DOCSLIB.ORG

Security Analyst Cheatsheet

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

SECURITY ANALYST CHEATSHEET QUERY SYNTAX QUERY SYNTAX HOST/AGENT INFO PROCESS TREE Hostname AgentName Process ID PID OS AgentOS PID of the parent process ParentPID Version of Agent AgentVersion Parent Process ParentProcessName Domain name DNSRequest Time parent process started to run ParentProcessStartTime Site ID SiteId Unique ID of parent process ParentProcessUniqueKey Site name SiteName Process command line ProcessCmd Account ID AccountId Display name of process ProcessDisplayName Account Name AccountName Generated ID of the group of processes, from first parent to last ProcessGroupId FILE/REGISTRY INTEGRITY generation (SentinelOne Patent) File ID FileID Pathname of running process ProcessImagePath File Name FileFullName SHA1 signature of running process ProcessImageSha1Hash Date and time of file creation FileCreatedAt String: SYSTEM (operating system MD5 FileMD5 processes), HIGH (administrators), Date and time of file change FileModifyAt MEDIUM (non-administrators), ProcessIntegrityLevel LOW (temporary Internet files), SHA1 signature FileSHA1 UNTRUSTED SHA256 signature FileSHA256 Process Name ProcessName SHA1 of file before it was changed OldFileSHA1 ID of the terminal session of a ProcessSessionId Name of file before rename OldFileName process Identity of file signer Publisher Process start time ProcessStartTime Signature Status Signed Status String: SYS_WIN32, SYS_WSL, ProcessSubSystem Verification Status Verified status SUBSYSTEM_UNKNOWN Why not verified Why not verified Unique ID of process ProcessUniqueKey Registry Key Unique ID RegistryID PID after relinked Rpid Full path location of the RegistryPath Registry Key entry Thread ID Tid ID of all objects associated TrueContext with a detection NETWORK DATA String: GET, POST, PUT, DELETE NetworkMethod Username User URL NetworkUrl DNS response data DNSResponse SCHEDULED TASKS IP address of the destination DstIP Name of a scheduled task TaskName Full path location of a Port number of destination DstPort TaskPath scheduled task IP address of traffic source SrcIP The file who has been executed executable file Port number of traffic source SrcPort Browser type Source www.SentinelOne.com | [email protected] | +1-855-868-3733 | 605 Fairchild Dr, Mountain View, CA 94043 HUNTING QUERIES QUERY SYNTAX QUERY SYNTAX Clear Windows Event Logs Net User Add User ProcessCmd RegExp "net\s+user(?:(?!\s+/add) ProcessCmd ContainsCIS "wevtutil cl system" (?:.|\n))*\s+/add" Powershell or Wevtutil OR ProcessCmd ContainsCIS "Clear-EventLog" processCmd = "REG ADD HKLM\SYSTEM\ netsh disable firewall ProcessCmd ContainsCIS "netsh firewall" Enable SMBv1 CurrentControlSet\Services\LanmanServer\ AND ProcessCmd ContainsCIS "disable" Parameters /v SMB1 /t REG_DWORD /d 1 /f" Query logged in Users ProcessCmd ContainsCIS "quser" Unusual Schedule ProcessCmd ContainsCIS "schtasks" AND Task Created processName != "Manages scheduled tasks" Qwinsta - Display information Terminal ProcessCmd ContainsCIS "qwinsta" Powershell with Net DstIP Is Not Empty AND ProcessName Sessions connections ContainsCIS "powershell" Current Running Processes ProcessCmd ContainsCIS "tasklist" (ProcessName ContainsCIS "windows command Net User - Query a User ProcessCmd ContainsCIS "net user" Shell Process Creating File processor" OR ProcessName ContainsCIS "powershell") AND FileModifyAt > "Mar 26, 2017 00:00:39" Query Network Shares ProcessCmd ContainsCIS "net share" Query Account & (ProcessName ContainsCIS "windows command ProcessCmd ContainsCIS "net accounts" processor" OR ProcessName ContainsCIS Password Policy Shell Process Modify or File "powershell") AND (FileModifyAt > "Mar 26, Net Config - Query 2017 00:00:10" OR FileCreatedAt > "Mar 26, ProcessCmd ContainsCIS "net config 2017 00:00:31") Workstation Current Settings workstation" Registry Alteration via ProcessCmd RegExp "reg\s+add" OR ProcessCmd Query AD ProcessCmd ContainsCIS "dsquery" Command line RegExp "reg\s+del" WMIC user account list ProcessCmd ContainsCIS "wmic useraccount get" processImagePath = "C:\Windows\System32\ OR ProcessCmd RegExp "wmic useraccount list" svchost.exe" AND User != "NT AUTHORITY\ WMIC NT Domain svchost.exe running in a ProcessCmd ContainsCIS "wmic ntdomain" SYSTEM" AND User != "NT AUTHORITY\LOCAL Object Query unusual user context SERVICE" AND User != "NT AUTHORITY\NETWORK SERVICE" WMIC Group List on ProcessCmd ContainsCIS "wmic group list" Local System Powershell runnning as ProcessName ContainsCIS "powershell" AND User system user ContainsCIS "SYSTEM" WMIC List built in ProcessCmd