-NetTCPConnection -State Established |? LocalAddress -Like \"127.0.0.1\"| Select RemoteAddress, RemotePort, OwningProcess, @{n=\"Path\";e={(gps -Id $_.OwningProcess).Path}},@{n=\"Hash\";e={(gps -Id $_.OwningProcess|gi|filehash).hash}}, @{n=\"User\";e={(gps -Id $_.OwningProcess -IncludeUserName).UserName}},@{n=\"DNSCache\";e={(Get-DnsClientCache -Data $_.RemoteAddress).Entry}}|sort|gu -AS|FT\nGet-NetTCPConnection -State LISTEN |? LocalAddress -Like \"127.0.0.1\" | Select LocalAddress, LocalPort, OwningProcess, @{n=\"Path\";e={(gps -Id $_.OwningProcess).Path}},@{n=\"Hash\";e={(gps -Id $_.OwningProcess|gi|filehash).hash}}, @{n=\"User\";e={(gps -Id $_.OwningProcess -IncludeUserName).UserName}}|sort|gu -AS|FT\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-workstation-name-for-tunneled-authentication\">Obtain workstation name for tunneled authentication<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='::';} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-hash-of-dlls-currently-loaded-by-processes\">Obtain hash of DLLs currently loaded by processes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$A = $(foreach ($dll in gps|select -ExpandProperty modules -ea SilentlyContinue|? FileName -NotLike \"C:\\Windows\\SYSTEM32\\*\"){Get-FileHash $dll.FileName| select Hash -ExpandProperty Hash})|Sort-Object| Get-Unique;$A\n(gps).Modules.FileName | sort -uniq | foreach {filehash $_ -ea 0}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-processes-where-binaries-file-version-doesnt-match-os-release\">Obtain processes where binaries file version doesn\u2019t match OS Release<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gps -FileVersionInfo -ea 0|? {$_.ProductVersion -notmatch $(&#91;System.Environment]::OSVersion.Version|Select -exp Build)}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-process-binary-file-external-names\">Obtain process binary file external names<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gps -FileVersionInfo -ea 0 | sort -uniq | Select OriginalFilename,InternalName,Filename\ngps -module -FileVersionInfo -ea 0 | sort -uniq | Select OriginalFilename,InternalName,Filename\ngps -module -FileVersionInfo -ea 0 | sort -uniq | FL *name,*version\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-processes-running-which-are-running-a-dll\">Obtain processes running which are running a DLL<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$A=(gps|select -ExpandProperty modules -ea SilentlyContinue | where {$_.ModuleName -Like 'sechost.dll' -or $_.ModuleName -Like 'ntdll.dll'} | sort -u);if($A&#91;0].Size -ge -1) {foreach ($Module in $A){tasklist \/m $Module.ModuleName}};\ngps | FL ProcessName, @{l=\"Modules\";e={$_.Modules|Out-String}}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-hash-of-unsigned-or-invalid-dlls-currently-loaded-by-processes\">Obtain hash of unsigned or invalid DLLs currently loaded by processes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$A=$(foreach ($dll in gps|select -ExpandProperty modules -ea SilentlyContinue){Get-AuthenticodeSignature $dll.FileName |Where-Object Status -NE \"Valid\"|Select Path});$B=$(foreach ($dll in $A){Get-FileHash $dll.Path| select Hash -ExpandProperty Hash})|Sort-Object| Get-Unique;$B\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-list-of-unsigned-dlls-currently-loaded-by-processes\">Obtain list of unsigned DLLs currently loaded by processes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gps | select -exp modules -ea 0 | Select -exp FileName | Get-AuthenticodeSignature|Where-Object Status -NE \"Valid\"\ngps | select -exp modules -ea 0 | Select -exp FileName | Get-AuthenticodeSignature | ? Status -NE \"Valid\" | FL Path\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-dll-information-listdlls\">Obtain DLL information <a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/listdlls\">ListDLLs<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>listdlls &#91;-r] &#91;-v | -u] &#91;processname|pid]\nlistdlls &#91;-r] &#91;-v] &#91;-d dllname]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-unsigned-dll-information-loaded-by-processes\">Obtain unsigned DLL information loaded by processes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>listdlls -u\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-dlls-in-use-by-processes\">Obtain DLLs in use by processes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>listdlls -v processname -accepteula\nlistdlls -v -d dllname.dll -accepteula\nlistdlls -v PID -accepteula\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"determine-handles-on-a-file\">Determine handles on a file<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>handle &#91;&#91;-a] &#91;-u] | &#91;-c &lt;handle&gt; &#91;-l] &#91;-y]] | &#91;-s]] &#91;-p &lt;processname&gt;|&lt;pid&gt;&gt; &#91;name]\nhandle -a -u -s -p exp\nhandle windows\\system\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"verify-eternalblue-patch-ms17-010-is-installed---microsoft\">Verify EternalBlue Patch (MS17-010) is installed &#8211; <a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4023262\/how-to-verify-that-ms17-010-is-installed\">Microsoft<\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This impacts the SMB 1.0 Server Driver, if you don\u2019t have the below, then it\u2019s not installed. If you do you can use the above to determine patch level.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>get-item C:\\Windows\\system32\\drivers\\srv.sys | FL VersionInfo\nget-hotfix -id KB&lt;111111&gt;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-txt-records-from-recently-resolved-domains\">Obtain TXT records from recently resolved domains<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>foreach ($domains in Get-DnsClientCache){Resolve-DnsName $domains.Entry -Type \"TXT\"|Select Strings|? Strings -NotLike \"\"};\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-all-appdata-files-for-unsigned-or-invalid-executables\">Check all Appdata files for unsigned or invalid executables<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -Recurse $env:APPDATA\\..\\*.exe -ea SilentlyContinue| ForEach-object {Get-AuthenticodeSignature $_ -ea SilentlyContinue} | Where-Object {$_.status -ine \"Valid\"}|Select Status,Path\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-for-execuables-in-local-system-user-profile-and-files\">Check for execuables in Local System User Profile and Files<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem C:\\Windows\\*\\config\\systemprofile -recurse -force -ea 0 -include *.exe, *.dll *.lnk\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"investigate-wmi-usage\">Investigate WMI Usage<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Requires <a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/strings\">Strings<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>strings -q C:\\windows\\system32\\wbem\\repository\\objects.data\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"find-executables-and-scripts-in-path-directories-envpath\">Find executables and scripts in Path directories ($env:Path)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Command * -Type Application | FT -AutoSize\nGet-Command -Name * | FL FileVersionInfo\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"find-files-createdwritten-based-on-date\">Find files created\/written based on date<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem C:\\ -recurse -ea SilentlyContinue -force | where-object { $_.CreationTime.Date -match \"12\/25\/2014\"}\nGet-ChildItem C:\\ -recurse -ea SilentlyContinue -force | where-object { $_.LastWriteTime -match \"12\/25\/2014\"}\nGet-ChildItem C:\\ -recurse -ea SilentlyContinue -force | where-object { $_.CreationTime.Hour -gt 2 -and $_.CreationTime.Hour -lt 15}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-running-executables-for-malware-via-virustotal\">Check running executables for malware via VirusTotal<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Note: VT Has a rate limit for the Public API so this won\u2019t work if you are using the Public API. All 1 liners require VTAPIKey to be set as your VirusTotal API key<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>foreach ($process in Get-WmiObject win32_process | where {$_.ExecutablePath -notlike \"\"}) {Invoke-RestMethod -Method 'POST' -Uri 'https:\/\/www.virustotal.com\/vtapi\/v2\/file\/report' -Body @{ resource =(Get-FileHash $process.ExecutablePath | select Hash -ExpandProperty Hash); apikey = \"&#91;VTAPIKey]\"}}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>This query uses a 15 second timeout to ensure only 4 queries are submitted a minute<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>foreach ($process in Get-WmiObject win32_process | where {$_.ExecutablePath -notlike \"\"}) {Invoke-RestMethod -Method 'POST' -Uri 'https:\/\/www.virustotal.com\/vtapi\/v2\/file\/report' -Body @{ resource =(Get-FileHash $process.ExecutablePath | select Hash -ExpandProperty Hash); apikey = \"&#91;VTAPIKey]\"};Start-Sleep -Seconds 15;}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>This query uses a 15 second timeout to ensure only 4 queries are submitted a minute and only unique hashes are queried<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$A = $( foreach ($process in Get-WmiObject win32_process | where {$_.ExecutablePath -notlike \"\"}) {Get-FileHash $process.ExecutablePath | select Hash -ExpandProperty Hash}) |Sort-Object| Get-Unique -AsString; foreach ($process in $A) {Invoke-RestMethod -Method 'POST' -Uri 'https:\/\/www.virustotal.com\/vtapi\/v2\/file\/report' -Body @{ resource =($process); apikey = \"&#91;VTAPIKey]\"};Start-Sleep -Seconds 15;} \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scan-systems-for-ioaioc-yara\">Scan systems for IOA\/IOC (Yara)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/Neo23x0\/Loki\">Loki Scanner<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>loki-upgrader.exe\nloki.exe -p &#91;Directory]\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.crowdstrike.com\/resources\/community-tools\/crowdresponse\/\">Crowdresponse Scanner<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>CrowdResponse -v -i config.txt -o out.xml\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/binalyze.com\/download\/irec\/\">IREC Tactical<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>IREC.exe --triage-memory\nIREC.exe -ad \"\\\\MACHINE\\IREC-DIR\" --triage-ruleset MyYaraRules --triage-memory \n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/virustotal\/yara\/releases\/latest\">Yara<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>yara32.exe -d filename=&#91;file defined in ruleset.yar] &#91;ruleset.yar] &#91;file to scan]\nyara32.exe -d filename=&#91;svchost.exe] &#91;ruleset.yar] -r &#91;directory to scan]\nyara64.exe yararule.yar -r C:\nyara64.exe yararule.yar -r C: -f 2&gt; $null\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Yara Linux<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>yara rule.yara malware.exe -s\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"kill-malicious-process\">Kill malicious process<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic process where name=\"malware.exe\" call terminate\nwmic process where processid=&#91;PID] delete\ntaskkill \/IM malware.exe\ntaskkill \/PID &#91;PID] \/T\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Call terminate allows you to specify an exit status in terms of a signed integer or a quoted negative value. Both methods essentially function the same by calling TerminateProcess.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"dump-full-process-memory\">Dump full process memory<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(procdump requires systinternals procdump.exe)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>procdump -ma &#91;processID]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"live-triage-of-memory\">Live Triage of Memory<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Shout-out to Matt Graeber, Jared Atkinson and Joe Desimone for the awesome work that has gone into these scripts. Note: Not all tested, appears to work with a standard Meterpreter payload, and by default with Cobalt Strike.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/JPMinty\/PowerShellArsenal\">PowerShellArsenal<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/gist.github.com\/JPMinty\/beffcd18d8ec06b73643c2f38cde384d\">Get-InjectedThread<\/a><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"locate-possible-shellcode-within-process-via-injected-thread\">Locate Possible Shellcode within process via Injected Thread<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Import-Module .\\Get-InjectedThread.ps1\nGet-InjectedThread\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"obtain-possible-shellcode-within-process-as-hex\">Obtain Possible Shellcode within process as Hex<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>(Get-InjectedThread|Select -exp Bytes|ForEach-Object ToString X2) -join ''\n(Get-InjectedThread|? {$_.ThreadId -match '{PID}'}|Select -exp Bytes|ForEach-Object ToString X2) -join ''\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"obtain-possible-shellcode-within-process-as-hex-1\">Obtain Possible Shellcode within process as Hex<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>(Get-InjectedThread|Select -exp Bytes|ForEach-Object ToString X2) -join '\\x'\n(Get-InjectedThread|? {$_.ThreadId -match '{PID}'}|Select -exp Bytes|ForEach-Object ToString X2) -join '\\x'\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"basic-memory-analysis-via-powershellarsenal\">Basic Memory Analysis via PowerShellArsenal<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>import-module .\\PowerShellArsenal.psd1\nFind-ProcessPEs\nGet-ProcessStrings\nGet-ProcessMemoryInfo -ProcessID {PID}\nGet-VirtualMemoryInfo\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"locate-possible-shellcode-address-space\">Locate Possible Shellcode Address Space<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ProcessMemoryInfo {PID} | ? {$_.AllocationProtect -eq \"PAGE_EXECUTE_READWRITE\"}\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"find-meterpreter-in-process-memory\">Find Meterpreter in Process Memory:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Ref: <a href=\"https:\/\/github.com\/rapid7\/metasploit-framework\/wiki\/Meterpreter\">Meterpreter Wiki<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Find-ProcessPEs {PID} | ?{$_.ModuleName -eq \"metsrv.dll\" -OR $_.ModuleName -eq \"ext_server_stdapi.dll\" -OR $_.ModuleName -like \"ext_server_*.dll\"} | FL ProcessID,ModuleName,Imports;\n$A=$(gps | Select -exp Id); foreach ($process in $A){Find-ProcessPEs $process | ?{$_.ModuleName -eq \"metsrv.dll\"} | FL ProcessID,ModuleName,Imports};\n$A=$(gps | Select -exp Id);\tforeach ($process in $A){Find-ProcessPEs $process | ?{$_.ModuleName -eq \"metsrv.dll\" | FL ProcessID,ModuleName,Imports};\n$A=$(gps | Select -exp Id);\tforeach ($process in $A){Find-ProcessPEs $process | ?{$_.ModuleName -eq \"metsrv.dll\" -OR $_.ModuleName -eq \"ext_server_stdapi.dll\" -OR $_.ModuleName -like \"ext_server_*.dll\"} | FL ProcessID,ModuleName,Imports};\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"find-cobalt-strike-in-process-memory\">Find Cobalt Strike in Process Memory:<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Find-ProcessPEs {PID} | ?{$_.ModuleName -eq \"beacon.dll\" -OR $_.ModuleName -eq \"beacon x64.dll\" -OR $_.ModuleName -eq \"beacon.x64.dll\"} | FL ProcessID,ModuleName,Imports;\n$A=$(gps | Select -exp Id); foreach ($process in $A){Find-ProcessPEs $process | ?{$_.ModuleName -eq \"beacon.dll\"} | FL ProcessID,ModuleName,Imports};\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"network-connections\">Network connections<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(tcpvcon requires sysintenals tcpvcon.exe):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ipconfig \/all\nnetstat \u2013anob\nnetstat -ano\nTcpvcon -a\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"routing-table-and-arp-cache\">Routing table and ARP cache<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>route print\narp -a\nGet-NetNeighbor\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"contents-of-dns-resolver\">Contents of DNS resolver<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(useful for recent web history)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ipconfig \/displaydns\nGet-DnsClientCache | FT -AutoSize\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enable-dns-logging\">Enable DNS Logging<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil set-log \"Microsoft-Windows-DNS-Client\/Operational\" \/enabled:true\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">OR<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$DNSLogs = 'Microsoft-Windows-DNS-Client\/Operational'\n$DNSContainer = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $logName\n$DNSContainer.IsEnabled=$true\n$DNSContainer.SaveChanges()\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scan-dns-logs\">Scan DNS Logs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-DNS-Client\/Operational'; Id='3010';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-DNS-Client\/Operational'; Id='3020';} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scan-dns-logs-and-output-unique-dns-queries\">Scan DNS Logs and output unique DNS Queries<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$events=Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-DNS-Client\/Operational'; Id='3020';};\n$output = @();\nforeach ($Event in $events){\n$data = New-Object -TypeName PSObject;\n$XML = &#91;xml]$Event.ToXml();\n$query=$XML.Event.EventData.Data|?{$_.Name -eq 'QueryName'} | Select -exp InnerText;\n$result=$XML.Event.EventData.Data|?{$_.Name -eq 'QueryResults'} | Select -exp InnerText;\n$data `\n| Add-Member NoteProperty Query \"$query\" -PassThru `\n| Add-Member NoteProperty QueryResults \"$result\" -PassThru | Out-Null\n$output += $data;\n}\n$output = $output | sort Query | unique -AsString;\n$output\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"hostname-to-corresponding-ips-from-list\">Hostname to corresponding IPs from list<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$listofhostnames = cat Hostnames.txt;\nforeach ($hostname in $listofhostnames){\ntry{&#91;System.Net.Dns]::gethostaddresses(\"$hostname\")|FT $hostname, IPAddressToString}catch\n{}}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"t1074-data-staging\">T1074 Data Staging<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Examples of some known staging directories, lots of false positives likely.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gci C:\\ProgramData\\ -recurse -include .* -ea 0 -force | ?{ $_.PSIsContainer }\ngci C:\\Windows\\Temp -recurse -ea 0 -force | ?{ $_.PSIsContainer }\nls C:\\ProgramData\\tmp\\log.log\nls C:\\ProgramData\\log.log\nls C:\\ProgramData\\google\\\nls C:\\ProgramData\\Sun\\low\nls env:temp\\SMB\nls $Recycle.Bin\nls C:\\ProgramData\\.rnd\nls C:\\inetpub\\\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"latest-system-activities\">Latest system activities<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(requires Nirsoft\u2019s LastActivityView)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LastActivityView.exe \/shtml \"LastActivityView.html\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"driver-information\">Driver information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic sysdriver list brief \/format:csv\ndriverquery\ndriverquery \/FO list \/v\ndriverquery \/si\nwmic sysdriver list full\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-and-extra-information\">Process and extra information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist \/m\ntasklist \/m \/fi \"pid eq &#91;PID]\"\ntasklist \/svc\nwmic process where processid=&#91;PID] get commandline\ntasklist \/v\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"hosts-file-and-serviceport-mapping\">Hosts file and service&gt;port mapping<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>type %SystemRoot%\\System32\\drivers\\etc\\hosts\ntype %SystemRoot%\\System32\\drivers\\etc\\services\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recycle-bin-forensics\">Recycle Bin Forensics<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Named as $I = Metadata of file (Info)<\/li>\n\n\n\n<li>Named as $R = The file contents itself (Recovery)<\/li>\n\n\n\n<li>Located at %SystemRoot%\\..