Hunting Baseline Notes

LOLBINS

"Living-off-the-land binaries," tools that are already accessible on a base Windows installation

Review: https://lolbas-project.github.io/

Baseline Information

1. whoami
2. whoami /all
3. hostname
4. netstat -a
5. netstat -s
6. netstat -a -b
7. Get-Process (Powershell)
8. Get-Process | Select-Object Name, ID, Path | Format-Table
9. Get-Process -IncludeUserName
10. Get-Module
11. Get-Service | Where-Object {$_.Status -eq "Running"}
12. net accounts
13. net user
14. net localgroup
15. Get-LocalGroup | Get-LocalGroupMember
16. Get-Service
17. Get-Service | Where-Object {$._Status -eq "Running"}
18. Get-Service | Where-Object {$._Status -eq "Stopped"}
19. Get-WMI-Object win32_service | select Name, DisplayName, State, PathName
20. icacles "C:\Program Files" /t
21. icacles "C:\Users\Public"
22. icacles "C:\ProgramData"
23. Get-ScheduledTask
24. Get-ComputerInfo
25. tree c:\

Compress with makecab [filename] Compressed.cab Expand with expand Compressed.cab Compressed.txt