Module 3: Windows Endpoint Introduction
Windows Processes
A process is an instance of a program running in system memory, used by both the OS and applications. Some applications use one process, others may use more.
Windows Registry
Windows maintains service and applications configurations in the Windows Registry. It is a hierarchical database that store critical information for the OS and for applications that use it. It stores settings, options, and various other information in hives, keys, and values.
Keys can contain a single value, or even more keys with their own values/keys. Values are made up of three fields: name, type, and data.
Command Prompt, VBScript, and Powershell
Command Prompt
Also known as cmd.exe, the command prompt is the most commonly-used command-line interface for the Windows operating system. Automated command-line tasks can be created via batch files.
Example Batch File
@ECHO OFF
TITLE Example Batch File
ECHO This batchfile will show Windows 10 Operating System information
systeminfo | findstr /C:"Host Name"
systeminfo | findstr /C:"OS Name"
systeminfo | findstr /C:"OS Version"
systeminfo | findstr /C:"System Type"
systeminfo | findstr /C:"Registered Owner"
PAUSEVisual Basic Script (VBScript)
These scripts require the file extension .vbs and must be run through the cscript.exe interpreter.
Getting WMIService reference in our VBScript
With the reference set, we can now use it.
Querying WMIService for all entries in Win32_OperatingSystem
For each loop to print system information
Operating System Information VBScript stored in osinfo.vbs
Running osinfo.vbs to get OS information
PowerShell
PowerShell is a scripting language that leverages the .NET Framework. The scripts are plaintext files, typically with an extension of .ps1. Powershell commands are called cmdlets.
PowerShell uses something called an execution policy which is a protective measure designed to block potentially malicious scripts from executing. Your current execution policy can be queried with Get-ExecutionPolicy inside a PowerShell prompt.
Getting Operating System information with Get-CimInstance
Getting a list of all services with Get-Service
Using Where-Object to get all running services retrieved from Get-Service
Source code for our hostinfo.ps1 script
Executing our hostinfo.ps1 script
Getting help for the Get-CimInstance cmdlet
Aliases can be queried with the Get-Alias cmdlet.
Using Get-Alias with gcim to show the original cmdlet
If built-in PowerShell functions and scripts don't fit our needs, we can build our own.
Custom Function Example Get-AVInfo
Importing and Executing the Get-AVInfo function
Programming on Windows
Component Object Model
COM is a code wrapper. Code wrappers reduce complexity of code without sacrificing utility. COM was later upgraded to the Distributed Component Object Model (DCOM). It addressed new issues between COM objects including memory and formatting issues when passing data between objects running on two different networked machines.
ActiveX later came into play, allowing execution of code that would run in the browser. ActiveX later evolved into .NET as well as .NET Core, aiming to address shortcomings of ActiveX whiel also enhancing reliability and suitability for applications.
.NET and .NET Core
The .NET Framework introducted C# and Visual Basic.NET, which provides wrappers for the Windows API as well as COM objects within the OS. .NET Core makes .NET available to other OS' in the marketplace. i.e. applications written in C# and other supportedl anguages can be compiled and executed on Linux as well as macOS without using a compatability layer.
Windows Event Log
Introduction to Windows Events
Event logs are stored in C:\Windows\System32\winevt\Logs where they're saved as .evtx files. These are restricted to privileged users and is encoded into hexadecimal values. Event Viewer can be used to parse the logs.
Windows Logs categories:
Application: events generated by Windows applications.
Security: authentication and other security-related activities.
Setup: details about upgrade installations or replacements by Windows Update
System: Native operating system behaviors that don't fit any of the other categories. ex. system restarts, mounting drives, etc.
PowerShell and Event Logs
Using Get-WinEvent to list all the different Windows Event Logs
Getting all Security events with Get-WinEvent
Getting all Logon Events with Get-WinEvent
Hash tables, in Powershell, are data structures that store pairings of keys and associated values. Using -FilterHashtableis more efficient because we're not piping all the results into another command.
Using FilterHashtable with Get-WinEvent to filter events
Filter Logon events over the course of a weekend
Rather than memorize every possible XML format for Windows events, Microsoft provides a reference for each one. The Logon Events documentation contains an example of XML data mapping.
Mapping elements in EventData for Logon events
Filtering out a Logon Event and a specific Logon Type
Empowering the Logs
System Monitor (Sysmon)
SysMon is an enhanced auditing tool from the Sysinternals suite. It can be deployed to a Windows endpoint and create its own events as a separate provider under Applications and Services Logs.
Configuration Entires in a Sysmon XML File
Process Rule Group for Event Filtering in Sysmon Configuration
Driver Rule Group for Event Filtering in Sysmon Configuration
Network Rule Groups for Event Filtering in Sysmon Configuration
Example Sysmon Config file
The above-linked Sysmon Configuration not only works as-is but includes many event filtering rules suitable for most enterprise environments.
Running Sysmon for the first time, confirming the config file in use
Sysmon and Event Viewer
Sysmon events are stored in Applications and Services Logs/Microsoft/Windows/Sysmon/Operational.
The most important detail in the event is the Channel tag. This is the Log Name to be used when querying events via Get-WinEvent.
Sysmon and PowerShell
Getting Sysmon events with Get-WinEvent
Custom function Get-SysmonEvent
Filtering out ProcessCreate Sysmon events
Updated Get-SysmonEvent with parameter support
Full Event Data for FileCreate Event
Event Data in XML format for ProcessCreate
ProcessCreate Event found with ProcessId Discovered from Another Event
Remote Access with PowerShell Core
Connecting to a Windows 10 Machine using pwsh
Importing a local module while remotely connected via pwsh
Last updated