\\$Recycle.Bin in win vista and later commonly (C:$Recycle.Bin)<\/li>\n\n\n\n<li>Use dir \/a via cmd to show recycle bin SID folders and files<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"dcom-information\">DCOM Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic dcomapp get \/all \/format:List\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"service-information\">Service Information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(psservice requires sysinternals psservice.exe):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic service list full\nnet start\nsc query\nwmic loadorder\npsservice\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"stop-and-disabledelete-malicious-service\">Stop and disable\/delete malicious service<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>net stop &#91;servicename]\nsc config &#91;servicename] start= disabled\nsc delete &#91;servicename]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"disable-internet-explorer\">Disable Internet Explorer<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4013567\/how-to-disable-internet-explorer-on-windows\">More Information: MS Docs<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dism \/online \/Disable-Feature \/FeatureName:Internet-Explorer-Optional-amd64\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"cmd-history\">cmd history<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>doskey \/history\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Linux Subsystem for Windows 10 may have history in a location such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\&#91;User]\\AppData\\Local\\Packages\\CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc\\LocalState\\rootfs\\home\\&#91;user]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"files-greater-than-a-10mb\">Files greater than a 10mb<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>FOR \/R C:\\ %i in (*) do @if %~zi gtr 10000000 echo %i %~zi\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"temp-files-greater-than-10mb\">Temp files greater than 10mb<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>FOR \/R C:\\Users\\&#91;User]\\AppData %i in (*) do @if %~zi gtr 10000000 echo %i %~zi\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"locate-process-handles-eg-files-open-by-process\">Locate process handles (e.g. files open by process)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Note: Requires handles\/handles64.exe from sysinternals<\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>handle64.exe -p &#91;PID\/name] -nobanner\nhandle64.exe -a -p &#91;PID\/name] -nobanner\nhandle64.exe -a -l -p &#91;PID\/name] -nobanner\nhandle64.exe -a -l -u -p keepass -nobanner\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"close-process-handles-eg-files-open-by-process\">Close process handles (e.g. files open by process)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Note: Requires handles\/handles64.exe from sysinternals<\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>handle64.exe -c &#91;hexhandleref] -p &#91;PID] -nobanner\nhandle64.exe -c &#91;hexhandleref] -y -p &#91;PID] -nobanner\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"event-logs-between-a-timeframe\">Event logs between a timeframe<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This tool is useful for gathering all windows events within a given timeframe: <a href=\"https:\/\/github.com\/BeanBagKing\/EventFinder2\">Event Finder2<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-audit-policies\">Check audit policies<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>auditpol \/get \/category:*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"set-logging-on-all-successfailure-events\">Set logging on all success\/failure events<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(WARNING THIS WILL PRODUCE A LOT OF NOISE, TAILOR TO YOUR NEEDS)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auditpol \/set \/category:* \/success:enable \/failure:enable\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enable-logging-of-process-creation\">Enable logging of process creation<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>auditpol \/set \/subcategory:\"Process Creation\" \/success:enable \/failure:enable\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scan-process-creation-logs-for-appdata\">Scan process creation logs for \u2018appdata\u2019<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4688';}| ? {$_.Message -match 'appdata'}|FL TimeCreated, Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-for-windows-security-logging-bypass\">Check for Windows Security Logging Bypass<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Special thanks to <a href=\"https:\/\/twitter.com\/0gtweet\/status\/1182516740955226112\">Grzegorz Tworek &#8211; 0gtweet<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\System\\CurrentControlSet\\Control\\MiniNt\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-group-policies\">Check group policies<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gpresult \/Z \/SCOPE COMPUTER\ngpresult \/Z \/SCOPE USER\ngpresult \/R \/SCOPE COMPUTER\ngpresult \/R \/SCOPE USER\ngpresult \/r \/z\nls C:\\Users\\&#91;username]\\AppData\\Local\\GroupPolicy\\DataStore\nls C:\\Windows\\system32\\GroupPolicy\\DataStore\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-mode-settings-for-ports\">Obtain mode settings for ports<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>mode\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"event-logs-for-offline-analysis\">Event Logs for offline analysis<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Event logs can be found: %SystemRoot%\\System32\\winevt\\Logs<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil epl System &#91;Location]\\System.evtx\nwevtutil epl Security &#91;Location]\\Security.evtx\nwevtutil epl Application &#91;Location]\\Application.evtx\nwevtutil epl \"Windows PowerShell\" &#91;Location]\\Powershell.evtx\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">OR:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>esentutl.exe \/y \/vss C:\\Windows\\System32\\winevt\\Logs\\Security.evtx \/d &#91;Location]\\Security.evtx\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Copy all event logs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>XCOPY C:\\Windows\\System32\\winevt\\Logs &#91;Location] \/i\nXCOPY C:\\WINDOWS\\system32\\LogFiles\\ &#91;Location] \/i\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"quickly-scan-event-logs-with-deepbluecli\">Quickly scan event logs with <a href=\"https:\/\/github.com\/sans-blue-team\/DeepBlueCLI\">DeepblueCLI<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\DeepBlue.ps1 .\\evtx\\psattack-security.evtx | FL\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"event-tracing-for-windows-etw\">Event Tracing for Windows (ETW).<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Event tracing is how a Provider (an application that contains event tracing instrumentation) creates items within the Windows Event Log for a consumer. This is how event logs are generated, and is also a way they can be tampered with. More information on this architecture can be found below.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/etw\/about-event-tracing\">Event Tracing Architecture<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A great <a href=\"https:\/\/medium.com\/palantir\/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63\">post by Matt Graeber<\/a> goes into some depth on how this works and some common ways of interacting with ETW Traces.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"list-running-trace-sessions\">List Running Trace Sessions<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>logman query -ets\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"list-providers-that-a-trace-session-is-subscribed-to\">List Providers That a Trace Session is Subscribed to<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>logman query \"EventLog-System\" -ets\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"list-all-etw-providers\">List all ETW Providers<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>logman query providers\nreg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers\\\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"view-providers-process-is-sending-events-to\">View providers process is sending events to<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>logman query providers -pid {PID}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"setup-custom-log-tracing\">Setup Custom Log Tracing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Special thanks to <a href=\"https:\/\/twitter.com\/spotheplanet\">Spotless<\/a> for his <a href=\"https:\/\/www.ired.team\/miscellaneous-reversing-forensics\/etw-event-tracing-for-windows-101\">crash course<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"query-providers-available-and-their-keyword-values\">Query Providers Available and their keyword values<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>logman query providers\nlogman query providers Microsoft-Windows-WinHttp\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Take note of wanted values.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"initiate-tracing-session\">Initiate Tracing Session<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>logman create trace &lt;TRACENAMEHERE&gt; -ets\nlogman query &lt;TRACENAMEHERE&gt; -ets\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"update-trace-with-wanted-providers\">Update trace with wanted providers<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: the mask is the combined values wanted. For example if a keyword was 0x1 and another 0x16 and you wanted both you\u2019d use 0x17.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>logman update &lt;TRACENAMEHERE&gt; -p Microsoft-Windows-WinHttp 0x100000000 -ets\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"delete-subscription-and-providers\">Delete Subscription and Providers<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>logman update trace &lt;TRACENAMEHERE&gt; --p Microsoft-Windows-WinHttp 0x100000000 -ets\nlogman stop &lt;TRACENAMEHERE&gt; -ets\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"event-logtracing-tampering-detection\">Event Log\/Tracing Tampering Detection<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\ \/s \/v File\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\ \/s \/v MaxSize\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\ \/s \/v Retention\nsc.exe query eventlog\ngci REGISTRY::HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\ -recurse\nreg query HKLM\\SYSTEM\\CurrentControlSet\\control\\WMI\\AutoLogger\\ \/s \/v enable*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"timeline-windows-event-logs\">Timeline Windows Event Logs.<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An easy way to explore Windows event logs is to dump them into a normalized csv format using EvtxExplorer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">EvtxExplorer:<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>EvtxECmd.exe -d \"C:\\Windows\\System32\\winevt\\Logs\" --csv C:\\ --csvf AllEvtx.csv\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">From here you can analyse the CSV using Timeline explorer to view relevant information and group by MAPs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">TimelineExplorer:<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"super-timeline-a-host\">Super Timeline a host:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This can be done using <a href=\"https:\/\/plaso.readthedocs.io\/en\/latest\/\">Plaso (Log2Timeline)<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Common IIS logs can often be found in the below locations:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemDrive%\\inetpub\\logs\\LogFiles<\/li>\n\n\n\n<li>%SystemRoot%\\System32\\LogFiles\\W3SVC1<\/li>\n\n\n\n<li>%SystemDrive%\\inetpub\\logs\\LogFiles\\W3SVC1\n<ul class=\"wp-block-list\">\n<li>Note: replace 1 with the number for your IIS website ID<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>%SystemDrive%\\Windows\\System32\\LogFiles\\HTTPERR<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Common Apache logs can often be found in the below locations:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\/var\/log<\/li>\n\n\n\n<li>\/var\/log\/httpd\/access.log<\/li>\n\n\n\n<li>\/var\/log\/apache\/access.log<\/li>\n\n\n\n<li>\/var\/log\/apache2\/access.log<\/li>\n\n\n\n<li>\/var\/log\/httpd-access.log<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Other logs can be found in the below, often using the Event Trace Log (ETL) format:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>C:\\Windows\\System32\\LogFiles<\/li>\n\n\n\n<li>C:\\Windows\\Panther<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">ETL format can be parsed using tracerpt which is included in Windows, some examples below.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tracerpt C:\\Windows\\System32\\LogFiles\\WMI\\Terminal-Services-RPC-Client.etl\ntracerpt logfile1.etl logfile2.etl -o logdump.xml -of XML\ntracerpt logfile.etl -o logdmp.xml -of XML -lr -summary logdmp.txt -report logrpt.xml\ntracerpt logfile1.etl logfile2.etl -o -report\ntracerpt logfile.etl counterfile.blg -report logrpt.xml -df schema.xml\ntracerpt -rt \"NT Kernel Logger\" -o logfile.csv -of CSV\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Software specific logs are often stored in readable formats at any of the following locations.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>%AppData%\\&#91;softwarename] (e.g. C:\\Users\\&#91;username]\\AppData\\Roaming\\&#91;softwarename]\\)\n%LocalAppData%\\&#91;softwarename] (e.g. C:\\Users\\&#91;username]\\AppData\\Local\\&#91;softwarename]\\)\n%programfiles%\\&#91;softwarename] (e.g. C:\\Program Files\\&#91;softwarename]\\)\n%programfiles(x86)%\\&#91;softwarename] (e.g. C:\\Program Files (x86)\\&#91;softwarename]\\)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You may also find useful memory crashdumps at the below:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\&#91;username]\\AppData\\Local\\CrashDumps\nC:\\Users\\&#91;username]\\AppData\\Local\\Microsoft\\Windows\\WER\\\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"security-log-information\">Security log information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Logs and their event codes have changed over time. Most of the references here are for Windows Vista and Server 2008 onwards rather than Windows 2000,XP,Server 2003. More information on them may be added in the future if required.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">(psloglist requires psloglist.exe from systinternals):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil qe security \/f:text\neventquery.vbs \/L security\nwevtutil qe security \/f:text | Select-String -Pattern \"Event ID: &#91;EventCode]\" -Context 2,20\nwevtutil qe security \/f:text | Select-String -Pattern \"Event ID: &#91;EventCode]\" -Context 2,20 | findstr \"Account Name:\"\npsloglist -s -x security\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Some suspicious events &#8211; \u201cEvent log service was stopped\u201d, \u201cWindows File Protection is not active on this system\u201d, \u201cThe MS Telnet Service has started successfully\u201d<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security: 4720 (Account created)<\/li>\n\n\n\n<li>Security: 4722 (Account enabled)<\/li>\n\n\n\n<li>Security: 4724 (Password reset)<\/li>\n\n\n\n<li>Security: 4723 (User changed password)<\/li>\n\n\n\n<li>Security: 4736 (Account deleted)<\/li>\n\n\n\n<li>Security: 4781 (Account renamed)<\/li>\n\n\n\n<li>Security: 4738 (User account change)<\/li>\n\n\n\n<li>Security: 4688 (A new process has been created)<\/li>\n\n\n\n<li>Security: 4732 (Account added to a group)<\/li>\n\n\n\n<li>Security: 4733 (Account removed from a group)<\/li>\n\n\n\n<li>Security: 1102 (Audit log cleared)<\/li>\n\n\n\n<li>Security: 4614 (Security System Extension)<\/li>\n\n\n\n<li>Security: 4672 (Special privileges assigned to new logon)<\/li>\n\n\n\n<li>Security: 4624 (Account successfully logged on)<\/li>\n\n\n\n<li>Security: 4698 (Scheduled Task Creation)<\/li>\n\n\n\n<li>Security: 4702 (Scheduled Task Modified)<\/li>\n\n\n\n<li>Security: 4699 (Scheduled Task Deleted)<\/li>\n\n\n\n<li>Security: 4701 (Scheduled Task Disabled)<\/li>\n\n\n\n<li>Security: 4700 (Scheduled Task Enabled)<\/li>\n\n\n\n<li>Security: 4697 (Service Installation)<\/li>\n\n\n\n<li>Security: 4625 (Account failed to log on)<\/li>\n\n\n\n<li>Security: 4776 (The domain controller attempted to validate credentials for an account)<\/li>\n\n\n\n<li>Security: 4634 (Account successfully logged off)<\/li>\n\n\n\n<li>Security: 4740 (A user account was locked out)<\/li>\n\n\n\n<li>Security: 4767 (A user account was unlocked)<\/li>\n\n\n\n<li>Security: 4778 (Remote Desktop session reconnected)<\/li>\n\n\n\n<li>Security: 4779 (Remote desktop session disconnected)<\/li>\n\n\n\n<li>Security: 4625 (A user account failed to log on)<\/li>\n\n\n\n<li>Security: 4648 (A logon was attempted using explicit credentials)<\/li>\n\n\n\n<li>Security: 4768 (A Kerberos authentication ticket (TGT) was requested)\n<ul class=\"wp-block-list\">\n<li>0x6 (The username doesn\u2019t exist) &#8211; Bad username or not yet replicated to DC<\/li>\n\n\n\n<li>0xC (Start time is later than end time &#8211; Restricted workstation)<\/li>\n\n\n\n<li>0x12 (Account locked out, disabled, expired, restricted, or revoked etc)<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Security: 4769 (A Kerberos service ticket was requested)<\/li>\n\n\n\n<li>Security: 4770 (A Kerberos service ticket was renewed)<\/li>\n\n\n\n<li>Security: 4771 (Kerberos pre-authentication failed)\n<ul class=\"wp-block-list\">\n<li>0x10 &#8211; Smart card logon is being attempted and the proper certificate cannot be located.<\/li>\n\n\n\n<li>0x17 &#8211; The user\u2019s password has expired.<\/li>\n\n\n\n<li>0x18 &#8211; The wrong password was provided.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Security: Greater than 4720 Eand less than 4764 (Account\/group modifications)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"logon-type-information\">Logon type information<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Type: 0 (Used only by System account authentications)<\/li>\n\n\n\n<li>Type: 2 (Interactive Logon)\n<ul class=\"wp-block-list\">\n<li>User is at the keyboard.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 3 (Network Authentication\/SMB Auth Logon)\n<ul class=\"wp-block-list\">\n<li>Auth over the network. Note: RDP can fall under this if Network Level Authentication is enabled.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 4 (Batch Logon)\n<ul class=\"wp-block-list\">\n<li>More often than not from a Scheduled Task.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 5 (Service Logon)\n<ul class=\"wp-block-list\">\n<li>More often than not from a Service.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 7 (Unlock Logon)\n<ul class=\"wp-block-list\">\n<li>User is at the keyboard unlocking it after lunch.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 8 (Network Cleartext Logon)\n<ul class=\"wp-block-list\">\n<li>Basically Logon Type 3 but creds are in the clear.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 9 (New Credentials Logon)\n<ul class=\"wp-block-list\">\n<li>More often than not from using \u2018RunAs\u2019 with the \u2018\/netonly\u2019 parameter.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 10 (Terminal\/RDP Logon Type)\n<ul class=\"wp-block-list\">\n<li>Logon via Terminal Services\/RDP.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 11 (Cached Interactive)\n<ul class=\"wp-block-list\">\n<li>Logon when unable to connect to domain (Cached Creds locally).<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 12 (Cached Remote Interactive)\n<ul class=\"wp-block-list\">\n<li>Same as RemoteInteractive. This is used for internal auditing.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Type: 13 (Cached Unlock Logon)\n<ul class=\"wp-block-list\">\n<li>Same as Unlock Logon except with cached creds.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"special-logon-information-4672\">Special logon information (4672)<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Privilege Name<\/th><th>Description<\/th><th>Notes<\/th><\/tr><\/thead><tbody><tr><td>SeAssignPrimaryTokenPrivilege<\/td><td>Replace a process-level token<\/td><td>Required to assign the primary token of a process. With this privilege, the user can initiate a process to replace the default token associated with a started subprocess.<\/td><\/tr><tr><td>SeAuditPrivilege<\/td><td>Generate security audits<\/td><td>With this privilege, the user can add entries to the security log.<\/td><\/tr><tr><td>SeBackupPrivilege<\/td><td>Back up files and directories<\/td><td>Required to perform backup operations. With this privilege, the user can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file. Any access request other than read is still evaluated with the ACL.<\/td><\/tr><tr><td>SeCreateTokenPrivilege<\/td><td>Create a token object<\/td><td>Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs. When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it.<\/td><\/tr><tr><td>SeDebugPrivilege<\/td><td>Debug programs<\/td><td>Required to debug and adjust the memory of a process owned by another account.With this privilege, the user can attach a debugger to any process or to the kernel. We recommend that SeDebugPrivilege always be granted to Administrators, and only to Administrators. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right. This user right provides complete access to sensitive and critical operating system components.<\/td><\/tr><tr><td>SeEnableDelegationPrivilege<\/td><td>Enable computer and user accounts to be trusted for delegation<\/td><td>With this privilege, the user can set the Trusted for Delegation setting on a user or computer object.The user or object that is granted this privilege must have write access to the account control flags on the user or computer object.<\/td><\/tr><tr><td>SeImpersonatePrivilege<\/td><td>Impersonate a client after authentication<\/td><td>With this privilege, the user can impersonate other accounts.<\/td><\/tr><tr><td>SeLoadDriverPrivilege<\/td><td>Load and unload device drivers<\/td><td>Required to load or unload a device driver.With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers.<\/td><\/tr><tr><td>SeRestorePrivilege<\/td><td>Restore files and directories<\/td><td>Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. With this privilege, the user can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories and determines which users can set any valid security principal as the owner of an object.<\/td><\/tr><tr><td>SeSecurityPrivilege<\/td><td>Manage auditing and security log<\/td><td>Required to perform a number of security-related functions, such as controlling and viewing audit events in security event log. With this privilege, the user can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys.A user with this privilege can also view and clear the security log.<\/td><\/tr><tr><td>SeSystemEnvironmentPrivilege<\/td><td>Modify firmware environment values<\/td><td>Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information.<\/td><\/tr><tr><td>SeTakeOwnershipPrivilege<\/td><td>Take ownership of files or other objects<\/td><td>Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object. With this privilege, the user can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads.