Manual Hunting Notes Windows

Windows

Processes

Get-Process -IncludeUserName | Select-Object Name, Path

• Requires Admin

Get-CimInstance Win32_Process -Filter "Name='powershell.exe'" | Select-Object ProcessId, CommandLine | Format-Table -wrap

• Remove with Stop-Process -ID [ID] -Force

del [originating powershell script]

Services

Get-Service

Remove a service with sc delete [ServiceName]

Task and service hunting - search for "Custom"

Tasks

Tasks - with no task path

Task Details - Get-ScheduledTask -TaskName "SystemMaintenanceTask" | Select-Object *

• (command).Actions
• (command).Triggers
• (command).Principal
• 2-3am might be a suspicious time

Legitimate Tasks are in \Microsoft\Windows\

Check when a task is created - Get-ScheduledTask -TaskName "TaskName" | Select-Object Date, Author, TaskName

Open Ports

netstat -ano

• 4444 - default port for a common pentesting/hacking tool
• 8888 - Commonly used by web proxies and malware
• 31337 - leetspeak for ELEET, known hacker port

netstat -ano | findstr "4444" - Note the process ID, then Get-Process -Id [PID]

Stop-Process -Id [PID]