ContainsCIS "wmic System Accounts sysaccount list" Powershell Scheduled ParentProcessName = "Windows PowerShell" AND ProcessName = "Task Scheduler Configuration Tasks Created Reg Query - last 10 files ProcessCmd ContainsCIS "RecentDocs" AND Tool" accessed or executed ProcessCmd ContainsCIS "REG QUERY" AND by explorer ProcessCmd ContainsCIS "explorer" Executable Created FileCreatedAt > "Apr 2, 2017 00:00:03" AND ProcessName ContainsCIS ".exe" Reg Query - RunOnce ProcessCmd ContainsCIS "Runonce" AND ProcessName ContainsCIS "Host Process for ProcessCmd ContainsCIS "REG QUERY" Suspicious Parent Windows Services" AND ParentProcessName != "Host Process for Windows Services" AND Reg Query - Check Patterns ProcessCmd ContainsCIS "Reg Query" Process svchost.exe AND ProcessCmd ContainsCIS "Disk" AND ParentProcessName != "Services and Controller for Virtual Machines app" ProcessCmd ContainsCIS "Enum" Query Group Policy ParentProcessName = "Insert Vulnerable ProcessCmd ContainsCIS "gpresult" RSOP Data Vulnerable App Application name from Applications Tab" AND (ProcessName ContainsCIS "Windows Command System Info - windows ProcessCmd ContainsCIS "systeminfo" launching shell Processor" OR ProcessName ContainsCIS "Powershell") ProcessCmd ContainsCIS "systeminfo" OR ProcessCmd RegExp "ver >" OR ProcessCmd Excel Running Shell ParentProcessName ContainsCIS "excel" AND System Info and RegExp "type\s+%APPDATA%" OR ProcessCmd (ProcessName ContainsCIS "sh" OR ProcessName or Python Network data gathering RegExp "ipconfig" OR ProcessCmd RegExp "net\ ContainsCIS "python") s+view" OR ProcessCmd RegExp "arp -a" OR Whoami ProcessCmd ContainsCIS "whoami" ProcessCmd RegExp "netstat" WMIC Process Get - Process Powershell Get processCmd RegExp "powershell\.exe\s+echo\ ProcessCmd RegExp "wmic\s+process\s+get" Clipboard Entry s+Get\-Process\s+\|\s+clip" data and sub commands WMIC qfe - Gather Powershell Get processCmd ContainsCIS "powershell.exe echo ProcessCmd ContainsCIS "wmic qfe" Running Processes Get-Process" Windows Patch Data Powershell Search processCmd ContainsCIS "powershell Get- ProcessName ContainsCIS "powershell" for Doc Files ChildItem -Recurse -Include *.doc" AND (ProcessCmd ContainsCIS "Invoke- Powershell suspicious Expression" OR ProcessCmd ContainsCIS Find string processCmd ContainsCIS "findstr" "-encodedcommand" OR ProcessCmd ContainsCIS commands "hidden" OR ProcessCmd ContainsCIS "write- Windows 10 Get ProcessCmd ContainsCIS "wmic nic" host" OR ProcessCmd ContainsCIS "Get- Network Adaptor Details NetIPConfiguration") Execute File in processCmd ContainsCIS "/FILE" AND ProcessCmd echo command ProcessCmd ContainsCIS "echo" Appdata folder ContainsCIS "Appdata" regsvr32 and scrobj.dll ProcessCmd ContainsCIS "regsvr32" AND Nslookup ProcessCmd ContainsCIS "nslookup" register-unregister dll ProcessCmd ContainsCIS "scrobj.dll" Net User Delete User ProcessCmd RegExp "net\s+user(?:(?!\s+/ regsvr32 suspicious processName = "Microsoft(C) Register Server" delete)(?:.|\n))*\s+/delete" downloads AND DstIP Is Not Empty Net User Domain ProcessCmd RegExp "net\s+user(?:(?!\s+/ regsvr32 suspicious processName = "Microsoft(C) Register Server" domain)(?:.|\n))*\s+/domain" file modification AND FileModifyAt > "Mar 1, 2019 00:00:45" Add user to AD ProcessCmd ContainsCIS "dsadd user" ProcessCmd ContainsCIS "regsvr32" AND (RegistryPath ContainsCIS "machine\software\ Powershell add local user ProcessCmd ContainsCIS "powershell.exe regsvr32 Persistence New-LocalUser" classes" OR ProcessCmd ContainsCIS "schtasks\ s+/create") Powershell upload or ProcessCmd ContainsCIS "(New-Object Net. download methods Webclient)" ProcessCmd ContainsCIS "bitsadmin" AND Bitsadmin suspicious (ProcessCmd ContainsCIS "transfer" OR ProcessCmd ContainsCIS "download" OR Suspicious - List all ProcessCmd ContainsCIS "setspn" AND commands ProcessCmd RegExp "-t" AND ProcessCmd RegExp ProcessCmd ContainsCIS ".ps1" OR ProcessCmd SPNs in a Domain "-q */*" ContainsCIS "powershell") ProcessCmd ContainsCIS "reg add" AND list vssadmin shadows ProcessCmd ContainsCIS "vssadmin.exe list shadows" Registry Persistence (ProcessCmd ContainsCIS "Run" OR ProcessCmd ContainsCIS "Null") Add user or Query local ProcessCmd ContainsCIS "net localgroup admin group administrators" Copy commands ProcessCmd ContainsCIS "copy" OR ProcessCmd ContainsCIS "xcopy" Change firewall ProcessCmd ContainsCIS "netsh advfirewall" profile settings www.SentinelOne.com | [email protected] +1-855-868-3733 | 605 Fairchild Dr, Mountain View, CA 94043.
Recommended publications
  • Transaction Insight Reference Manual Contents  I Admin - Filters - Partner Filter