<\/td><\/tr><tr><td>SeTcbPrivilege<\/td><td>Act as part of the operating system<\/td><td>This privilege identifies its holder as part of the trusted computer base.This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"system-log-information\">System log information:<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil qe system \/f:text\neventquery.vbs \/L system\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Some useful events &#8211;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>System: 7030 (Basic Service Operations)<\/li>\n\n\n\n<li>System: 7040 (The start type of a service was changed from disabled to auto start)<\/li>\n\n\n\n<li>System: 7045 (Service Was Installed)<\/li>\n\n\n\n<li>System: 1056 (DHCP Server Oddities)<\/li>\n\n\n\n<li>System: 10000 (COM Functionality)<\/li>\n\n\n\n<li>System: 20001 (Device Driver Installation)<\/li>\n\n\n\n<li>System: 20002 (Remote Access)<\/li>\n\n\n\n<li>System: 20003 (Service Installation)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"sysmon-log-information\">Sysmon log information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When installed and running the event log is located at: \u201cApplications and Services Logs\/Microsoft\/Windows\/Sysmon\/Operational\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note: A WMI consumer is a management application or script that interacts with the WMI infrastructure. https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/WmiSdk\/wmi-architecture<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Sysmon: 1 (Process create)<\/li>\n\n\n\n<li>Sysmon: 2 (File creation time)<\/li>\n\n\n\n<li>Sysmon: 3 (Network connection detected)<\/li>\n\n\n\n<li>Sysmon: 4 (Sysmon service state changed)<\/li>\n\n\n\n<li>Sysmon: 5 (Process terminated)<\/li>\n\n\n\n<li>Sysmon: 6 (Driver loaded)<\/li>\n\n\n\n<li>Sysmon: 9 (Image loaded)<\/li>\n\n\n\n<li>Sysmon: 10 (Process accessed)<\/li>\n\n\n\n<li>Sysmon: 11 (File created)<\/li>\n\n\n\n<li>Sysmon: 12 (Registry object added or deleted)<\/li>\n\n\n\n<li>Sysmon: 13 (Registry value set)<\/li>\n\n\n\n<li>Sysmon: 14 (Registry object renamed)<\/li>\n\n\n\n<li>Sysmon: 15 (File stream created)<\/li>\n\n\n\n<li>Sysmon: 16 (Sysmon configuration changed)<\/li>\n\n\n\n<li>Sysmon: 17 (Named pipe created)<\/li>\n\n\n\n<li>Sysmon: 18 (Named pipe connected)<\/li>\n\n\n\n<li>Sysmon: 19 (WMI filter)<\/li>\n\n\n\n<li>Sysmon: 20 (WMI consumer)<\/li>\n\n\n\n<li>Sysmon: 21 (WMI consumer filter)<\/li>\n\n\n\n<li>Sysmon: 22 (DNS Query)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"active-directory-investigation\">Active Directory Investigation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Live information can be found using <a href=\"https:\/\/docs.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-R2-and-2012\/cc732952(v=ws.11)\">DSQuery<\/a> or <a href=\"https:\/\/docs.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-R2-and-2012\/cc772217(v=ws.11)\">Netdom<\/a>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dsquery computer\ndsquery user\ndsquery contact\ndsquery domainroot -inactive 4\ndsquery group\ndsquery ou\ndsquery site\ndsquery server\ndsquery quota\ndsquery *\n\t- dsquery * -limit 999999999\nnetdom query fsmo\nnetdom query trust\nnetdom query pdc\nnetdom query DC\nnetdom query server\nnetdom query workstation\nnetdom query OU\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"nt-directory-services-directory-information-tree-file-ntdsdit\">NT Directory Services Directory Information Tree File (ntds.dit)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Active Directory Database file containing all schema, domain, configuration information (e.g. users, IP, computers, domain trusts etc)<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemRoot%\\NTDS\\ntds.dit<\/li>\n\n\n\n<li>%SystemRoot%\\System32\\ntds.dit\n<ul class=\"wp-block-list\">\n<li>File created only when promoting certain OS to a DC, and seldom used.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"edblog\">Edb.log<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">10MB transaction log used to store temporary data before it is sent to the ntds.dit database.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemRoot%\\NTDS\\Edb.log<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"edbxxxxxlog\">Edbxxxxx.log<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Additional transaction log files if the main edb.log file gets larger than 10MB without being flushed to ntds.dit.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemRoot%\\NTDS\\edbxxxxx.log<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"edbchk\">Edb.chk<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Checkpoint file used to determine how much of the transaction logs have been sent to the ntdis.dit database.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemRoot%\\NTDS\\edb.chk<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"resxlogresxjrs\">Resx.log\/Resx.jrs<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Reserved log files in case the hard drive fills up, at which point these files will be used (ideally they should never be used).<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemRoot%\\NTDS\\res1.log<\/li>\n\n\n\n<li>%SystemRoot%\\NTDS\\res2.log<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"tempedb\">Temp.edb<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Temporary file to store information during in progress transactions.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemRoot%\\NTDS\\temp.edb<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"schemaini\">Schema.ini<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Initialises the ntds.dit file when the domain controller is created, and is then never used again.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%SystemRoot%\\NTDS\\schema.ini<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"investigation-of-ntdsdit\">Investigation of ntds.dit<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Obtaining this file can be done using any of the following and also requires the SYSTEM hive to decrypt (note: ntdsutil may not work on older AD servers).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">(Output will be under C:\\Audit)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ntdsutil<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ntdsutil \"activate instance ntds\" ifm \"create full C:\\Audit\" quit quit\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">vssadmin<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vssadmin create shadow \/for=C:\nmkdir C:\\Audit\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy&#91;Number]\\Windows\\ntds\\ntds.dit C:\\Audit\\ntds.dit\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy&#91;Number]\\Windows\\System32\\config\\SYSTEM C:\\Audit\\SYSTEM\nvssadmin delete shadows \/shadow=&#91;ShadowCopyID]\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Other \u2018less legitimate\u2019 replication methods can be found detailed on the <a href=\"https:\/\/adsecurity.org\/?p=2398#MimikatzDCSync\">AD Security Blog by Sean Metcalf<\/a><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Or by using <a href=\"https:\/\/github.com\/clymb3r\/PowerShell\/blob\/master\/Invoke-NinjaCopy\/Invoke-NinjaCopy.ps1\">Invoke-NinjaCopy<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Repair the file if required:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>esentutl \/p \/o C:\\Audit\\ntds.dit\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Analysing this file offline can be done with tactics such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/blog.ropnop.com\/extracting-hashes-and-domain-info-from-ntds-dit\/\">Ropnop &#8211; Extract Hashes and Domain Info<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"origami-pdf-malicious-pdf-analysis\">Origami-PDF (Malicious PDF Analysis)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/gdelugre\/origami\">Github Download<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pdfextract malware.pdf\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"more-malicious-pdfdoc-analysis\">More Malicious PDF\/Doc Analysis<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>pdfid.py malware.pdf\npdfparser.py malware.pdf\npdfparser.py malware.pdf --object &#91;number] --filter --raw --dump file.&#91;extension]\noledump.py file.&#91;extension]\noledump.py file.&#91;extension] --select &#91;number] --vbadecompress\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"exiftool-image-analysis\">Exiftool (Image Analysis)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>exiftool malware.jpeg\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"rdp-cache-images\">RDP Cache images<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This can be used to display some fragments of images which a user could see when operating on a server using the Windows RDP. The cache files are located: %USERPROFILE%\\AppData\\Local\\Microsoft\\Terminal Server Client\\Cache\\<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These can be parsed using <a href=\"https:\/\/github.com\/ANSSI-FR\/bmc-tools\">BMC-Tools<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bmc-tools.py -s .\/ -d .\/output\nbmc-tools.py -s .\/ -d .\/output -o -b \t\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"rdp-terminal-services-activity\">RDP (Terminal Services) Activity<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query 'HKU\\SID\\Software\\Microsoft\\Terminal Server Client' \/s\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"rdp-terminal-services-configuration\">RDP (Terminal Services) Configuration<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" \/s\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-if-terminal-services-enabled\">Check if Terminal Services Enabled<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" \/v fDenyTSConnections\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-if-one-session-per-user-has-been-modified\">Check if one session per user has been modified<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" \/v fSingleSessionPerUser\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-if-port-number-has-been-modified\">Check if port number has been modified<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\" \/v PortNumber\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" \/v PortNumber\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"host-firewall-information\">Host Firewall information:<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>netsh firewall show config\nadvfirewall firewall show rule name=all verbose\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"model-of-motherboard-and-hardware-information\">Model of motherboard and hardware information:<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic baseboard get product,manufacturer\nwmic desktopmonitor get \/all \/format:list\nwmic baseboard get \/all \/format:list\nwmic bios get \/all \/format:list\nwmic cpu get \/all \/format:list\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"monitoring-of-open-files\">Monitoring of open files:<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>openfiles \/local on\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-bitlocker-encryption\">Check Bitlocker Encryption<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>manage-bde -status\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">OR Powershell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-BitLockerVolume\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"list-open-files\">List open files<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(this needs to have been enabled first and the PC rebooted, psfiles requires sysinternals psfile.exe)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openfiles \/query\npsfile\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"display-proxy-information\">Display proxy information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>netsh winhttp show proxy\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"disconnect-open-files-based-on-username\">Disconnect open files based on username:<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>openfiles \/disconnect \/a username\t\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Powershell (some with WMI). Note: Namespace is a group of classes belonging to the same management environment. Most important is the CIMV2 child which is the most common.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"powershell-commands\">Powershell Commands<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>help get-wmiobject\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"service-information-1\">Service information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WmiObject win32_service | select Name, DisplayName, State, PathName\nGet-Service\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"view-named-pipes\">View Named Pipes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;System.IO.Directory]::GetFiles(\"\\\\.\\\\pipe\\\\\")\nget-childitem \\\\.\\pipe\\\ndir \\\\.\\pipe\\\\\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"harden-system-from-lateral-movement\">Harden System from Lateral Movement<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: These may inadvertently break communication of devices and should be tested. It may also require a restart.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"disable-remote-interaction-with-services\">Disable remote interaction with services<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\" \/v DisableRemoteScmEndpoints \/t REG_DWORD \/d 1\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"disable-remote-interaction-with-scheduled-tasks\">Disable remote interaction with scheduled tasks<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\" \/v DisableRpcOverTcp \/t REG_DWORD \/d 1\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"disable-rdp-access\">Disable RDP access<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" \/v fDenyTSConnections \/t REG_DWORD \/d 1\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"disable-dcom\">Disable DCOM<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKLM\\SOFTWARE\\Microsoft\\Ole\" \/v EnableDCOM \/t REG_SZ \/d N \/f\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"disable-admin-shares\">Disable Admin Shares<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" \/v \"AutoShareWks\" \/t \"REG_DWORD\" \/d 0 \nreg add \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" \/v \"AutoShareServer\" \/t \"REG_DWORD\" \/d 0 \n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"stop-server-responsible-for-inter-process-communication-calls\">Stop Server Responsible for Inter-process Communication Calls<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>net stop server\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"delete-admin-shares\">Delete Admin Shares<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This may break some application communication and admin functionality. It may also be temporary as Windows has been known to recreate them. Always test.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>C$ = Default share on systems \u2018C\u2019 drive.<\/li>\n\n\n\n<li>IPC$ = Default Inter-process communication share (used by named pipes)<\/li>\n\n\n\n<li>ADMIN$ = Default share for remote administration (used by PsExec) net share C$ \/delete net share IPC$ \/delete net share ADMIN$ \/delete<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"disable-anonymous-access-to-named-pipes\">Disable Anonymous Access to Named Pipes<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanManServer\\Parameters\" \/v \"RestrictNullSessAccess\" \/t \"REG_DWORD\" \/d 1 \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-wmi-objects\">Process WMI objects<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>get-wmiobject -list | where {$_.name -like \"*process*\"}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-information-1\">Process information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WmiObject win32_process|select processname,ProcessId,CommandLine\nGet-WmiObject win32_process -Filter \"name like '%powershell.exe'\" | select processId,commandline|FL\nGet-Process\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"baseline-processes-and-services\">Baseline processes and services<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(Used to compare new process\/services)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Process | Export-Clixml -Path C:\\Users\\User\\Desktop\\process.xml\nGet-Service | Export-Clixml -Path C:\\Users\\User\\Desktop\\service.xml\n$edproc = Import-Clixml -Path C:\\Users\\User\\Desktop\\process.xml\n$edproc1 = Import-Clixml -Path C:\\Users\\User\\Desktop\\process1.xml\n$edservice = Import-Clixml -Path C:\\Users\\User\\Desktop\\service.xml\n$edservice1 = Import-Clixml -Path C:\\Users\\User\\Desktop\\service1.xml\nCompare-Object $edproc $edproc1 -Property processname\nCompare-Object $edservice $edservice1 -Property servicename\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"view-and-interact-with-shadow-copies-must-be-run-from-elevated-cmdexe\">View and interact with shadow copies (MUST BE RUN FROM ELEVATED CMD.exe)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>vssadmin list shadows | findstr \"VolumeShadowCopy\"\nmklink \/d shadow \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2\\\ndir shadow\nrmdir shadow\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">With a linked shadow copy we can copy pagefile.sys using the below.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir C:\\Audit\nrobocopy shadow C:\\Audit pagefile.sys\nattrib -s -h C:\\Audit\\pagefile.sys\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-shadow-copy-for-c-drive\">Create Shadow Copy for C: drive<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>vssadmin create shadow \/for=C:\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"other-shadow-copy-techniques\">Other Shadow Copy Techniques<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In Windows 7 or certain other OS you may not have access to use \u2018vssadmin create\u2019. As such some trickery may be required. In Windows 7 we can create a scheduled task (to execute with System privileges) and use it to create a Shadow Copy with Microsoft DLLs, this simulates the activity of creating a \u2018System Restore Point\u2019. This can also be done with psexec if you wish to install the psexec service.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>schtasks \/ru \"SYSTEM\" \/Create \/SC DAILY \/ST \"00:00\" \/TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" \/TR \"%windir%\\system32\\rundll32.exe \/d srrstr.dll,ExecuteScheduledSPPCreation\" \/f\nschtasks \/run \/TN \\Microsoft\\Windows\\SystemRestore\\SR\nvssadmin list shadows\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to remove the scheduled task so it doesn\u2019t run daily, use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>schtasks \/delete \/TN \\Microsoft\\Windows\\SystemRestore\\SR \/f\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also back it up using <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows-server\/administration\/windows-commands\/wbadmin-start-backup\">wbadmin<\/a>, but it\u2019s a bit more intricate. The below example should backup C drive to E drive.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wbadmin start backup -backupTarget:E: -include:c:\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"tcp-connections\">TCP Connections<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection \u2013State Established\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"list-of-ipv4-addresses-who-have-connected-rdp\">List of IPV4 addresses who have connected (RDP)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -Log 'Microsoft-Windows-TerminalServices-LocalSessionManager\/Operational' | select -exp Properties | where {$_.Value -like '*.*.*.*' } | sort Value -u \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"powershell-logs\">Powershell logs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -LogName \"Windows Powershell\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"event-logs-available\">Event logs available<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-EventLog -list\nGet-WinEvent -Listlog * | Select RecordCount,LogName \nGet-WinEvent -Listlog *operational | Select RecordCount,LogName\nwmic nteventlog list brief\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"event-logs-per-application-source\">Event Logs per Application Source<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-EventLog Application | Select -Unique Source\nGet-WinEvent -FilterHashtable @{ LogName='Application'; ProviderName='Outlook'}\nGet-WinEvent -FilterHashtable @{ LogName='OAlerts';} | FL TimeCreated, Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"event-logs-per-severity-source\">Event Logs per Severity Source<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"critical-logs\">Critical Logs<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Application'; Level='1';}\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"error-logs\">Error Logs<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Application'; Level='2';}\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"warning-logs\">Warning Logs<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Application'; Level='3';}\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"information-logs\">Information Logs<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Application'; Level='4';}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"live-event-log-filtering\">Live Event Log Filtering<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$Before = Get-Date 01\/07\/19;\n$After = Get-Date 31\/05\/19;\n\nGet-WinEvent -FilterHashtable @{ LogName='Security'; StartTime=$After; EndTime=$Before; Id='4624'; Data='127.0.0.1'} | Select -ExpandProperty Message\n\nGet-WinEvent -FilterHashtable @{ LogName='Security'; StartTime=$After; EndTime=$Before; Id='4624'; Data='127.0.0.1'} | Select TimeCreated,Message | Select-String -Pattern \"0x621EFDC\", \"0x825225F\"\n\nGet-WinEvent -FilterHashtable @{ LogName='Security'; StartTime=$After; EndTime=$Before; Id='4624'; Data='127.0.0.1'} | Select -ExpandProperty Message &gt; &#91;location]\\log.txt;\ncat &#91;location]\\log.txt | Select-String -Pattern \"Subject:\", \"New Logon:\", \"Process information\",\"Network Information:\" -Context 0,4;\n\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-SmbClient\/Connectivity';} | Select Timecreated,LogName,Message | where {$_.message -like \"*Failed to establish a network connection*\"} |FL\n\nGet-WinEvent -FilterHashtable @{ LogName='*SMB*'; Data=\"&#91;IP\/HostName]\"} | Select Timecreated,LogName,Message |FL\n\nGet-WinEvent -FilterHashtable @{ LogName='*SMB*';} | Select Timecreated,LogName,Message | where {$_.message -like \"*&#91;IP\/Hostname]*\"} |FL\n\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | where {$_.message -match '0x1F260F3E' } | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | where {$_.TimeCreated.ToString() -match ('28\/10\/2019')}|FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='2'} | where {$_.TimeCreated.ToString() -match ('28\/10\/2019 11:22')}\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='127.0.0.1'} | where {$_.TimeCreated.ToString() -match ('28\/10\/2019') -and $_.Message -match 'user' } | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='NTLM';} -MaxEvents 6 | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='127.0.0.1'} | where {$_.TimeCreated -ge (get-date).addDays(-3) -and $_.TimeCreated.ToString() -match ('11:04') -and $_.Message -match 'user' } | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"find-authenticating-userasset-for-remote-service-creation-lateral-movement\">Find Authenticating user\/asset for remote service creation (lateral movement)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$After = (get-date).addDays(-3);\n$Time = Get-WinEvent -FilterHashtable @{ LogName='System'; Id='7045';} | ? {$_.Message -match \"MALWARE.exe\"} | Select -exp TimeCreated;\nforeach ($Event in $Time){\n\t$Event;\n\tGet-WinEvent -FilterHashtable @{ LogName='Security'; StartTime=$After; Id='4624';} | ? {$_.TimeCreated -ge $Event.AddSeconds(-2) -AND $_.TimeCreated -le $Event.AddSeconds(+2)} | FL TimeCreated,Message;\n};\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"locate-possible-kerberoastkerberos-based-attacks\">Locate possible Kerberoast\/Kerberos based attacks<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Note: When looking at kerberos listing, RC4-HMAC encryption is generally anomalous and may be indicative of kerberoasting.