Windows Host Forensics

Windows CLI Basics

Command	Action
dir	list files and folders
cd <dir>	change to directory
mkdir <dir>	make directory
rmdir <dir>	deliete directory
copy <source> <target>	copy source to target
move <source> <target>	move file from source to target
ren <old> <new>	rename form old to new
del <file>	delete file
echo <text>	display text to STDOUT
type <text.txt>	display contents of file
cls	clear screen
ver	Windows Version + Build
<drive>:	Change Drive
ipconfig /all	get ip address
sc query state=all	show services
tasklist /m	show services and processes
taskkill /PID <PID> /F	force kill process by id
assoc	Show file type association
cipher /w:<dir>	secure delete file or directory
fc <file> <file>	file compare
netstat -an	display currently opened ports
pathping	displays each hop in ping
tracert	displays each hop and time
powercfg	change power configuration
chkdsk /f <drive>	check and fix disk errors
drivequery /FO list /v	list of drivers and status
osk	on screen keyboard
shutdown -s -t 3600	schedule shutdown for 1 hour

Powershell common cmdlets

Command	Alias	Action
Get-Content	cat	get contents of file
Get-Service	gsv	get services
Get-Process	gps	show services and processes
Stop-Processes -Id <PID> -Force	kill	force kill by pid
Clear-Content	clc	clear contents of file
Get-Command	gc	gets all commands
Compare-Object <f1> <f2>	compare	compare f1 and f2
Copy-Item	cp	copy and item
Get-Member	gm	gets the properties and methods for objects
Invoke-WMIMethod	iwmi	calls windows management instrumentation methods
cmd /c <command		run command as windows command line
Set-Alias	sal	creates or changes an alias
Select-Object	select	selects objects or object properties
ForEach-Object	%	performs an operation against each item in a collection of input objects
Where-Object	?	selects objects from a collection based on their property values

Windows Directories to examine

#dns file
"C:\Windows\System32\drivers\etc\hosts"
#network config file
"C:\Windows\System32\drivers\etc\networks"
#usernames and passwords
"C:\Windows\System32\config\SAM"
#security log
"C:\Windows\System32\config\SECURITY"
#software log
"C:\Windows\System32\config\SOFTWARE"
#windows event logs
"C:\Windows\System32\winevt\*"
#backup of user and password
"C:\Windows\repair\SAM"
#Windows xp all users start up
"C:\Documents and Settings\All Users\Start Menu\Programs\Startup\*"
#windows xp user startup
"C:\Documents and Settings\User\Start Menu\Programs\Startup"
#windows all user startup
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
#windows user startup
"C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp"
#prefetch files
"C:\Windows\Prefetch"
#amcache.hve
"C:\Windows\AppCompat\Programs\Amcache.hve"
#NTUSER.dat
"C:\Windows\Users\*\NTUSER.dat"

Windows Process with wmic

• Get a brief output of running processes

wmic process list brief 

• Get a large amount of output from running processes

wmic process list full

• Get specific information about running processes

wmic process get name,parentprocessid,processid,commandline

• Focus in on a specific process

wmic process where processid=pid_number get commandline

Network Connections

• Overview of connections

netstat -na

• Show the owning process ID and associated exe's / DLLs

netstat -naob

• Refresh network connections every 5 seconds

netstat -naob 5

• Examine the built-in firewall settings Windows 7 -- Windows 10

netsh advfirewall show currentprofile

Windows Services

• Examine services via GUI built-in

services.msc

• Examine running services

net start

• Get details about each service

sc query | more

• Map running process to windows services

tasklist /svc

Registry ASEPs/Registry Persistance

• Check common problem areas in Windows Registry

#HKLM
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
#HKCU
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

• Additional Persistance Keys

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"

Disable RunOnce

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v DisableLocalMachineRunOnce /t REG_DWORD /d 1