    Transaction Insight Reference Manual Contents  I Admin - Filters - Partner Filter

    TIBCO Foresight® Transaction Insight® Reference Manual Software Release 5.2 September 2017 Two-second advantage® Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE. USE OF TIBCO SOFTWARE AND THIS DOCUMENT IS SUBJECT TO THE TERMS AND CONDITIONS OF A LICENSE AGREEMENT FOUND IN EITHER A SEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING DOWNLOAD OR INSTALLATION OF THE SOFTWARE (AND WHICH IS DUPLICATED IN LICENSE.PDF) OR IF THERE IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S) LOCATED IN THE “LICENSE” FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY THE SAME. This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this document may be reproduced in any form without the written authorization of TIBCO Software Inc. TIBCO and Two-Second Advantage, TIBCO Foresight EDISIM, TIBCO Foresight Instream, TIBCO Foresight Studio, and TIBCO Foresight Transaction Insight are either registered trademarks or trademarks of TIBCO Software Inc. in the United States and/or other countries.
  • View the Slides (Smith)

    View the Slides (Smith)

    Network Shells Michael Smith Image: https://commons.wikimedia.org/wiki/File:Network-connections.png What does a Shell give us? ● A REPL ● Repeatability ● Direct access to system operations ● User-focused design ● Hierarchical context & sense of place Image: https://upload.wikimedia.org/wikipedia/commons/8/84/Bash_demo.png What does a Shell give us? ● A REPL ● Repeatability ● Direct access to system operations ● User-focused design ● Hierarchical context & sense of place Image: https://upload.wikimedia.org/wikipedia/commons/8/84/Bash_demo.png Management at a distance (netsh) Netsh: Configure DHCP servers with netsh -r RemoteMachine -u domain\username [RemoteMachine] netsh>interface [RemoteMachine] netsh interface>ipv6 [RemoteMachine] netsh interface ipv6>show interfaces Reference: https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts Management at a distance (netsh) Netsh: Configure DHCP servers with netsh Location-r RemoteMachine -u domain\username Hierarchical [RemoteMachine] netsh>interfacecontext Simpler [RemoteMachine] netsh interface>ipv6 commands [RemoteMachine] netsh interface ipv6>show interfaces Reference: https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts Management at a distance (WSMan) WSMan (in Powershell): Manage Windows remotely with Set-Location -Path WSMan:\SERVER01 Get-ChildItem -Path . Set-Item Client\TrustedHosts *.domain2.com -Concatenate Reference: https://docs.microsoft.com/en-us/powershell/module/microsoft.wsman.management/about/about_wsman_provider
  • Netsh Commands William John Holden 2014­04­11 (Version 2) Interface Configuration Configure an Ipv4 Address with Subnet Mask and Default Gateway