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4769'; Data='0x17'} | FL TimeCreated, Message\nklist\nreg query \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters\" \/v \"allowtgtsessionkey\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"extract-useful-fields-from-legacy-logs\">Extract useful fields from Legacy Logs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$A=Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='127.0.0.1'} | where {$_.TimeCreated -ge (get-date).addDays(-3) -and $_.Message -match 'INSERT DESIRED INFO HERE' };\nForEach ($Event in $A){$Event.TimeCreated;$Event.Message|findstr \/i \/C:\"Logon Type:\";$Event.Message|findstr \/i \/C:\"Security ID:\";$Event.Message|findstr \/i \/C:\"Account Name:\";$Event.Message|findstr \/i \/C:\"Account Domain:\";$Event.Message|findstr \/i \/C:\"Process ID:\";$Event.Message|findstr \/i \/C:\"Process Name:\";$Event.Message|findstr \/i \/C:\"Workstation Name:\";$Event.Message|findstr \/i \/C:\"Source Network Address:\";$Event.Message|findstr \/i \/C:\"Source Port:\";echo \"`n\";};\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: You can modify the second string to carve out wanted information, some examples below.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"find-user-authenticating\">Find User Authenticating<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>ForEach ($Event in $A){$Event.TimeCreated;$Event.Message|findstr \/i \/C:\"Account Name:\";$Event.Message|findstr \/i \/C:\"Account Domain:\";echo \"`n\";};\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"find-ipport-authenticating\">Find IP\/Port Authenticating<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>ForEach ($Event in $A){$Event.TimeCreated;$Event.Message|(findstr \/i \/C:\"Source Network Address:\";$Event.Message|findstr \/i \/C:\"Source Port:\";)|findstr -v \"-\";echo \"`n\";};\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">** Note: In the following section filter based on time for reduction of noise <a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.utility\/get-date\">Get-Date<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">e.g. get something like the below and add them to the FilterHashTable: StartTime=$After; EndTime=$Before;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Date = (Get-Date).AddDays(-2)\n$Before = Get-Date 01\/07\/19;\n$After = Get-Date 31\/05\/19;\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"remote-desktop-lateral-movement-detection-destinations\">Remote Desktop Lateral Movement Detection (Destinations)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='10'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4778';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4779';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS\/Operational'; Id='98';} | FL Message,ProcessId,TimeCreated\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS\/Operational'; Id='131';} | FL Message,ProcessId,TimeCreated\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TerminalServices-LocalSessionManager\/Operational'; Id='21';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TerminalServices-LocalSessionManager\/Operational'; Id='22';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TerminalServices-LocalSessionManager\/Operational'; Id='25';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TerminalServices-LocalSessionManager\/Operational'; Id='41';} | FL TimeCreated,Message\nls C:\\Windows\\Prefetch\\rdpclip.exe*.pf\nls C:\\Windows\\Prefetch\\tstheme.exe*.pf\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"map-network-shares-lateral-movement-detection-destinations\">Map Network Shares Lateral Movement Detection (Destinations)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4672';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4776';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4768';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4769';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='5140';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='5140'; Data='\\\\*\\C$'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='5145';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='5140';} | FL TimeCreated,Message\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"psexec-lateral-movement-detection-destinations\">PsExec Lateral Movement Detection (Destinations)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='2'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4672';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='5140'; Data='\\\\*\\ADMIN$'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='System'; Id='7045'; Data='PSEXESVC'} | FL TimeCreated,Message\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\PSEXESVC\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\\nls C:\\Windows\\Prefetch\\psexesvc.exe*.pf\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scheduled-tasks-lateral-movement-detection-destinations\">Scheduled Tasks Lateral Movement Detection (Destinations)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4672';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4698';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4702';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4699';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4700';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4701';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TaskScheduler\/Maintenance'; Id='106';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TaskScheduler\/Maintenance'; Id='140';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TaskScheduler\/Maintenance'; Id='141';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TaskScheduler\/Maintenance'; Id='200';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-TaskScheduler\/Maintenance'; Id='201';} | FL TimeCreated,Message\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\" \/s\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\" \/s \/v Actions\nGet-ChildItem -path 'registry::HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\' | Get-ItemProperty | FL Path, Actions\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\"\ngci -path C:\\Windows\\System32\\Tasks\\ -recurse -File\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"services-lateral-movement-detection-destinations\">Services Lateral Movement Detection (Destinations)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4697';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='System'; Id='7034';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='System'; Id='7035';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='System'; Id='7036';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='System'; Id='7040';} | FL TimeCreated,Message \nGet-WinEvent -FilterHashtable @{ LogName='System'; Id='7045';} | FL TimeCreated,Message\nreg query 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\'\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"wmiwmic-lateral-movement-detection-destinations\">WMI\/WMIC Lateral Movement Detection (Destinations)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4672';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WMI-Activity\/Operational'; Id='5857';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WMI-Activity\/Operational'; Id='5860';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WMI-Activity\/Operational'; Id='5861';} | FL TimeCreated,Message\nC:\\Windows\\System32\\wbem\\Repository\nls C:\\Windows\\Prefetch\\wmiprvse.exe*.pf\nls C:\\Windows\\Prefetch\\mofcomp.exe*.pf\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"powershell-lateral-movement-detection-destinations\">PowerShell Lateral Movement Detection (Destinations)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Security'; Id='4672';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell\/Operational'; Id='4103';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell\/Operational'; Id='4104';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell\/Operational'; Id='53504';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Windows PowerShell'; Id='400';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Windows PowerShell'; Id='403';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WinRM\/Operational'; Id='91';} | FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WinRM\/Operational'; Id='168';} | FL TimeCreated,Message\nls C:\\Windows\\Prefetch\\wsmprovhost.exe*.pf\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"extra-information\">Extra Information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">**AmCache<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>C:\\Windows\\AppCompat\\Programs\\Amcache.hve\n<ul class=\"wp-block-list\">\n<li>Amcache.hve\\Root\\File{Volume GUID}#######<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">**ShimCache<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>C:\\Windows\\System32\\config\\SYSTEM\n<ul class=\"wp-block-list\">\n<li>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>*Prefetch &#8211; ls C:\\Windows\\Prefetch\\evil.exe<\/em>.pf<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">** Connected Devices Platform (Timelining)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gci C:\\Users\\*\\AppData\\Local\\ConnectedDevicesPlatform -recurse\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"user-accounts-and-logon-information\">User accounts and logon information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WmiObject Win32_UserProfile\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"share-information\">Share information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WmiObject Win32_Share\nnet share\nwmic share list brief\nwmic netuse get Caption, DisplayType, LocalName, Name, ProviderName, Status\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"list-alternate-data-streams-in-current-dir-and-view-them\">List Alternate Data Streams in current Dir and view them<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>gi * -s *\ngc &#91;FILENAME] -s &#91;ADSNAME]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"list-alternate-data-streams-in-text-files-within-appdata\">List Alternate Data Streams in text files within AppData<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem -Recurse -Path $env:APPDATA\\..\\ -include *.txt -ea SilentlyContinue|gi -s *|Select Stream -ea SilentlyContinue| Where-Object {$_.Stream -ine \":`$DATA\"}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"use-alternate-data-streams-to-find-download-location\">Use Alternate Data Streams to find download location<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>get-item * -stream *|Where-Object {$_.Stream -ine \":`$DATA\"}|cat\nget-item C:\\Users\\Username\\Downloads\\* -stream *|Where-Object {$_.Stream -ine \":`$DATA\"}|cat\n$a=(gci -rec -path C:\\users\\user\\downloads -ea 0 | gi -s Zone.Identifier -ea 0 | ? {$_.Length -ge '27'});foreach ($b in $a){$b.FileName;$b|cat}\n$a=(get-item * -stream Zone.Identifier -ea 0 | ? {$_.Length -ge '27'});foreach ($b in $a){$b.FileName;$b|cat}\ngci -Recurse -Path $env:APPDATA\\..\\ -include *.txt -ea SilentlyContinue |gi -s *| Where-Object {$_.Stream -ine \":`$DATA\"}|cat\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"general-notes\">General Notes<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Under <strong>%SystemRoot%\\System32\\config<\/strong> the below registry hives are some of the most important to obtain. Additionally taking these files from within the RegBack directory also assists in comprehensive analysis should any anti-forensics activities have modified these registries.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DEFAULT<\/li>\n\n\n\n<li>SAM<\/li>\n\n\n\n<li>SECURITY<\/li>\n\n\n\n<li>SOFTWARE<\/li>\n\n\n\n<li>SYSTEM<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Under <strong>\\Users\\name<\/strong> there is also a <strong>NTUSER.DAT<\/strong> file which becomes HKEY_CURRENT_USER into the Registry when a user logs on, and this is very important to obtain. There\u2019s also a UsrClass.dat file which can be found: <strong>%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"gather-artifacts\">Gather artifacts<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg save HKLM\\SAM &#91;LOCATION]\\SAM \nreg save HKLM\\SYSTEM &#91;LOCATION]\\SYSTEM\nreg save HKLM\\SECURITY &#91;LOCATION]\\SECURITY\nreg save HKLM\\SOFTWARE &#91;LOCATION]\\SOFTWARE\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"powershell-execution-log\">Powershell execution log<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Located at: C:\\Users[name]\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"analyse-document-for-macros\">Analyse document for macros<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Using <a href=\"https:\/\/github.com\/decalage2\/oletools\/wiki\/olevba\">olevba<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>olevba &#91;Document]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"capture-powershell-memdump-and-analyse\">Capture powershell memdump and analyse<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Using Procdump from sysinternals:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>procdump -ma &#91;PowershellPID]\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Using <a href=\"https:\/\/github.com\/chrisjd20\/power_dump\">powerdump<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>python power_dump.py\n1\nld powershell.exe_mem_dump\n2 \n3\n4\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recent-execution-of-programs\">Recent execution of programs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefetch Located at : %SystemRoot%\\Prefetch\\<\/li>\n\n\n\n<li>RecentFileCache.bcf Located at : %SystemRoot%\\AppCompat\\Programs\\<\/li>\n\n\n\n<li>Amcache.hve (reg hive) Located at : %SystemRoot%\\AppCompat\\Programs\\<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Or query a lot of run programs from program compatibility assistant:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty \"REGISTRY::HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Store\"\nGet-ItemProperty \"REGISTRY::HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers\"\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"windows-indexing-service\">Windows Indexing Service<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\windows.edb\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.nirsoft.net\/utils\/ese_database_view.html\">ESE Database View<\/a><\/li>\n\n\n\n<li><a href=\"http:\/\/www.edgemanage.emmet-gray.com\/Articles\/ViewESE.html\">View ESE Database<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"programs-accessing-windows-features-such-as-webcam-and-microphone\">Programs Accessing Windows Features such as Webcam and Microphone<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Special thanks to Zack (svch0st) for his <a href=\"https:\/\/medium.com\/@7a616368\/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072\">Medium Post<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"all-windows-features-including-start-and-stop-timestamps\">All Windows Features Including Start and Stop Timestamps<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>$a=$(gci REGISTRY::HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\ -recurse | FT -AutoSize | Out-String);$a.replace(\"#\",\"\\\")\nreg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\ \/s \/f LastUsed\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"programs-using-webcam\">Programs Using Webcam<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>$a=$(gci REGISTRY::HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam -recurse | Select PSChildName | Out-String);$a.replace(\"#\",\"\\\")\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"programs-using-microphone\">Programs Using Microphone<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>$a=$(gci REGISTRY::HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\microphone -recurse | Select PSChildName | Out-String);$a.replace(\"#\",\"\\\")\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"usn-journal-any-changes-to-ntfs-volume\">USN Journal (any changes to NTFS volume)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>fsutil usn readjournal C: &gt; USN.txt\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"link-file-analysis\">Link File Analysis<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>LNK Files Located at: C:\\Users*\\AppData\\Roaming\\Microsoft\\Windows\\Recent<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Using <a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">LECmd<\/a> to parse Link metadata.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LECmd.exe -f {fileDirectory}\\filename.lnk\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Of interest is information such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>MachineID (NetBIOS name)<\/li>\n\n\n\n<li>MAC Address<\/li>\n\n\n\n<li>MAC Vendor<\/li>\n\n\n\n<li>Timestamps<\/li>\n\n\n\n<li>Volume Droid<\/li>\n\n\n\n<li>Volume Droid Birth<\/li>\n\n\n\n<li>File Droid<\/li>\n\n\n\n<li>File Droid Birth<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/openspecs\/windows_protocols\/ms-shllink\/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943\">File format specification<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"jump-lists-analysis\">Jump Lists Analysis<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Jump List Files Located at: C:\\Users*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A rough PowerShell 1-liner to gather information on previous opened directories and files is below.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Files=$(cat C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*Destinations\\*.*Destinations-ms);$Files.Split(\"``\")|Select-String \"Storage\" | findstr -v \"1SPSU\"|findstr -v \"?