Common Windows Registry Locations to Check

#os information 
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion"
#product name 
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductName
#data of install 
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate
#registered owner
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v RegisteredOwner
#system root
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v SystemRoot
#time zone
reg query "HKLM\System\CurrentControllerSet\Control\TimeZoneInformation" /v ActiveTimeBias
#mapped network drives
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Explorer\Map Network Drive MRU"
#mounted devices
reg query "HKLM\System\MountedDevices"
#usb devices
reg query "HKLM\System\CurrentControllerSet\Enum\USBStor"
#audit policies
reg query "HKLM\Security\Policy\PolAdTev"
#installed software (machine)
reg query "HKLM\Softwware"
#installed software (user)
reg query "HKCU\Software"
#recent documents
reg query "HKCU\Software\Microsoft\Windows\Currentversion\Explorer\RecentDocuments"
#recent user locations
reg query "HKCU\Software\Microsoft\Windows\Currentversion\Explorer\ComDlg32\LastVistitedMRU"
#typed urls
reg query "HKCU\Software\Microsoft\Internet Explorer\TypedURLs"
#mru list
reg query "HKCU\Software\Microsoft\Windows\Currentversion\Explorer\RunMRU"
#last accessed registry keys
reg query "HKCU\Software\Microsoft\Windows\Currentversion\Applets\RegEdit" /v LastKey

Checking for Malicious Accounts

• Windows built-in

lusrmgr.msc

• List users / view user group membership

net user 
net user <username>
net localgroup Administrators

Scheduled Tasks

• View using the GUI

schtasks

• Remember if using the CLI the at command will only show tasked where at was used to set up the task, schtasks shows all tasks.

Unusual Log Entries

• Suspicious Log entiries to look for, low hanging fruit

Event log services was stopped
Windows File Protection is not active on this system
A member was added to a security-enabled local group
##Several Failed logon attempts##

• For Win7 -- Win 10

wevtutil qe security /f:text
#Or
Get-EventLog -LogName Security | Format-List -Property *

Key Sysinternals tools

• Process Explorer Enumerate running processes

• Autoruns Display a list of Autostart Extensibility Points (ASEP)

• Process Monitor Show file system, network, registry, and process information in real time

• TCPView Maps listening and active TCP UDP activity to applications

• Procdump Capture memory for a running process for analysis

Dump Windows Memory

winpmem_mini.exe 20221218-ircase#0100.mem

Volatility

• Best to use a virtual enviroment

python3 -m venv venv
source venv/bin/activate

General Usage

./vol.py -f image_name --profile profile_name plugin_name

• Save off some enviromental variables that will help with command length and typos

export VOLATILITY_LOCATION=file:///path/image
export VOLATILITY_PROFILE=profile

Vol Plugins

• There are alot of created plugins, view plugins

python vol.py --info

Basic Image Information (Start Here)

• This provides basic information about the image, will suggest which volatility plugin to use

./vol.py imageinfo
#OR on windows cmd
ver
#Output 
Microsoft Windows [Version 10.0.20348.1249]
#now search for the build version 
python vol.py --info | grep 20348

Listing Processes

vol.py pslist

Parent and Child Processes

vol.py pstree

Network Connections

vol.py netscan

UserAssist

• UserAssist registry keys track any program run from the GUI, create for creating IR timelines

vol.py userassist

Processs Command Line

• See full command line used to start processes

vol.py cmdline

Guidelines

• Suspicious process --> pslist, pstree

• Network Listener --> netscan, check processes

• Suspicious program --> userassist , cmdline , processes

• Others --> hivelist printkey svcscan dllist

Detecting PSEXEC in logs

Get-WinEvent -FilterHashTable @{ Logname='System'; ID='7045'} | where {$_.Message.contains("PSEXEC")}

Enable Script Block Logging

New-Item -Path "HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging" -Force
Set-ItemProperty -Path "HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 -Force

DLL Search Order Hijacking

• Windows DLLs will be searched for in this order

Folder where the application is stored
C:\Windows\System32
C:\Windows\System
C:\Windows
Current Directory
Directories listed in system path #see with env/set