    Netsh Commands William John Holden 2014­04­11 (Version 2) Interface Configuration Configure an Ipv4 Address with Subnet Mask and Default Gateway

    Netsh Commands William John Holden 2014­04­11 (version 2) Interface Configuration Configure an IPv4 address with subnet mask and default gateway. Omitted netmask implies classful addressing. netsh int ipv4 set address "Local Area Connection" static 192.168.1.3 255.255.255.0 192.168.1.1 Remove an IPv4 address and default gateway from an interface. netsh int ipv4 del address "Local Area Connection" 192.168.1.3 192.168.1.1 You can add more than one IP address to an interface. Additional addresses don't show up in ipconfig without /all. netsh int ipv4 add address "Local Area Connection" 192.168.1.4 Add a global unicast IP with prefix. Prefix is optional and defaults to /64. netsh int ipv6 set address "Local Area Connection" 2001:beef::1/64 Add a link­local IP to an interface. See the similarity to above? netsh int ipv6 add address "Local Area Connection" fe80::6 Delete the IP. Remove a link­local IP the same way. netsh int ipv6 del address "Local Area Connection" 2001:beef::1 Set an IPv6 default route. netsh int ipv6 add route ::/0 "Local Area Connection" fe80::3 Delete the default route. netsh int ipv6 delete route ::/0 "Local Area Connection" fe80::3 Reset Configuration Reset interface configuration completely (requires restart): netsh int ipv6 reset all netsh int ipv4 reset all shutdown ­r ­t 0 Verification (“show commands”) netsh has several commands that are very similar to ipconfig, route print (netstat ­r), netstat ­a, and getmac. Poke around netsh int ipv4 show ? and you’ll find lots of interesting stuff.
  • How to Cheat at Windows System Administration Using Command Line Scripts

    How to Cheat at Windows System Administration Using Command Line Scripts

    www.dbebooks.com - Free Books & magazines 405_Script_FM.qxd 9/5/06 11:37 AM Page i How to Cheat at Windows System Administration Using Command Line Scripts Pawan K. Bhardwaj 405_Script_FM.qxd 9/5/06 11:37 AM Page ii Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or produc- tion (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®,“Career Advancement Through Skill Enhancement®,”“Ask the Author UPDATE®,” and “Hack Proofing®,” are registered trademarks of Syngress Publishing, Inc.“Syngress:The Definition of a Serious Security Library”™,“Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies.
  • Invalid Class String Error

    Invalid Class String Error

    Tib4231 July, 2001 TECHNICAL INFORMATION BULLETIN Invalid Class String Error KODAK DC215, KODAK DC240, KODAK DC280, DC3400, and DC5000 Zoom Digital Cameras An Invalid Class String error may occur when you try to launch the camera software for the first time, or the Mounter or Camera Properties software may not operate properly.This error is caused when the program RegSvr32.exe is not located in the C:\Windows\System folder, preventing the DLL files from being registered. Use this document to help you properly locate the RegSvr32.exe program in your system, and if necessary, manually register the DLL files. The instructions in this document assume that you are familiar with copying and moving files in your computer, and installing software. Relocating RegSvr32.exe 1. Go to Start > Find > Files and Folders and search for regsvr32*.* Note the location of the program. 2. In WINDOWS Explorer or My Computer, copy RegSvr32.exe to the C:\Windows\System folder if it is not already there. When the file is in place, go on to Step 3. 3. Uninstall the KODAK software using the KODAK Uninstall application, or go to Start > Settings > Control Panel > Add / Remove Programs. 4. Close all background programs except Explorer and Systray by pressing Ctrl Alt Del, selecting each program one at a time, and clicking End Task after each. 5. Install the KODAK camera software. 6. Start the KODAK Camera Mounter and Camera Properties software for your camera. If the Invalid Class String error appears, manually register the DLL file using the procedure that follows for your camera.
  • How Will You Troubleshoot the Issue? What Are the Steps to Followed? A