\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"srum-analysis\">SRUM Analysis<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>System Resource Usage Monitor Located at: %systemroot%\\System32\\sru\\SRUDB.dat<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Great tool to parse to csv: <a href=\"https:\/\/github.com\/MarkBaggett\/srum-dump\">SRUM-Dump<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"background-activity-moderator-bamdam\">Background Activity Moderator (BAM\/DAM)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\bam\\UserSettings\" \/s\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\dam\\UserSettings\" \/s\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\bam\\UserSettings\" \/s \/v *.exe\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\dam\\UserSettings\" \/s \/v *.exe\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"windows-10-mail-app-forensics\">Windows 10 Mail App Forensics<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>%LocalAppData%\\Comms\\Unistore\\data\\0 - Windows phone data\n%LocalAppData%\\Comms\\Unistore\\data\\2 - Contact lists\n%LocalAppData%\\Comms\\Unistore\\data\\3 - Contents\/body of email\n%LocalAppData%\\Comms\\Unistore\\data\\5 - Calendar invitations\n%LocalAppData%\\Comms\\Unistore\\data\\7 - Email attachments\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"capture-packets-with-netsh\">Capture packets with netsh<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: You will need to use something like etl2pcapng to convert these captures to a cap file for analysis with Wireshark <a href=\"https:\/\/github.com\/microsoft\/etl2pcapng\/releases\">Download<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>netsh trace start persistent=yes capture=yes tracefile=c:\\temp\\packetcapture.etl\nnetsh trace stop\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"capture-packets-with-powershell\">Capture Packets with PowerShell<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>New-NetEventSession -Name \"Capture\" -CaptureMode SaveToFile -LocalFilePath \"c:\\temp\\packetcapture.etl\"\nAdd-NetEventProvider -Name \"Microsoft-Windows-TCPIP\" -SessionName \"Capture\"\nAdd-NetEventPacketCaptureProvider -SessionName \"Capture\"\nStart-NetEventSession -Name \"Capture\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"stop-capturing-packets-with-powershell\">Stop Capturing Packets with PowerShell<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetEventSession\nStop-NetEventSession -Name Capture\nRemove-NetEventSession\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"convert-etl-file-to-pcap\">Convert ETL File to PCAP<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>etl2pcapng.exe c:\\temp\\packetcapture.etl c:\\temp\\packetcapture.pcapng\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"ntuserdat-important-registry-entries\">NTUSER.DAT Important Registry entries:<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recent-execution-of-programs-gui\">Recent execution of programs (GUI)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\\RecentDocs <em>(Notes recent files run, most commonly .lnk files)<\/em><\/li>\n\n\n\n<li>\\UserAssist <em>(Notes files run and number of times run. Values are ROT13 encoded)<\/em>,\n<ul class=\"wp-block-list\">\n<li>CEBFF5CD is Executable File Execution<\/li>\n\n\n\n<li>F4E57C4B is Shortcut File Execution<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>\\TypedPaths <em>(Notes file locations visited using Windows Explorer address bar)<\/em><\/li>\n\n\n\n<li>\\RunMRU <em>(Notes recent commands executed through the \u2018run\u2019 program)<\/em><\/li>\n\n\n\n<li>\\ComDlg32 <em>(Last file path visited)<\/em>\n<ul class=\"wp-block-list\">\n<li>\\LastVisitedPidlMRU <em>(Last PID which was \u2018Most Recently Used\u2019, e.g. the binaries used to open a file)<\/em><\/li>\n\n\n\n<li>\\OpenSavePidlMRU <em>(Last Saved PID file which was \u2018Most Recently Used\u2019, location of a file opened by a binary)<\/em><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>\\WordWheelQuery <em>(Keywords searched for from the START menu bar)<\/em><\/li>\n\n\n\n<li>\\FeatureUsage\\AppBadgeUpdated (Every Time Task Bar Application Gets Notification and Badge Updates)<\/li>\n\n\n\n<li>\\FeatureUsage\\AppLaunch (Every Time Task Bar Application Which is Pinned is Launched)<\/li>\n\n\n\n<li>\\FeatureUsage\\AppSwitched (Every Time Task Bar Application Left Clicked)<\/li>\n\n\n\n<li>\\FeatureUsage\\ShowJumpView (Every Time Task Bar Application Right Clicked)<\/li>\n\n\n\n<li>\\FeatureUsage\\TrayButtonClicked (Every Time Relevant Button on Task Bar is Clicked)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">You can get the names of recently run files from UserAssist by using ROT13 across them, we can do this quickly in Powershell by using a script from BornToBeRoot and some scriptfu:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/JPMinty\/PowerShell\/blob\/master\/Scripts\/Convert-ROT13.ps1\">Convert-ROT13.ps1<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$A=$(gci REGISTRY::HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\*\\Count | Select -exp Property);foreach ($B in $A){.\\Convert-ROT13.ps1 -Rot 13 $B|Select -exp Text}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Or for those who don\u2019t want to run it over every entry individually.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$A=$(gci REGISTRY::HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\*\\Count | Select -exp Property)|Out-String;.\\Convert-ROT13.ps1 -Rot 13 $A|Select -exp Text\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recent-appslast-visited-mru\">Recent Apps\/Last Visited MRU<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: OpenSavePidlMRU is in hex and will need to be decoded<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKCU\\Software\\Microsoft\\Windows\\Current Version\\Search\\RecentApps\"\nreg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSavePidlMRU\" \/s\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"execution-of-sysinternals-tool\">Execution of Sysinternals Tool<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKCU\\Software\\Sysinternals\\ \/s \/v EulaAccepted\nreg query HKU\\SID\\Software\\Sysinternals\\ \/s \/v EulaAccepted\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recent-internet-explorer-history\">Recent Internet Explorer History<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKCU\\Software\\Microsoft\\Internet Explorer\\TypedURLs\"\nC:\\Users\\username\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\\nC:\\Users\\username\\AppData\\Local\\Microsoft\\Windows\\History\\\nC:\\Users\\username\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\nC:\\Users\\username\\AppData\\Local\\Microsoft\\Windows\\WebCache\\Internet Explorer\\WebCacheV01.dat\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.nirsoft.net\/utils\/ie_cache_viewer.html\">IE Cache Viewer<\/a> <a href=\"https:\/\/www.foxtonforensics.com\/browser-history-viewer\/\">Browser History Viewer<\/a> <a href=\"https:\/\/www.nirsoft.net\/utils\/ese_database_view.html\">ESE Database View<\/a> <a href=\"https:\/\/www.nirsoft.net\/utils\/browsing_history_view.html\">Browsing History View<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>esentutl.exe \/y \/vss C:\\Users\\Username\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat \/d C:\\Location\\WebCacheV01.dat\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recent-chrome-history\">Recent Chrome History<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>'C:\\Users\\Username\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\history'\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recent-firefox-history\">Recent Firefox History<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/profiles-where-firefox-stores-user-data#w_what-information-is-stored-in-my-profile\">More Information<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\username\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*\\\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recent-edge-history\">Recent Edge History<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\Username\\AppData\\Local\\Packagaes\\Microsoft.MicrosoftEdge_xxxx\\AC\\#!001\\MicrosoftEdge\\Cache\\\nC:\\Users\\Username\\AppData\\Local\\Packagaes\\Microsoft.MicrosoftEdge_xxxx\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\\nC:\\Users\\Username\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-root-certificate-store\">Check Root Certificate Store<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\\nreg query HKCU\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\\nreg query HKU\\{SID}\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\\nreg query HKLM\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\\nreg query HKCU\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\\nreg query HKU\\{SID}\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"thumbnail-cache\">Thumbnail Cache<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">[Thumbcacheviewer](https:\/\/github.com\/thumbcacheviewer\/thumbcacheviewer0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Files located at: C:\\Users\\Username\\AppData\\Local\\Microsoft\\Windows\\Explorer<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"shellbags\">Shellbags<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Shellbags can be used to verify the previous existance of files which have been deleted. This is used by the OS to store information about a file location\u2019s customisation e.g. look, feel, size, sorting files method, colour etc and resides after files have been deleted. Shellbags Explorer or ShellBagsView can be used to parse this information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HKCU\\SOFTWARE\\Microsoft\\Windows\\Shell<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\\BagMRU<\/li>\n\n\n\n<li>\\Bags<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">BagsMRU contains the database of folders and their saved settings by windows.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"usrclassdat-shellbags\">UsrClass.dat Shellbags<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Additional shellbags files can be found in UsrClass.dat<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HKCU\\SOFTWARE\\Classes<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>%USERPROFILE%\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"usb-information\">USB Information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Using the VolumeGUID found in SYSTEM\\MountedDevices, you can find the user that actually mounted the USB device: NTUSER.DAT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Mountpoints2 USB Times:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>First time device is connected<\/li>\n\n\n\n<li>Last time device is connected<\/li>\n\n\n\n<li>Removal time<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"software-hive-registry-entries\">SOFTWARE Hive Registry Entries<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"common-startup-locations\">Common startup locations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run<\/li>\n\n\n\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Runonce<\/li>\n\n\n\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunonceEx<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"network-information\">Network Information<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\n<ul class=\"wp-block-list\">\n<li>\\Signatures\n<ul class=\"wp-block-list\">\n<li>\\Unmanaged\n<ul class=\"wp-block-list\">\n<li>(record DefaultGatewayMac, DnsSuffix, FirstNetwork(SSID), ProfileGUID)<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>\\Managed<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>\\Nla\\Cache<\/li>\n\n\n\n<li>Profiles<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\HomeGroup<\/li>\n\n\n\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles{GUID}\n<ul class=\"wp-block-list\">\n<li>0x06 = Wired<\/li>\n\n\n\n<li>0x17 = Broadband<\/li>\n\n\n\n<li>0x47 = Wireless<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Gather information via Live Queries:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Signatures\\Unmanaged\" \/s\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\" \/s\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"gather-wifi-passwords\">Gather WiFi Passwords<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>netsh wlan show profile\nnetsh wlan show profile name={NAME} key=clear\nnetsh wlan export profile interface=* key=clear\nls C:\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\Interfaces\\*\\* | cat\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"networks-connecteddisconnected-tofrom-and-mac-address\">Networks connected\\disconnected to\\from and mac address<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-NetworkProfile\/Operational'; Id='10000';}|FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-NetworkProfile\/Operational'; Id='10001';}|FL TimeCreated,Message\nGet-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DHCP*'; Id='50067';}|FL TimeCreated,Message\nGet-WmiObject win32_networkadapterconfiguration | FL description, macaddress\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"get-host-mac-addresses\">Get host Mac Addresses<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>getmac\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"lookup-mac-addressorganizationally-unique-identifier-oui\">Lookup MAC Address\/Organizationally Unique Identifier (OUI)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A number of ways to do this but one of the most accurate is from the <a href=\"https:\/\/regauth.standards.ieee.org\/standards-ra-web\/pub\/view.html#registries\">IEEE Webpage<\/a>. You can interact directly with their REST API to get the results you want in JSON format. To do so via PowerShell, just change the \u2018text\u2019 top the first 3 digits of the MAC Address (The OUI):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;Net.ServicePointManager]::SecurityProtocol = &#91;Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri \"https:\/\/services13.ieee.org\/RST\/standards-ra-web\/rest\/assignments\/?registry=MAC&amp;text=08-00-27&amp;sortby=organization&amp;sortorder=asc&amp;size=10\" | Select -exp content;\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"useful-wireshark-filters\">Useful Wireshark filters<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"all-traffic-to-or-from-an-ip\">All traffic to or from an IP<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code> ip.addr == {IP}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"all-tcp-traffic-on-a-port\">All TCP traffic on a port<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tcp.port == {port}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"all-traffic-from-an-ip\">All traffic from an IP<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ip.src == {IP}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"all-traffic-to-an-ip\">All traffic to an IP<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ip.dst == {IP}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"http-or-dns-traffic\">HTTP or DNS Traffic<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>http || dns\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"clientdc-traffic-filtering-noise\">Client&gt;DC traffic filtering noise<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>smb || nbns || dcerpc || nbss || dns\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"tcp-issues-flags\">TCP issues (flags)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tcp.analysis.flags\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"tcp-protocol-flags-present\">TCP protocol flags (present)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tcp.flags.syn == 1\ntcp.flags.ack == 1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"encrypted-traffic\">Encrypted Traffic<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>(ssh || tls)\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"follow-tcp-stream\">Follow TCP Stream<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tcp.stream == {StreamNum}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"tcp-packets-for-string\">TCP packets for string<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tcp contains {String}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"http-codes\">HTTP codes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>http.response.code == 400\nhttp.response.code == 200\nhttp.response.code == 404\nhttp.response.code == 500\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"user-agent-withoutwith-case-sensitivity\">User agent, without\/with case sensitivity<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>http.user_agent matches \"firefox\"\nhttp.user_agent matches \"(?-i)firefox\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"addresses-on-subnet-by-iphostname\">Addresses on subnet by IP\/Hostname<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ip.addr == 172.217.167.78\/16\nip.addr eq hostname\/24\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"wireshark-key-tips-and-tricks-by-brad-duncan\">Wireshark Key Tips and Tricks by Brad Duncan<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.wireshark.org\/docs\/man-pages\/wireshark-filter.html\">General Wireshark Filter Reference<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.wireshark.org\/docs\/dfref\/\">Full Wireshark Display Filter Reference<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/unit42-customizing-wireshark-changing-column-display\/\">Customizing Wireshark \u2013 Changing Your Column Display<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/using-wireshark-display-filter-expressions\/\">Using Wireshark \u2013 Display Filter Expressions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/using-wireshark-identifying-hosts-and-users\/\">Using Wireshark: Identifying Hosts and Users<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/using-wireshark-exporting-objects-from-a-pcap\/\">Using Wireshark: Exporting Objects from a Pcap<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/wireshark-tutorial-examining-trickbot-infections\/\">Wireshark Tutorial: Examining Trickbot Infections<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/wireshark-tutorial-examining-ursnif-infections\/\">Wireshark Tutorial: Examining Ursnif Infections<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"decrypting-encrypted-packets\">Decrypting Encrypted Packets<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This can be done in a few ways:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Man-in-the-middle (MITM)<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/moxie0\/sslstrip\">MITM Through SSLStrip<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/mitmproxy.org\/\">MITM Through mitmproxy<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/wiki.wireshark.org\/TLS#Using_the_.28Pre.29-Master-Secret\">Using the (Pre)-Master-Secret SSLKEYLOGFILE<\/a> <a href=\"https:\/\/docs.microsoft.com\/en-us\/archive\/blogs\/nettracer\/decrypting-ssltls-sessions-with-wireshark-reloaded\">Using an RSA Private Key<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"system-hive-registry-entries\">SYSTEM Hive Registry Entries<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"usb-information-1\">USB Information<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices Note: Find Serial # and then look for FriendlyName to obtain the Volume Name of the USB device<\/li>\n\n\n\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EMDMgmt\n<ul class=\"wp-block-list\">\n<li>Key will ONLY be present if system drive is NOT SSD<\/li>\n\n\n\n<li>Traditionally used for ReadyBoost<\/li>\n\n\n\n<li>Find Serial # to obtain the Volume Serial Numberof the USB deviceoThe Volume Serial Number will be in decimal &#8211; convert to hex<\/li>\n\n\n\n<li>You can find complete history of Volume Serial Numbers here, even if the device has been formatted multiple times. The USB device\u2019s Serial # will appear multiple times, each with a different Volume Serial Number generated on each format.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>HKLM\\SYSTEM\\MountedDevices\n<ul class=\"wp-block-list\">\n<li>Find Serial # to obtain the Drive Letter of the USB device<\/li>\n\n\n\n<li>Find Serial # to obtain the Volume GUID of the USB device<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Live System<\/strong> HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR (Class ID\/Serial Number) HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USB (VID\/PID) HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceContainers*<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query HKLM\\SYSTEM\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\ \/s \/f FriendlyName\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\ \/s \/f FriendlyName\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USB\\ \/s \/f FriendlyName\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USB\\\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\\nreg query HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceContainers\\ \/s \/f \"USB\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Forensic Image<\/strong> (Determine Control Set Number from HKLM\\SYSTEM\\Select\\ -&gt; Current Value) HKLM\\SYSTEM\\ControlSet00x\\Enum\\USBSTOR (Class ID\/Serial Number) HKLM\\SYSTEM\\ControlSet00x\\Enum\\USB (VID\/PID)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note: VID\/PID information can be found online. Subdirectories under USB and USBSTOR provide unique USB identifiers (if the &amp; is near the end), if it is near the start they do not conform to MS standards and it is unique to the given PC only.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\Ven_Prod_Version\\USB iSerial#\\Properties{GUID}####\n<ul class=\"wp-block-list\">\n<li>0064 = First Install<\/li>\n\n\n\n<li>0066 = Last Connected<\/li>\n\n\n\n<li>0067 = Last Removal<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/woanware\/usbdeviceforensics\">More Information<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"os-information\">OS Information<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HKLM\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation<\/li>\n\n\n\n<li>HKLM\\SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName<\/li>\n\n\n\n<li>HKLM\\SYSTEM\\CurrentControlSet\\services\\LanmanServer\\Shares<\/li>\n\n\n\n<li>HKLM\\SYSTEM\\CurrentControlSet\\FileSystem\n<ul class=\"wp-block-list\">\n<li>NtfsDisableLastAccessUpdate set at 0x1 means that access time stamps are turned OFF by default<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"network-information-1\">Network Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>wmic nic get \/all \/format:list\nwmic nicconfig get \/all \/format:list\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HKLM\\SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters\\Interfaces\n<ul class=\"wp-block-list\">\n<li>Display interfaces and their IP address configuration (using interface GUID)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"prefetch-information\">Prefetch Information<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters\n<ul class=\"wp-block-list\">\n<li>0=Disabled<\/li>\n\n\n\n<li>1=Application prefetching enabled<\/li>\n\n\n\n<li>3=Application and Boot prefetching enabled (default)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">Prefetch Parser<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PECmd.exe -d \"C:\\Windows\\Prefetch\"\nPECmd.exe -d \"C:\\Windows\\Prefetch\" --csv \"c:\\temp\" --csvf Prefetch.csv\ngci C:\\Windows\\Prefetch\\\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/analyzeDFIR\/analyzePF\">analyzePF<\/a> <a href=\"https:\/\/www.nirsoft.net\/utils\/win_prefetch_view.html\">WinPrefetchView<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"superfetch-information\">Superfetch Information<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters \/v EnableSuperfetch\n<ul class=\"wp-block-list\">\n<li>0=Disabled<\/li>\n\n\n\n<li>1=Booting only<\/li>\n\n\n\n<li>2=Applications<\/li>\n\n\n\n<li>3=Application and Boot<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Find relevant files:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gci C:\\Windows\\Prefetch\\ -recurse -include *.db, *.trx\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"powershell-host-based-investigation-and-containment-techniques\">PowerShell Host Based Investigation and Containment Techniques<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Note: I thoroughly recommend looking at maintaining an accurate log of all actions taken through the use of PowerShell host based IR and Containment. To do so I recommend reading <a href=\"https:\/\/devblogs.microsoft.com\/powershell\/powershell-the-blue-team\/\">PowerShell \u2665 the Blue Team<\/a>. This will allow you to log all actions taken through this type of IR Framework. Other alternatives for larger scale response include:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"powerforensics\"><a href=\"https:\/\/powerforensics.readthedocs.io\/en\/latest\/\">PowerForensics<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"google-rapid-response\"><a href=\"https:\/\/github.com\/google\/grr\">Google Rapid Response<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"kansa-powershell-ir-framework\"><a href=\"https:\/\/github.com\/davehull\/Kansa\">Kansa PowerShell IR Framework<\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Google Rapid Response comes in the form of a Server &gt; Client architecture but is very flexible.