Incident Response: Windows Cheatsheet

4 years ago 293

BOOK THIS SPACE FOR AD

ARTICLE AD

For some people who use their computer systems, their systems might seem normal to them, but they might never realise that there could be something really phishy or even that fact that their systems could have been compromised. Making use of Incident Response a large number of attacks at the primary level could be detected. The investigation can be carried out to obtain any digital evidence.

This article mainly focuses on Incident response for Windows systems. So, let’s begin with this cheat sheet to get you going.

What is Incident Response User Accounts Processes Services Task Scheduler Startup Registry Entries Active TCP & UDP ports File Shares Files Firewall Settings Sessions with other Systems Open Sessions Log Entries

What is Incident Response?

Incident response can be defined as a course of action that is taken whenever a computer or network security incident occurs.

The security events that could have occurred:

Unauthorized use of system privileges and sensitive data Any cause of System crashes or flooding of packets Presence of malware or any malicious program

User Accounts

In Incident response it is very necessary to investigate the user activity. It is used to find if there is any suspicious user account is present or any restricted permissions have been assigned to a user. By checking the user account one can be able to get answers to the questions like which user is currently logged in and what kind of a user account one has.

The ways one can view the user accounts are:

To view the local user accounts in GUI, press ‘Windows+R’, then type

Now click on ‘okay’, and here you will be able to see the user accounts and their descriptions.

To now see the user accounts for the system and the type of account it is. Run command prompt as administrator and type command

Net localgroup group name is used in order to manage local user groups on a system. By using this command, an administrator can add local or domain users to a group, delete users from a group, create new groups and delete existing groups.

Open Command prompt and run as an administrator then type

net localgroup administrators

To see the local user accounts, with their names, if they are enabled and their description. Run PowerShell as an administrator, type

Processes

In order to get the list of all the processes running on the system, you can use ‘tasklist’ command for this purpose. By making use of this command you can get a +-a list of the processes the memory space used, running time, image file name, services running in the process etc

To view the processes, you can use the following methods; To view the running processes in a GUI, press ‘Windows+R’, then type

Now click on ‘OK’ and you will be able to see all the running processes in your system and will be able to check if there is any unnecessary process running.

To see all the running processes with their Process ID (PID) and their session name and the amount of memory used. Run command prompt as an administrator and type

To gets a list of all active processes running on the local computer run PowerShell as an administrator and type

Windows system have an extremely powerful tool with the Windows Management Instrumentation Command (WMIC). Wmic is very useful when it comes to incident response. This tool is enough to notice some abnormal signs in the system. This command can be used in the Command-prompt as well as PowerShell when running as an administrator. The syntax is wmic process list full

After you determine which process is performing a strange network activity. To get more details about the parent process IDs, Name of the process and the process ID, open PowerShell as an administrator and type

wmic process get name,parentprocessid,processid

To get the path of the Wmic process, open PowerShell and type

wmic process where 'ProcessID=PID’ get CommandLine

Services

To identify if there is any abnormal service running in your system or some service is not functioning properly, you can view your services.

To view all the services in GUI, press ‘Windows+R’ and type

Now click on ‘Ok’ to see the list of processes.

To start and view the list of services that are currently running in your system, open command prompt as an administrator, type

To view whether a service is running and to get its more details like its service name, display name, etc.

If you want a list of running processes with their associated services in the command prompt, run command prompt as an administrator, then type

Task Scheduler

Task Scheduler is a component in the Windows which provides the ability to schedule the launch of programs or any scripts at a pre-defined time or after specified time intervals. You can view these scheduled tasks which are of high privileges and look suspicious.

To view the task Scheduler in GUI, then go the path and press enter. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools

To view the schedule tasks in the command prompt, run command prompt as an administrator, type

Startup

The startup folder in Windows automatically runs applications when you log on. So, an incident handler, you should observe the applications that auto-start.

To view the applications in the Startup menu in the GUI, open the task manager and click on the ‘Startup’ menu. By doing this, you can see which applications are enabled and disabled on startup. On opening the following path, it will give you the same option

To view, the startup applications in the PowerShell run the PowerShell as an administrator, type

wmic startup get caption,command

To get a detailed list of the AutoStart applications in PowerShell, you can run it as an administrator and type

Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List

Registry Entries

Sometimes if there is a presence of unsophisticated malware it can be found by taking a look at the Windows Registry’s run key. To view the GUI of the registry key, you can open REGEDIT reach the run key manually.

You can also view the registry of the Local Machine of the Run key in the PowerShell, by running it as an administrator and then type

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

You can also view the registry of the Current User of the Run key in the PowerShell, by running it as an administrator and then type

reg query HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Active TCP & UDP ports

As an Incident Responder, you should carefully pay attention to the active TCP and UDP ports of your system.

The network statistics of a system can be using a tool. The criteria tested are incoming and outgoing connections, routing tables, port listening, and usage statistics. Open the command prompt, type

Well, this can also be checked in the PowerShell with a different command to see the IP and the local ports. Run PowerShell and type

Get-NetTCPConnection -LocalAddress 192.168.0.110 | Sort-Object LocalPort

File sharing

As an incident responder, you should make sure that every file share is accountable and reasonable and there is no unnecessary file sharing.

In order to check up on the file-sharing options in the command prompt, type

To see the file-sharing in PowerShell, you can type

Files

To view the files which could be malicious or end with a particular extension, you can use ‘forfiles’ command. Forfiles is a command-line utility software. It was shipped with Microsoft Windows Vista. During that time, management of multiples files through the command line was difficult as most of the commands at that time we made to work on single files

To view the .exe files with their path to locate them in the command prompt, type

forfiles /D -10 /S /M *.exe /C "cmd /c echo @path"