    How Will You Troubleshoot the Issue? What Are the Steps to Followed? A

    1. A user in a corporate network contacts service desk saying he/she has lost network connectivity: How will you troubleshoot the issue? What are the steps to followed? A. First I will check the network cable is plugged in or not. Then check the network connections and the ip address is assigned or not. Then check connecting to website or not. IP conflict. 2. A User calls in and complains that her computer and network is running very slow. How would go about troubleshooting it? A. 3. How would you create an email account for a user already in AD? A. Open Microsoft Outlook if you are using office 2000, and click on "Tools" tab. Go to "Email Accounts". There you can find two option like Email and Directory. Click on "Add a new Account" and click next. If you are using Exchange Server then click over there, this depends on that particular Organization. According to the their setup you have to choose. And if you are using POP3 server then next popup will come along with your name, email address POP3 and SMTP IP address, Password etc. and after that click on Next and finish it..... 4. A PC did not receive an update from SMS. What steps would we take to resolve this? A. If SMS not updated in client system. 1. Need to check system getting IPaddress or not. 2. Need to check system in domain or not 3.Ensure that windows firewall should be off. 5. How do you set the IP address by using the command prompt A.
  • Threat Advisory: Eternalrocks

    Threat Advisory: Eternalrocks

    McAfee Labs Threat Advisory EternalRocks June 6, 2017 McAfee Labs periodically publishes Threat Advisories to provide customers with a detailed analysis of prevalent A malware. This Threat Advisory contains behavioral information, characteristics, and symptoms that may be used to n mitigate or discover this threat, and suggestions for mitigation in addition to the coverage provided by the DATs. d To receive a notification when a Threat Advisory is published by McAfee Labs, select to receive “Malware and Threat Reports” at the following URL: https://www.mcafee.com/enterprise/en-us/sns/preferences/sns-form.html. Summary EternalRocks is a network worm which uses the SMB exploits ETERNAL BLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY along with related programs DOUBLEPULSAR, ARCHITOUCH, and SMBTOUCH to spread. McAfee products detect this threat under the following detection names: • Trojan-EtrnlRock • Trojan.EternalRocks • Trojan-Bluedoom • HackTool-Shadowbrokers • RDN/Generic.grp • RDN/Generic.dx • RDN/Trojan-EtrnlRock • RDN/Generic Downloader.x Detailed information about the threat, its propagation, characteristics, and mitigation are in the following sections: • Infection and Propagation Vectors • Mitigation • Characteristics and Symptoms • Restart Mechanism • Remediation • McAfee Foundstone Services Infection and Propagation Vectors Even though this has not been confirmed, the malware’s initial vector is expected to be spam email. The malware spreads by exploiting shares and uses the EternalBlue (MS17-010 Echo Response - SMB vulnerability) vulnerability. The authors have used publicly available exploit code and embedded it as a part of their dropper. On execution, the malware connects to the IPC$ tree and attempts a transaction on FID 0, triggers the vulnerability, and then exploits it.
  • Command-Line IP Utilities This Document Lists Windows Command-Line Utilities That You Can Use to Obtain TCP/IP Configuration Information and Test IP Connectivity

    Command-Line IP Utilities This Document Lists Windows Command-Line Utilities That You Can Use to Obtain TCP/IP Configuration Information and Test IP Connectivity

    Guide to TCP/IP: IPv6 and IPv4, 5th Edition, ISBN 978-13059-4695-8 Command-Line IP Utilities This document lists Windows command-line utilities that you can use to obtain TCP/IP configuration information and test IP connectivity. Command parameters and uses are listed for the following utilities in Tables 1 through 9: ■ Arp ■ Ipconfig ■ Netsh ■ Netstat ■ Pathping ■ Ping ■ Route ■ Tracert ARP The Arp utility reads and manipulates local ARP tables (data link address-to-IP address tables). Syntax arp -s inet_addr eth_addr [if_addr] arp -d inet_addr [if_addr] arp -a [inet_address] [-N if_addr] [-v] Table 1 ARP command parameters and uses Parameter Description -a or -g Displays current entries in the ARP cache. If inet_addr is specified, the IP and data link address of the specified computer appear. If more than one network interface uses ARP, entries for each ARP table appear. inet_addr Specifies an Internet address. -N if_addr Displays the ARP entries for the network interface specified by if_addr. -v Displays the ARP entries in verbose mode. -d Deletes the host specified by inet_addr. -s Adds the host and associates the Internet address inet_addr with the data link address eth_addr. The physical address is given as six hexadecimal bytes separated by hyphens. The entry is permanent. eth_addr Specifies physical address. if_addr If present, this specifies the Internet address of the interface whose address translation table should be modified. If not present, the first applicable interface will be used. Pyles, Carrell, and Tittel 1 Guide to TCP/IP: IPv6 and IPv4, 5th Edition, ISBN 978-13059-4695-8 IPCONFIG The Ipconfig utility displays and modifies IP address configuration information.
  • Copyrighted Material