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/grr-doc.readthedocs.io\/en\/latest\/index.html\">GRR Docs<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Kansa is a modular PowerShell IR Framework which can be used across multiple hosts in parallel.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enable-ps-remoting-using-psexec\">Enable PS Remoting using PsExec<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>psexec.exe \\\\TARGET -s powershell Enable-PSRemoting -Force;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">OR for public network setup (less security)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>psexec.exe \\\\TARGET -s powershell Enable-PSRemoting -SkipNetworkProfileCheck -Force;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"confirm-trusted-hosts-list-if-required\">Confirm trusted hosts list if required<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Item WSMan:\\localhost\\Client\\TrustedHosts\nSet-Item WSMan:\\localhost\\Client\\TrustedHosts -Value 'ASSET1,ASSET2'\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"quick-remote-response-no-auditlogging\">Quick Remote Response (no audit\/logging)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Enter-PSSession -ComputerName SERVER -Credential &#91;name]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"setup-logging-for-ir\">Setup logging for IR<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: If you enter a PSSession, the logging won\u2019t persist, so you will need to enable it on the remote host and pull the file back afterwards. Otherwise refer to PowerShell \u2665 the Blue Team mentioned above.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Start-Transcript -Path \"C:\\&#91;location]\\investigation-1.log\" -NoClobber\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/b2dfir.blogspot.com\/2018\/11\/windows-powershell-remoting-host-based.html\">Thanks Barnaby Skeggs<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"establish-remote-session\">Establish Remote Session<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$s1 = New-PSsession -ComputerName remotehost -SessionOption (New-PSSessionOption -NoMachineProfile) -ErrorAction Stop\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enter-or-exit-remote-session\">Enter or exit remote session<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Enter-PSSession -Session $s1\nExit-PSSEssion\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"issuing-remote-commandshell\">Issuing remote command\/shell<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {whoami} -Session $s1\nInvoke-Command -file file.ps1 -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"retrievingdownloading-files\">Retrieving\/downloading files<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Copy-Item -Path \"&#91;RemoteHostFilePath]\" -Destination \"&#91;LocalDestination]\" -FromSession $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"checking-for-running-processes\">Checking for running processes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {Get-Process} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"query-registry-keys\">Query Registry Keys<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {Get-ItemProperty -Path HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"pcap-collection\">PCAP collection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">*Note: Script and pcap should be located under: C:\\Windows\\System32 or your user directory.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {ipconfig} -Session $s1\n\nInvoke-Command -ScriptBlock {\n$url = \"https:\/\/raw.githubusercontent.com\/nospaceships\/raw-socket-sniffer\/master\/raw-socket-sniffer.ps1\"\nInvoke-WebRequest -Uri $url `\n\t-OutFile \"raw-socket-sniffer.ps1\"\nPowerShell.exe -ExecutionPolicy bypass .\\raw-socket-sniffer.ps1 `\n\t-InterfaceIp \"&#91;RemoteIPv4Address]\n\t-CaptureFile \"capture.cap\"\n\t} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"blocking-a-domain\">Blocking a domain<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock { Add-Content C:\\Windows\\System32\\drivers\\etc\\hosts \"`n127.0.0.1 bad.com\"} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"blocking-an-ip\">Blocking an IP<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {New-NetFirewallRule -DisplayName \"Block_Malicious_IP\" -Direction Outbound \u2013LocalPort Any -Protocol TCP -Action Block -RemoteAddress 173.182.192.43}  -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"unblocking-an-ip\">Unblocking an IP<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {Remove-NetFirewallRule -DisplayName \"Block_Malicious_IP\"} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"quarantining-a-host-using-firewall\">Quarantining a host using Firewall<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {New-NetFirewallRule -DisplayName InfoSec_Quarantine -Direction Outbound -Enabled True -LocalPort Any -RemoteAddress Any -Action Block} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"creating-an-ou-to-quarantine-a-host-into\">Creating an OU to quarantine a host into<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>import-module ActiveDirectory\nNew-ADOrganizationalUnit -Name \"Quarantined\" -Path \"DC=CORP,DC=COM\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Or<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dsadd ou \"ou=Quarantined,dc=CORP,dc=COM\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"moving-an-ad-object-into-a-quarantine-ou\">Moving an AD Object into a quarantine OU<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Move-ADObject -Identity \"CN=&lt;USERNAME&gt;,OU=Marketing,DC=CORP,DC=com\" -TargetPath \"OU=Quarantined,DC=CORP,DC=com\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"quarantining-a-host-using-dcom\">Quarantining a host using DCOM<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Another method which is a little more DANGEROUS is to disable DCOM on this host and restart which will stop something using DCOM to spread TO this host. This will likely break some aspects of it communicating on the domain, and also your ability to respond so it\u2019s not recommended, but this is a possible solution for a host which is to be thoroughly contained before being investigated once an asset is returned (for example for re-imaging). This can be reversed by changing this registry key back to Y.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {reg add HKLM\\SOFTWARE\\Microsoft\\Ole \/v EnableDCOM \/t REG_SZ \/d N \/f; shutdown \/r \/f;} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"remove-a-quarantined-host\">Remove a quarantined host<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {Remove-NetFirewallRule -DisplayName InfoSec_Quarantine} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"disable-admin-shares-1\">Disable Admin Shares<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-Command -ScriptBlock {Red add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" \/V \"AutoShareWks\" \/T \"REG_DWORD\" \/D \"0\" \/F } -Session $s1\nInvoke-Command -ScriptBlock {restart-service Lanmanserver -Force} -Session $s1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"credentials-and-exposure\">Credentials and Exposure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When investigating a compromised asset, it\u2019s important to know what remote triage methods leave your credentials on the infected endpoint, and what ones don\u2019t. Reference can be found on <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows-server\/identity\/securing-privileged-access\/securing-privileged-access-reference-material#administrative-tools-and-logon-types\">Microsoft Documentation<\/a><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Connection Method<\/th><th>Logon Type<\/th><th>Reusable credentials on destination<\/th><th>Notes<\/th><\/tr><\/thead><tbody><tr><td>Logon via console<\/td><td>Interactive<\/td><td>Y<\/td><td>Includes hardware remote access\/network KVM\/lights-out cards<\/td><\/tr><tr><td>RUNAS<\/td><td>Interactive<\/td><td>Y<\/td><td>Nil<\/td><\/tr><tr><td>RUNAS\/NETWORK<\/td><td>NewCredentials<\/td><td>Y<\/td><td>Clones LSA session, but uses new creds when connecting to network resources.<\/td><\/tr><tr><td>Remote Desktop<\/td><td>RemoteInteractive<\/td><td>Y<\/td><td>Nil<\/td><\/tr><tr><td>Remote Desktop Failure<\/td><td>RemoteInteractive<\/td><td>N<\/td><td>Only stored briefly<\/td><\/tr><tr><td>Net Use * \\SERVER<\/td><td>Network<\/td><td>N<\/td><td>Nil<\/td><\/tr><tr><td>Net Use * \\ SERVER \/user<\/td><td>Network<\/td><td>N<\/td><td>Nil<\/td><\/tr><tr><td>MMC snap-ins to remote computer<\/td><td>Network<\/td><td>N<\/td><td>Nil<\/td><\/tr><tr><td>PowerShell WinRM<\/td><td>Network<\/td><td>N<\/td><td>e.g. Enter-PSSession SERVER<\/td><\/tr><tr><td>PowerShell WinRM with CredSSP<\/td><td>NetworkClearText<\/td><td>Y<\/td><td>e.g. New-PSSession SERVER -Authentication Credssp -Credential PWD<\/td><\/tr><tr><td>PsExec without explicit creds<\/td><td>Network<\/td><td>N<\/td><td>e.g. PsExec \\SERVER cmd<\/td><\/tr><tr><td>PsExec with explicit creds<\/td><td>Network&amp;Interactive<\/td><td>Y<\/td><td>PsExec \\SERVER -u USER -p PWD cmd<\/td><\/tr><tr><td>Remote Registry<\/td><td>Network<\/td><td>N<\/td><td>Nil<\/td><\/tr><tr><td>Remote Desktop Gateway<\/td><td>Network<\/td><td>N<\/td><td>Authenticating to Remote Desktop Gateway<\/td><\/tr><tr><td>Scheduled Task<\/td><td>Batch<\/td><td>Y<\/td><td>Also saved as LSA secret on disk<\/td><\/tr><tr><td>Tools as Service<\/td><td>Service<\/td><td>Y<\/td><td>Also saved as LSA secret on disk<\/td><\/tr><tr><td>Vuln Scanners<\/td><td>Network<\/td><td>N<\/td><td>Most use Network logons; however, those that don\u2019t have the risk of creds on destination.<\/td><\/tr><tr><td>IIS \u201cBasic Authentication\u201d<\/td><td>NetworkCleartext<\/td><td>Y<\/td><td>Nil<\/td><\/tr><tr><td>IIS \u201cIntegrated Windows Authentication\u201d<\/td><td>Network<\/td><td>N<\/td><td>NTLM\/Kerberos Providers<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"kerberos-tickets-and-exposure\">Kerberos Tickets and Exposure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Special thanks to <a href=\"https:\/\/cert.europa.eu\/static\/WhitePapers\/CERT-EU_SWP_17-002_Lateral_Movements.pdf\">Cert EU<\/a> for this. When comparing Pass-the-Hash to Pass-the-Ticket attacks, the following key differences apply:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Administrative privileges are required to steal credentials, but NOT to use an obtained Kerberos ticket.<\/li>\n\n\n\n<li>A password change does NOT make Kerberos tickets invalid. By default Kerberos has a max lifetime of 10hrs before the ticket must be renewed, and a max renewal time of 7 days after being granted.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Due to this disabling accounts may not be enough to prevent ongoing compromise, and you may have to purge the users kerberos ticket. Locate the user in question using \u2018sessions\u2019 and purge by specifying the user session prior to logging them off.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>klist.exe sessions\nklist purge \u2013li 0x2e079217 \nquery user\nlogoff &lt;session id&gt;\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"windows-memory-forensics\">Windows Memory Forensics<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"volatility-2x-basics\">Volatility 2.x Basics<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">(Note: Depending on what version of volatility you are using and where you may need to substitute volatility with vol.py if there\u2019s no alias setup)<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"find-out-what-profiles-you-have-available\">Find out what profiles you have available<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility --info\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"find-out-the-originating-os-profile-to-be-used-from-the-memory-dump\">Find out the originating OS profile to be used from the memory dump.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem imageinfo\nvolatility -f memorydump.mem kdbgscan\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"determine-what-plugins-are-available-for-use\">Determine what plugins are available for use.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; -h\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-what-processes-were-running\">Check what processes were running.<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">(Note: Any entires for svchost.exe should always have services.exe as a parent process and parameters such as \/k should always be present)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; pslist\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; psscan\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; tree\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-what-commands-have-been-run-and-their-output\">Check what commands have been run and their output.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; cmdscan\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; consoles\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dump-process-files-which-were-running-from-memory\">Dump process files which were running from memory.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; procdump -p &lt;processid&gt; --dump-dir=.\/\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dump-the-memory-associated-with-a-process-file\">Dump the memory associated with a process file.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; memdump -p &lt;processid&gt; --dump-dir=.\/\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dump-all-cached-files-from-memory\">Dump all cached files from memory.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; dumpfiles --dump-dir=.\/\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-what-drivers-or-kernal-modules-were-unloaded-or-hidden\">Check what drivers or kernal modules were unloaded or hidden.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; modscan\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-what-network-connectivity-has-occurred\">Check what network connectivity has occurred.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; netscan\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-what-network-connectivity-has-occurred-windows-xpserver-2003\">Check what network connectivity has occurred (Windows XP\/Server 2003).<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; connections\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; conscan\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; sockets\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; sockscan\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-what-information-exists-within-registry-from-memory\">Check what information exists within registry from memory.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; hivelist\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; hivescan\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; hivedump --dump-dir=.\/\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; userassist\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; shellbags\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; shimcache\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; shimcachemem\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"scan-memory-with-yara-rule\">Scan memory with Yara Rule<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; yarascan -y rule.yara\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"duplicate-image-space-out-as-a-raw-dd-file\">Duplicate image space out as a raw DD file<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">(e.g. dump files such as hiberfil.sys memory from memory).<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; imagecopy\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dump-timelined-artifacts-from-memory\">Dump timelined artifacts from memory.<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; timeliner\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"detect-persistence-mechanisms-using-winesap\">Detect persistence mechanisms using Winesap<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"http:\/\/www.dfrws.org\/sites\/default\/files\/session-files\/characteristics_and_detectability_of_windows_auto-start_extensibility_points_in_memory_forensics.pdf\">Research Paper<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/gitlab.unizar.es\/rrodrigu\/winesap\">Volatility Plugin &#8211; Winesap<\/a> <code>volatility -f memdump.mem --profile=[profile] autoruns volatility --plugins=.\/winesap\/plugin -f memdump.mem --profile=[profile] autoruns volatility --plugins=.\/winesap\/plugin -f memdump.mem --profile=[profile] autoruns --match<\/code><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"compare-memory-dump-to-known-good-memory-dump\">Compare memory dump to known good memory dump.<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/csababarta\/volatility_plugins\">csababarta plugins<\/a> volatility -f infected.mem \u2013profile= processbl -B clean.mem -U 2>\/dev\/null volatility -f infected.mem &#8211;profile= servicebl -B clean.mem -U 2>\/dev\/null volatility -f infected.mem &#8211;profile= driverbl -B clean.mem -U 2>\/dev\/null<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"output-visual-dot-file-to-view-process-tree\">Output visual .dot file to view process tree<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; psscan --output=dot --output-file=psscan.dot\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; tree --output=dot --output-file=pstree.dot\ndot -Tpng pstree.dot -o pstree.png\ndot -Tpng pstree.dot -o psscan.png\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"volatility-3x-basics\">Volatility 3.x Basics<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: <a href=\"https:\/\/github.com\/volatilityfoundation\/volatility3\/\">Version 3 of Volatility<\/a> was released in November 2019 which changes the Volatility usage and syntax. More information on V3 of Volatility can be found on <a href=\"https:\/\/volatility3.readthedocs.io\/en\/latest\/basics.html\">ReadTheDocs<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A list of common plugins are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>linux.bash.Bash<\/li>\n\n\n\n<li>linux.check_afinfo.Check_afinfo<\/li>\n\n\n\n<li>linux.check_syscall.Check_syscall<\/li>\n\n\n\n<li>linux.elfs.Elfs<\/li>\n\n\n\n<li>linux.lsmod.Lsmod<\/li>\n\n\n\n<li>linux.lsof.Lsof<\/li>\n\n\n\n<li>linux.malfind.Malfind<\/li>\n\n\n\n<li>linux.proc.Maps<\/li>\n\n\n\n<li>linux.pslist.PsList<\/li>\n\n\n\n<li>linux.pstree.PsTree<\/li>\n\n\n\n<li>mac.bash.Bash<\/li>\n\n\n\n<li>mac.check_syscall.Check_syscall<\/li>\n\n\n\n<li>mac.check_sysctl.Check_sysctl<\/li>\n\n\n\n<li>mac.check_trap_table.Check_trap_table<\/li>\n\n\n\n<li>mac.ifconfig.Ifconfig<\/li>\n\n\n\n<li>mac.lsmod.Lsmod<\/li>\n\n\n\n<li>mac.lsof.lsof<\/li>\n\n\n\n<li>mac.malfind.Malfind<\/li>\n\n\n\n<li>mac.netstat.Netstat<\/li>\n\n\n\n<li>mac.proc_maps.Maps<\/li>\n\n\n\n<li>mac.psaux.Psaux<\/li>\n\n\n\n<li>mac.pslist.PsList<\/li>\n\n\n\n<li>mac.pstree.PsTree<\/li>\n\n\n\n<li>mac.tasks.Tasks<\/li>\n\n\n\n<li>mac.timers.Timers<\/li>\n\n\n\n<li>mac.trustedbsd.trustedbsd<\/li>\n\n\n\n<li>windows.cmdline.CmdLine<\/li>\n\n\n\n<li>windows.dlldump.DllDump<\/li>\n\n\n\n<li>windows.dlllist.DllList<\/li>\n\n\n\n<li>windows.driverirp.DriverIrp<\/li>\n\n\n\n<li>windows.driverscan.DriverScan<\/li>\n\n\n\n<li>windows.filescan.FileScan<\/li>\n\n\n\n<li>windows.handles.Handles<\/li>\n\n\n\n<li>windows.info.Info<\/li>\n\n\n\n<li>windows.malfind.Malfind<\/li>\n\n\n\n<li>windows.moddump.ModDump<\/li>\n\n\n\n<li>windows.modscan.ModScan<\/li>\n\n\n\n<li>windows.modules.Modules<\/li>\n\n\n\n<li>windows.mutantscan.MutantScan<\/li>\n\n\n\n<li>windows.poolscanner.PoolScanner<\/li>\n\n\n\n<li>windows.procdump.ProcDump<\/li>\n\n\n\n<li>windows.pslist.PsList<\/li>\n\n\n\n<li>windows.psscan.PsScan<\/li>\n\n\n\n<li>windows.pstree.PsTree<\/li>\n\n\n\n<li>windows.registry.certificates.Certificates<\/li>\n\n\n\n<li>windows.registry.hivedump.HiveDump<\/li>\n\n\n\n<li>windows.registry.hivelist.HiveList<\/li>\n\n\n\n<li>windows.registry.hivescan.HiveScan<\/li>\n\n\n\n<li>windows.registry.printkey.PrintKey<\/li>\n\n\n\n<li>windows.registry.userassist.UserAssist<\/li>\n\n\n\n<li>windows.ssdt.SSDT<\/li>\n\n\n\n<li>windows.statistics.Statistics<\/li>\n\n\n\n<li>windows.strings.Strings<\/li>\n\n\n\n<li>windows.symlinkscan.SymlinkScan<\/li>\n\n\n\n<li>windows.vaddump.VadDump<\/li>\n\n\n\n<li>windows.vadinfo.VadInfo<\/li>\n\n\n\n<li>windows.virtmap.VirtMap<\/li>\n\n\n\n<li>timeliner.Timeliner<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-memory-image-information\">Check Memory Image Information<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.info.Info\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-list-of-kernel-drivers\">Check List of Kernel Drivers<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.modules.Modules\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-list-of-kernel-drivers-incl-previously-unloaded-and-hidden\">Check List of Kernel Drivers (incl previously unloaded and hidden)<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.modscan.ModScan\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dump-list-of-kernel-drivers-to-files\">Dump List of Kernel Drivers to Files<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.moddump.ModDump\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dump-list-of-running-processes-to-files\">Dump List of Running Processes to Files<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.procdump.ProcDump\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-process-list-of-running-processes\">Check Process List of Running Processes<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.pslist.PsList\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-process-tree-of-running-processes\">Check Process Tree of Running Processes<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.pstree.PsTree\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-running-processes-from-eprocess-blocks\">Check Running Processes from EPROCESS blocks<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.psscan.PsScan\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-running-processes-for-possible-shellcodeinjection-via-page_execute_readwrite\">Check Running Processes for possible shellcode\/injection via PAGE_EXECUTE_READWRITE<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.malfind.Malfind\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-processes-and-their-command-lines\">Check processes and their command lines<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.cmdline.CmdLine\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"check-for-files-which-exist-in-memory\">Check for files which exist in memory<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/bin\/python3.6 vol.py -f \/home\/user\/samples\/mem.bin windows.filescan.FileScan\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"miscellaneous-tools-and-notes\">Miscellaneous Tools and Notes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">Eric Zimmerman has excellent widely used libraries and tools<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"regripper\"><a href=\"https:\/\/github.com\/keydet89\/RegRipper2.8\">RegRipper<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>rip.pl -r NTUSER.DAT -f ntuser | less.\nrip.pl -r SAM -f sam | less\nrip.exe -l\nrip.exe -r C:\\Users\\User\\ntuser.dat -p userassist\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"kape\"><a href=\"https:\/\/learn.duffandphelps.com\/kape\">Kape<\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">*Note: <a href=\"https:\/\/www.youtube.com\/watch?v=L9H1uj2HSb8\">Video Tutorial<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kape.exe --tsource C --target RegistryHives --tdest \"&#91;location]\"\nkape.exe --tsource \\\\server\\directory --target !ALL --tdest \"&#91;location]\" --vhdx LOCALHOST\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"shimcaheparser\"><a href=\"https:\/\/github.com\/mandiant\/ShimCacheParser\">ShimCaheParser<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ShimCacheParser.py -h\nShimCacheParser.py -i SYSTEM --BOM \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"appcompatcacheparser\"><a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">AppCompatCacheParser<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>AppCompatCacheParser.exe --csv .\\ -t\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"amcacheparser\"><a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">AmCacheParser<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>AmcacheParser.exe --csv .\\ -f .\\Amcache.hve\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"windows-10-timeline-database-parser\"><a href=\"https:\/\/ericzimmerman.github.io\/#!index.md\">Windows 10 Timeline Database Parser<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>WxTCmd.exe -f \"C:\\Users\\&#91;username]\\AppData\\Local\\ConnectedDevicesPlatform\\L.&#91;username]\\ActivitiesCache.db\" --csv .\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"bulk-extractor\"><a href=\"http:\/\/downloads.digitalcorpora.org\/downloads\/bulk_extractor\/\">Bulk Extractor<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>bulk_extractor64.exe -o &#91;outputdir] memdump.mem\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"forensicdots\"><a href=\"https:\/\/www.forensicdots.de\/\">ForensicDots<\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Can be used to determine the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Machine_Identification_Code\">Machine Identification Code<\/a> of a Printer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"cyber-chef\"><a href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyber Chef<\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Cyber Swiss Army Knife &#8211; a web app for encryption, encoding, compression and data analysis. Note: This was created by an analyst at the GCHQ which is part of the UKs National Cyber Security Centre. The source is actively maintained on <a href=\"https:\/\/github.com\/gchq\/CyberChef\">Github<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"urlscan\"><a href=\"https:\/\/urlscan.io\/\">URLScan<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"osquery\"><a href=\"https:\/\/www.osquery.io\/\">OSQuery<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"velociraptor\"><a href=\"https:\/\/www.velocidex.com\/docs\/\">Velociraptor<\/a><\/h3>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"vipermonkey\"><a href=\"https:\/\/github.com\/kirk-sayre-work\/ViperMonkey\">ViperMonkey<\/a><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"parse-and-interpret-vba-macros\">Parse and interpret VBA macros<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>vmonkey phishing.docm\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"faster-output\">Faster output<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>pypy vmonkey.py -s phishing.docm\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"less-verbose-output\">Less verbose output<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>vmonkey -l warning phishing.docm\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"xlm-macro-deobfuscator\"><a href=\"https:\/\/github.com\/DissectMalware\/XLMMacroDeobfuscator\">XLM Macro Deobfuscator<\/a><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"parse-and-interpret-hidden-xlm-macros-excel-40-macros\">Parse and interpret hidden XLM Macros (Excel 4.0 Macros)<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>xlmdeobfuscator --file malware.xlsm\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Using a tool such as <a href=\"http:\/\/b2xtranslator.sourceforge.net\/snapshots\/BiffView.zip\">BiffView<\/a> we\u2019re able to view BOUNDSHEET records to find hidden sheets. This is indicated by \u201802 01\u2019 hex values at the 5th and 6th offset.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Changing 02 to 00 makes these hidden spreadsheets visible without having to run any macros.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mounting-image-files-in-linux\">Mounting image files in linux<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir \/mnt\/windows\nimageMounter.py\nImageMounter.py -s &lt;imagefile&gt; \/mnt\/windows\ncd \/mnt\/windows\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">OR<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir \/mnt\/windows\nsudo apt install libguestfs-tools\nsudo virt-list-filesystems &lt;vhdx file&gt;\nsudo guestmount -a &lt;vhdx file&gt; -m \/dev\/&lt;filesystemabove&gt; -r \/mnt\/windows -o allow_other\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mounting-image-files-in-windows\">Mounting image files in Windows<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/arsenalrecon.com\/downloads\/\">Arsenal Image Mounter<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/accessdata.com\/product-download\/ftk-imager-version-4-2-1\">FTK Imager<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.sleuthkit.org\/autopsy\/download.php\">Autopsy<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"unpack-binary-packed-with-upx\">Unpack binary packed with UPX<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>upx -d PackedProgram.exe\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scan-exchange-for-phishing-emails\">Scan exchange for phishing emails<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Disclaimer: Always test before running against live systems. For those running Office365 <a href=\"https:\/\/docs.microsoft.com\/en-us\/office365\/securitycompliance\/search-for-and-delete-messages-in-your-organization\">this documentation<\/a> may be more useful.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># This is used to authenticate yourself and connect to the exchange server\n$UserCredential = Get-Credential\n$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http:\/\/EXCHANGEHOSTFQDN\/PowerShell\/ -Credential $UserCredential\nImport-PSSession $Session -DisableNameChecking\n\n# This is used to confirm the mailboxes accessible and modules available\nGet-Mailbox\nGet-Module\n\n# This is used to remove emails from a mailbox and move them to an administrator mailbox as a backup\nSearch-Mailbox -Identity \"NAME\" | Search-Mailbox -SearchQuery 'Subject:\"SUBJECT LINE\"' -TargetMailbox \"ADMINBACKUPMAILBOX\" -TargetFolder \"BACKUPFOLDER\" -DeleteContent\n\n# This is used to run a report on anyone who received an email with a malicious attachment and log this information in an administrator mailbox\nGet-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery attachment:trojan* -TargetMailbox \"ADMINBACKUPMAILBOX\" -TargetFolder \"BACKUPFOLDER\" -LogOnly -LogLevel Full\n\n# This is used to disconnect from the established powershell session\nRemove-PSSession $Session\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"common-dll-information\">Common DLL Information<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>DLL<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>Kernel32.dll<\/td><td>(Windows Kernel) This is a very common DLL that contains core functionality, such as access and manipulation of memory, files, and hardware.<\/td><\/tr><tr><td>Advapi32.dll<\/td><td>(Advanced API) This DLL provides access to advanced core Windows components such as the Service Manager and Registry.<\/td><\/tr><tr><td>Ntdll.dll<\/td><td>(NT Layer) This DLL is the interface to the Windows kernel. Executables rarely import this file directly, although it is always imported indirectly by Kernel32.dll. If an executable deliberately imports this, it means that the author wanted to use functionality not normally available to Windows programs. Some tasks, such as hiding functionality or manipulating processes, will use this interface.<\/td><\/tr><tr><td>User32.dll<\/td><td>(Windows User) This DLL contains all the user interface components, such as buttons, scroll bars, and components for controlling and responding to user actions.<\/td><\/tr><tr><td>Wininet.dll<\/td><td>(Windows Internet API) This DLL contains high level networking functions. These implement protocols such as FTP, HTTP, and NTP.<\/td><\/tr><tr><td>Gdi32.dll<\/td><td>(Graphics Device Interface) This DLL contains functions used for displaying and manipulating graphics.<\/td><\/tr><tr><td>WSock32.dll and Ws2_32.dll<\/td><td>(Windows Sockets API) These are networking DLLs. A program that accesses either of these will likely connect to a network or perform network related tasks.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>When analysing a binary, small amount of strings present and minimal imported functions help confirm that it is a packed binary.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"show-processes-with-networking-functions\">Show processes with networking functions<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist \/m WSock32.dll\ntasklist \/m Ws2_32.dll\ntasklist \/m Wininet.dll\ntasklist \/m winhttp.dll\ngps | ?{$_.Modules -like '*WSock32.dll*' -OR $_.Modules -like '*Ws2_32.dll*' -OR $_.Modules -like '*Wininet.dll*' -OR $_.Modules -like '*winhttp.dll*' }|FL Id, ProcessName\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"show-processes-importing-the-remote-access-api\">Show processes importing the Remote Access API<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist \/m RASAPI32.dll\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"show-processes-importing-the-task-scheduler-api\">Show processes importing the task scheduler API<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist \/m taskschd.dll\ntasklist \/m mstask.dll\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"show-processes-importing-the-windows-media-instrumentation-api\">Show processes importing the Windows Media Instrumentation API<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist \/m wbem*\ntasklist \/m wmi*\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"windows-memory-analysis-example-process-with-volatility\">Windows Memory Analysis (Example Process with Volatility)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Identify memory OS information<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem imageinfo\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Identify suspicious running processes<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; pstree\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show suspicious running processes based on names.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; pstree | egrep 'winlogon|lsass|services'\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; psscan\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show any malicious or suspicious processes requiring investigation<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; malfind\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show any Process Hollowing (Hollow Process Injection)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; hollowfind\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Dump suspicious process executables from memory<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; procdump -p &lt;processid&gt; --dump-dir=.\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Parse the Master File Table<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f &lt;memoryDump&gt; mftparser -C --output-file=output.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reassemble raw hex of file under $DATA back into original file from dump.raw file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>xxd -r dump.raw &gt; &lt;filename.originalextension&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Compare hashes with known detections e.g. VirusTotal.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sha256 &lt;filename&gt;\nhttps:&#47;&#47;www.virustotal.com\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Create a timeline of events.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>volatility -f memorydump.mem --profile=&lt;profilename&gt; timeliner\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; timeliner --hive=SECURITY\nvolatility -f memorydump.mem --profile=&lt;profilename&gt; timeliner --type=Registry\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"windows-memory-analysis-using-windbg\">Windows Memory Analysis using Windbg<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Using <a href=\"https:\/\/github.com\/comaeio\/SwishDbgExt\">Comaeio SwishDbgExt<\/a> you are able to better analyse Windows Crash (DMP) files using Windbg. To do this, download the latest release, run windbg, load the correct dll and then run a command. At the time of writing there are:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>!load X:\\FullPath\\SwishDbgExt.dll \n\n!help             - Displays information on available extension commands\n!ms_callbacks     - Display callback functions\n!ms_checkcodecave - Look for used code cave\n!ms_consoles      - Display console command's history \n!ms_credentials   - Display user's credentials (based on gentilwiki's mimikatz) \n!ms_drivers       - Display list of drivers\n!ms_dump          - Dump memory space on disk\n!ms_exqueue       - Display Ex queued workers\n!ms_fixit         - Reset segmentation in WinDbg (Fix \"16.kd&gt;\")\n!ms_gdt           - Display GDT\n!ms_hivelist      - Display list of registry hives\n!ms_idt           - Display IDT\n!ms_lxss          - Display lsxx entries\n!ms_malscore      - Analyze a memory space and returns a Malware Score Index (MSI) - (based on Frank Boldewin's work)\n!ms_mbr           - Scan Master Boot Record (MBR)\n!ms_netstat       - Display network information (sockets, connections, ...)\n!ms_object        - Display list of object\n!ms_process       - Display list of processes\n!ms_readkcb       - Read key control block\n!ms_readknode     - Read key node\n!ms_readkvalue    - Read key value\n!ms_regcheck      - Scan for suspicious registry entries\n!ms_scanndishook  - Scan and display suspicious NDIS hooks\n!ms_services      - Display list of services\n!ms_ssdt          - Display service descriptor table (SDT) functions\n!ms_store         - Display information related to the Store Manager (ReadyBoost)\n!ms_timers        - Display list of KTIMER\n!ms_vacbs         - Display list of cached VACBs\n!ms_verbose       - Turn verbose mode on\/off\n!ms_yarascan      - Scan process memory using yara rules\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"normal-process-relationship-hierarchy-geneology\">Normal Process Relationship Hierarchy (Geneology)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/digital-forensics.sans.org\/media\/DFPS_FOR508_v4.6_4-19.pdf\">Excellent SANS Reference<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Old:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">System<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>smss.exe\n<ul class=\"wp-block-list\">\n<li>winlogon.exe (upon smss.exe exiting)\n<ul class=\"wp-block-list\">\n<li>userinit.exe\n<ul class=\"wp-block-list\">\n<li>explorer.exe (upon userinit.exe exiting)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>wininit.exe (upon smss.exe exiting)\n<ul class=\"wp-block-list\">\n<li>lsass.exe<\/li>\n\n\n\n<li>services.exe\n<ul class=\"wp-block-list\">\n<li>svchost.exe<\/li>\n\n\n\n<li>taskhost.exe<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>crss.exe<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Windows 10:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">System<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>smss.exe\n<ul class=\"wp-block-list\">\n<li>winlogon.exe (upon smss.exe exiting)\n<ul class=\"wp-block-list\">\n<li>userinit.exe\n<ul class=\"wp-block-list\">\n<li>explorer.exe (upon userinit.exe exiting)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>wininit.exe (upon smss.exe exiting)\n<ul class=\"wp-block-list\">\n<li>lsass.exe<\/li>\n\n\n\n<li>lsaiso.exe (credential guard only)<\/li>\n\n\n\n<li>services.exe\n<ul class=\"wp-block-list\">\n<li>svchost.exe\n<ul class=\"wp-block-list\">\n<li>taskhostw.exe<\/li>\n\n\n\n<li>runtimebroker.exe<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>crss.exe<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"extra-notes\">Extra notes<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Be mindful of the below:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>svchost.exe should always have services.exe pid as ppid and a service associated with it.<\/li>\n\n\n\n<li>there should never be more than 1 lsass.exe process.<\/li>\n\n\n\n<li>lsass.exe should always have a parent of winlogon.exe (WinXP and older) or Wininit.exe (Vista or newer).<\/li>\n\n\n\n<li>pslist and pstree follow a \u2018Double Linked List\u2019 which malware can \u2018unlink\u2019 itself from thus hiding the process.<\/li>\n\n\n\n<li>psscan looks instead for \u2018EPROCESS blocks\u2019 which is memory associated with a windows process.<\/li>\n\n\n\n<li>Discrepencies between these 2 areas can indicate the process hollowing has occurred.\n<ul class=\"wp-block-list\">\n<li>VAD = Virtual Address Descriptor which lives in kernel memory.<\/li>\n\n\n\n<li>PEB = Process Environment Block which lives in process memory.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>PAGE_EXECUTE_READWRITE protection indicates memory marked as executable, which may indicate potential shellcode was used or injected.<\/li>\n\n\n\n<li>Process hollowing essentially pauses and duplicates a legitimate process, replaces the executable memory with something malicious, and then resumes the process. Process Injection on the other hand injects malicious code into an already running process which causes that process to execute the code.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"linux-cheat-sheet\">Linux Cheat Sheet<\/h1>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"dumping-memory\">Dumping Memory<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>dd if=\/dev\/kmem of=\/root\/kmem\ndd if=\/dev\/mem of=\/root\/mem\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/504ensicsLabs\/LiME\/releases\">LiME<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo insmod .\/lime.ko \"path=.\/Linmen.mem format=raw\"\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"taking-image\">Taking Image<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>fdisk -l\ndd if=\/dev\/sda1 of=\/&#91;outputlocation]\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"misc-useful-tools\">Misc Useful Tools<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/SekoiaLab\/Fastir_Collector_Linux\">FastIR<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>python .\/fastIR_collector_linux.py\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/rebootuser\/LinEnum\/blob\/master\/LinEnum.sh\">LinEnum<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/linenum.sh\n.\/linenum.sh -t\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"live-triage\">Live Triage<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"system-information-1\">System Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>date\nuname \u2013a\nhostname\ncat \/proc\/version\nlsmod\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"account-information\">Account Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/passwd\ncat \/etc\/shadow\ncat \/etc\/sudoers\ncat \/etc\/sudoers.d\/*\ncut -d: -f1 \/etc\/passwd\ngetent passwd | cut -d: -f1\ncompgen -u\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"current-user\">Current user<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>whoami\nwho\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"last-logged-on-users\">Last logged on users<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>last\nlastb\ncat \/var\/log\/auth.log\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"initialisation-files\">Initialisation Files<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/bash.bashrc\ncat ~\/.bash_profile \ncat ~\/.bashrc \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"environment-and-startup-programs\">Environment and Startup Programs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/profile\nls \/etc\/profile.d\/\ncat \/etc\/profile.d\/*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"scheduled-tasks\">Scheduled Tasks<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/etc\/cron.*\nls \/etc\/cron.*\/*\ncat \/etc\/cron.*\/*\ncat \/etc\/crontab\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ssh-keys-and-authorised-users\">SSH Keys and Authorised Users<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/ssh\/sshd_config\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: This specifies where the SSH daemon will look for keys. Generally this will be as below.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/home\/*\/.ssh\/*\ncat \/home\/*\/.ssh\/id_rsa.pub\ncat \/home\/*\/.ssh\/authorized_keys\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"sudoers-file-who-who-can-run-commands-as-a-different-user\">Sudoers File (who who can run commands as a different user)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/sudoers\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configuration-information\">Configuration Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/etc\/*.d\ncat \/etc\/*.d\/*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"network-connections--socket-stats\">Network Connections \/ Socket Stats<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>netstat\nnetstat -apetul\nnetstat -plan\nnetstat -plant\nss\nss -l\nss -ta\nss -tp\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ip-table-information\">IP Table Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/etc\/iptables\ncat \/etc\/iptables\/*.v4\ncat \/etc\/iptables\/*.v6\niptables -L\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"network-configuration\">Network Configuration<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ifconfig -a\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"browser-plugin-information\">Browser Plugin Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -la ~\/.mozilla\/plugins\nls -la \/usr\/lib\/mozilla\/plugins\nls -la \/usr\/lib64\/mozilla\/plugins\nls -la ~\/.config\/google-chrome\/Default\/Extensions\/\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"kernel-modules-and-extensions\">Kernel Modules and Extensions\/<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -la \/lib\/modules\/*\/kernel\/*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-information-2\">Process Information<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>ps &lt;simple<\/td><td>list<\/td><td>output<\/td><td>threads<\/td><td>misc<\/td><td>all&gt;\u2019<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -s\nps -l\nps -o\nps -t\nps -m\nps -a\ntop\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"search-files-recursively-in-directory-for-keyword\">Search files recursively in directory for keyword<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>grep -H -i -r \"password\" \/\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-tree\">Process Tree<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -auxwf\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"open-files-and-space-usage\">Open Files and space usage<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>lsof\ndu\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"pluggable-authentication-modules-pam\">Pluggable Authentication Modules (PAM)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/pam.d\/sudo\ncat \/etc\/pam.conf\nls \/etc\/pam.d\/\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"disk--partition-information\">Disk \/ Partition Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>fdisk -l\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"system-calls--network-traffic\"><a href=\"https:\/\/bytefreaks.net\/gnulinux\/how-to-capture-all-network-traffic-of-a-single-process\">System Calls \/ Network Traffic<\/a><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>strace -f -e trace=network -s 10000 &lt;PROCESS WITH ARGUMENTS&gt;;\nstrace -f -e trace=network -s 10000 -p &lt;PID&gt;;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: Below material with thanks to <a href=\"https:\/\/blog.apnic.net\/2019\/10\/14\/how-to-basic-linux-malware-process-forensics-for-incident-responders\/\">Craig Rowland &#8211; Sandfly Security<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"detailed-process-information\">Detailed Process Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -al \/proc\/&#91;PID]\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Note:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CWD = Current Working Directory of Malware<\/li>\n\n\n\n<li>EXE = Binary location and whether it has been deleted<\/li>\n\n\n\n<li>Most Common Timestamp = When process was created<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"recover-deleted-binary-which-is-currently-running\">Recover deleted binary which is currently running<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cp \/proc\/&#91;PID]\/exe \/&#91;destination]\/&#91;binaryname]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"capture-binary-data-for-review\">Capture Binary Data for Review<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cp \/proc\/&#91;PID]\/ \/&#91;destination]\/&#91;PID]\/\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"binary-hash-information\">Binary hash information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sha1sum \/&#91;destination]\/&#91;binaryname]\nmd5sum \/&#91;destination]\/&#91;binaryname]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-command-line-information\">Process Command Line Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/proc\/&#91;PID]\/cmdline\ncat \/proc\/&#91;PID]\/comm\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Note:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Significant differences in the above 2 outputs and the specified binary name under \/proc\/[PID]\/exe can be indicative of malicious software attempting to remain undetected.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-environment-variables-incl-user-who-ran-binary\">Process Environment Variables (incl user who ran binary)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>strings \/proc\/&#91;PID]\/environ\ncat \/proc\/&#91;PID]\/environ\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-file-descriptorsmaps-what-the-process-is-accessing-or-using\">Process file descriptors\/maps (what the process is \u2018accessing\u2019 or using)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -al \/proc\/&#91;PID]\/fd\ncat \/proc\/&#91;PID]\/maps\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-stackstatus-information-may-reveal-useful-elements\">Process stack\/status information (may reveal useful elements)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/proc\/&#91;PID]\/stack\ncat \/proc\/&#91;PID]\/status\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"deleted-binaries-which-are-still-running\">Deleted binaries which are still running<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -alr \/proc\/*\/exe 2&gt; \/dev\/null |  grep deleted\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"process-working-directories-including-common-targeted-directories\">Process Working Directories (including common targeted directories)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -alr \/proc\/*\/cwd\nls -alr \/proc\/*\/cwd 2&gt; \/dev\/null | grep tmp\nls -alr \/proc\/*\/cwd 2&gt; \/dev\/null | grep dev\nls -alr \/proc\/*\/cwd 2&gt; \/dev\/null | grep var\nls -alr \/proc\/*\/cwd 2&gt; \/dev\/null | grep home\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"hidden-directories-and-files\">Hidden Directories and Files<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -type d -name \".*\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"immutable-files-and-directories-often-suspicious\">Immutable Files and Directories (Often Suspicious)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>lsattr \/ -R 2&gt; \/dev\/null | grep \"\\----i\"\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"suidsgid-and-sticky-bit-special-permissions\">SUID\/SGID and Sticky Bit Special Permissions<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -type f \\( -perm -04000 -o -perm -02000 \\) -exec ls -lg {} \\;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"file-and-directories-with-no-usergroup-name\">File and Directories with no user\/group name<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ \\( -nouser -o -nogroup \\) -exec ls -lg  {} \\;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"file-types-in-current-directory\">File types in current directory<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>file * -p\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"executables-on-file-system\">Executables on file system<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -type f -exec file -p '{}' \\; |  grep ELF\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"hidden-executables-on-file-system\">Hidden Executables on file system<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -name \".*\" -exec file -p '{}' \\; | grep ELF\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"files-modified-within-the-past-day\">Files modified within the past day<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -mtime -1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"persistent-areas-of-interest\">Persistent Areas of Interest<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/rc.local\n\/etc\/initd\n\/etc\/rc*.d\n\/etc\/modules\n\/etc\/cron*\n\/var\/spool\/cron\/*\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"audit-logs\">Audit Logs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -al \/var\/log\/*\nls -al \/var\/log\/*tmp\nutmpdump \/var\/log\/btmp\nutmpdump \/var\/run\/utmp\nutmpdump \/var\/log\/wtmp\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"installed-software-packages\">Installed Software Packages<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/usr\/bin\/\nls \/usr\/local\/bin\/\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"macos-cheat-sheet\">MacOS Cheat Sheet<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>IMPORTANT NOTE: This section is still in its early stages of documentation and testing. I strongly suggest checking out Sarah Edwards, who is an industry leader in this space, as she has many excellent resources and this section for the most part is reiterating the hard work she has put in. Other excellent resources include the Mac OS X Forensics Wikis and shared spreadsheet containing Forensics Artifacts.<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/twitter.com\/iamevltwin\">Sarah Edwards<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.mac4n6.com\/\">Mac4n6<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/digital-forensics.sans.org\/media\/FOR518-Reference-Sheet.pdf\">SANS FOR518 Reference Sheet<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/forensicswiki.org\/wiki\/Mac_OS_X_10.9_-_Artifacts_Location\">Mac OS X 10.9 Forensics Wiki<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/forensicswiki.org\/wiki\/Mac_OS_X_10.11_(ElCapitan)_-_Artifacts_Location\">Mac OS X 10.11 Forensics Wiki<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.google.com\/spreadsheets\/d\/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW_GNGpX8\/edit#gid=1317205466\">Mac OS X Forensics Artifacts Spreadsheet<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"live-mac-ir--triage\">Live Mac IR \/ Triage<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"system-information-2\">System Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>date\nsw_vers\nuname \u2013a\nhostname\ncat \/System\/Library\/CoreServices\/SystemVersion.plist\ncat \/private\/var\/log\/daily.out\ncat \/Library\/preferences\/.Globalpreferences.plist\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"network-connections-1\">Network Connections<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>netstat \u2013an\nnetstat \u2013anf\nlsof -i\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"routing-table\">Routing Table<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>netstat \u2013rn\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"network-information-2\">Network Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>arp \u2013an\nndp -an\nifconfig\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"open-files\">Open Files<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>lsof\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"file-system-usage\">File System Usage<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo fs_usage\nsudo fs_usage &#91;process] \nsudo fs_usage -f network\nsudo fs_usage pid &#91;PID]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"bash-history\">Bash History<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ~\/.bash_history\nhistory\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"user-logins\">User Logins<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>who -a\nw\nlast\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"running-processes\">Running Processes<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ps aux\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"system-profiler\">System Profiler<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>system_profiler -xml -detaillevel full &gt; systemprofiler.spx\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"persistent-locations\">Persistent Locations<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"quick-overview-knockknock\"><a href=\"https:\/\/www.objective-see.com\/products\/knockknock.html\">Quick Overview (KnockKnock)<\/a><\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/KnockKnock.app\/Contents\/MacOS\/KnockKnock -whosthere &gt; \/path\/to\/some\/file.json\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"xpc-services\">XPC Services<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>ls Applications\/&lt;application&gt;.app\/Contents\/XPCServices\/\ncat Applications\/&lt;application&gt;.app\/Contents\/XPCServices\/*.xpc\/Contents\/Info.plist\nls ~\/System\/Library\/XPCServices\/\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"launch-agents--launch-daemons\">Launch Agents &amp; Launch Daemons<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/Library\/LaunchAgents\/\nls \/System\/Library\/LaunchAgents\/\nls \/System\/Library\/LaunchDaemons\/\nls \/Library\/LaunchDaemons\/\nls \/users\/*\/Library\/LaunchAgents\/\nls \/users\/*\/Library\/LaunchDaemons\/\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"loginitems\">LoginItems<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ~\/Library\/Preferences\/com.apple.loginitems.plist\nls &lt;application&gt;.app\/Contents\/Library\/LoginItems\/\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"disable-persistent-launch-daemon\">Disable Persistent Launch Daemon<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo launchctl unload -w \/Library\/LaunchDaemons\/&lt;name&gt;.plist\nsudo launchctl stop \/Library\/LaunchDaemons\/&lt;name&gt;.plist\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"web-browsing-preferences\">Web Browsing Preferences<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ~\/Library\/Preferences\/com.apple.Safari.plist \nls ~\/Library\/Application Support\/Google\/Chrome\/Default\/Preferences\nls ~\/Library\/Application Support\/Firefox\/Profiles\/********.default\/prefs.js\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"safari-internet-history\">Safari Internet History<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ~\/Library\/Safari\/Downloads.plist\ncat ~\/Library\/Safari\/History.plist \ncat ~\/Library\/Safari\/LastSession.plist\nls ~\/Library\/Caches\/com.apple.Safari\/Webpage Previews\/ \nsqlite3 ~\/Library\/Caches\/com.apple.Safari\/Cache.db  \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"chrome-internet-history\">Chrome Internet History<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls ~\/Library\/Application Support\/Google\/Chrome\/Default\/History\nls ~\/Library\/Caches\/Google\/Chrome\/Default\/Cache\/\nls ~\/Library\/Caches\/Google\/Chrome\/Default\/Media Cache\/\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"firefox-internet-history\">Firefox Internet History<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sqlite3 ~\/Library\/Application Support\/Firefox\/Profiles\/********.default\/places.sqlite \nsqlite3 ~\/Library\/Application Support\/Firefox\/Profiles\/********.default\/downloads.sqlite\nsqlite3 ~\/Library\/Application Support\/Firefox\/Profiles\/********.default\/formhistory.sqlite\nls ~\/Library\/Caches\/Firefox\/Profiles\/********.default\/Cache\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"apple-email\">Apple Email<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ~\/Library\/Mail\/V2\/MailData\/Accounts.plist\nls ~\/Library\/Mail\/V2\/\nls ~\/Library\/Mail Downloads\/\nls ~\/Downloads\ncat ~\/Library\/Mail\/V2\/MailData\/OpenAttachments.plist\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"temporary--cached\">Temporary \/ Cached<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/tmp\nls \/var\/tmp \nls \/Users\/&lt;user&gt;\/Library\/Caches\/Java\/tmp\nls \/Users\/&lt;user&gt;\/Library\/Caches\/Java\/cache\n\t\/Applications\/Utilities\/Java Preferences.app\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"system-and-audit-logs\">System and Audit Logs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/private\/var\/log\/asl\/\nls \/private\/var\/audit\/\ncat \/private\/var\/log\/appfirewall.log\nls ~\/Library\/Logs\nls \/Library\/Application Support\/&lt;app&gt; \nls \/Applications\/ \nls \/Library\/Logs\/\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"specific-log-analysis\">Specific Log Analysis<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>bzcat system.log.1.bz2 \nsystem.log.0.bz2 &gt;&gt; system_all.log \ncat system.log &gt;&gt; system_all.log\nsyslog -f &lt;file&gt;\nsyslog \u2013T utc \u2013F raw \u2013d \/asl\nsyslog -d \/asl\npraudit \u2013xn \/var\/audit\/*\nsudo log collect\nlog show\nlog stream\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"files-quarantined\">Files Quarantined<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls ~\/Library\/Preferences\/com.apple.LaunchServices.QuarantineEvents.V2\nls ~\/Library\/Preferences\/com.apple.LaunchServices.QuarantineEvents \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"user-accounts--password-shadows\">User Accounts \/ Password Shadows<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>ls \/private\/var\/db\/dslocal\/nodes\/Default\/users\/ \nls \/private\/var\/db\/shadow\/&lt;User GUID&gt;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"pluggable-authentication-modules-pam-1\">Pluggable Authentication Modules (PAM)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/pam.d\/sudo\ncat \/etc\/pam.conf\nls \/etc\/pam.d\/\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"file-fingerprintingreversing\">File Fingerprinting\/Reversing<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>file &lt;filename&gt;\nxxd &lt;filename&gt;\nnm -arch x86_64 &lt;filename&gt;\notool -L &lt;filename&gt;\nsudo vmmap &lt;pid&gt;\nsudo lsof -p &lt;pid&gt;\nxattr \u2013xl &lt;file&gt;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"connected-disks-and-partitions\">Connected Disks and Partitions<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>diskutil list\ndiskutil info &lt;disk&gt;\ndiskutil cs\nap list\ngpt \u2013r show \ngpt -r show -l\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"disk-file-image-information\">Disk File Image Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>hdiutil imageinfo *.dmg\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"user-keychain-information\">User Keychain Information<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>security list-keychains\nsecurity dump-keychains -d &lt;keychain&gt;\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"spotlight-metadata\">Spotlight Metadata<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>mdimport \u2013X | -A\nmdls &lt;file&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"has-luminous-vivid-amber-color has-text-color has-link-color wp-elements-1 wp-block-paragraph\"><strong>Thanks To Jai Minton and his <a href=\"https:\/\/www.jaiminton.com\/cheatsheet\/DFIR\/\" data-type=\"link\" data-id=\"https:\/\/www.jaiminton.com\/cheatsheet\/DFIR\/\">blog<\/a> posts<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction This post is inspired by all the hard working DFIR, and more broadly security professionals, who have put in the hard yards over the years [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8571,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[224],"tags":[179,246,184],"class_list":["post-8568","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dfir-and-incident-response","tag-dfir","tag-digital-forensics","tag-incident-response"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8568","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8568"}],"version-history":[{"count":6,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8568\/revisions"}],"predecessor-version":[{"id":9211,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8568\/revisions\/9211"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8571"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}