    Copyrighted Material

    Index Numerics Address Resolution Protocol (ARP), 1052–1053 admin password, SOHO network, 16-bit Windows applications, 771–776, 985, 1011–1012 900, 902 Administrative Tools window, 1081–1083, 32-bit (x86) architecture, 124, 562, 769 1175–1176 64-bit (x64) architecture, 124, 562, 770–771 administrative tools, Windows, 610 administrator account, 1169–1170 A Administrators group, 1171 ADSL (Asynchronous Digital Subscriber Absolute Software LoJack feature, 206 Line), 1120 AC (alternating current), 40 Advanced Attributes window, NTFS AC adapters, 311–312, 461, 468–469 partitions, 692 Accelerated Graphics Port (AGP), 58 Advanced Computing Environment (ACE) accelerated video cards (graphics initiative, 724 accelerator cards), 388 Advanced Confi guration and Power access points, wireless, 996, 1121 Interface (ACPI) standard, 465 access time, hard drive, 226 Advanced Graphics Port (AGP) card, access tokens, 1146–1147 391–392 Account Operators group, 1172 Advanced Graphics Port (AGP) port, 105 ACE (Advanced Computing Environment) Advanced Host Controller Interface (AHCI), initiative, 724 212–213 ACPI (Advanced Confi guration and Power Advanced Micro Devices (AMD), 141–144 Interface) standard, 465 Advanced Packaging Tool (APT), 572 Action Center, 1191–1192 Advanced Power Management (APM) Active Directory Database, 1145–1146, 1183 standard, 465 active heat sink, 150 Advanced Programmable Interrupt active matrix display, LCD (thin-fi lm Controller (APIC), 374 transistor (TFT) display), 470 Advanced RISC Computing Specifi cation active partition, 267,
  • 10 Windows Server 2008 Netsh Commands You Should Know Page 1 of 7

    10 Windows Server 2008 Netsh Commands You Should Know Page 1 of 7

    10 Windows Server 2008 Netsh commands you should know Page 1 of 7 Are you monitoring your network 24/7? Automated server and network monitoring. Monitors all aspects of your Windows and Linux servers, workstations and devices. Download a free 30-day trial! - www.gfi.com/nsm/ 10 Windows Server 2008 Netsh commands you should know Taking a look at ten Netsh commands that every Windows administrator should know. z Published: Aug 26, 2008 z Updated: Aug 26, 2008 z Section: Articles & Tutorials :: Windows Server 2008 z Author: David Davis z Rating: 4.1/5 - 8 Votes Introduction I have written a number of different Netsh articles and other authors have published their own Netsh articles. This just shows how important and innovative Netsh really is. In this article, I will cover 10 Netsh commands that every Windows admin should know. In my opinion. Netsh is so powerful and flexible; I cannot choose the “most important” Netsh commands as the importance of a command will vary from admin to admin. What I can do is to choose the 10 commands that I feel will either show you valuable information or will help you out when you are in trouble. Keep in mind that these commands can be scripted (as they are all command line tools) so whatever you can do with just an individual command on a single machine, you could write a script to perform that command on all machines in your network. What is Netsh? Microsoft Windows Netsh is a command line scripting utility. With Netsh, you can view or change the network configuration of your local computer or a remote computer.
  • INFORMATION TECHNOLOGY CONCEPTS-OPEN - REGIONAL 2019 Page 1 of 8

    INFORMATION TECHNOLOGY CONCEPTS-OPEN - REGIONAL 2019 Page 1 of 8

    INFORMATION TECHNOLOGY CONCEPTS-OPEN - REGIONAL 2019 Page 1 of 8 INFORMATION TECHNOLOGY CONCEPTS (391) —OPEN EVENT— REGIONAL – 2019 DO NOT WRITE ON TEST BOOKLET TOTAL POINTS _________ (100 points) Failure to adhere to any of the following rules will result in disqualification: 1. Contestant must hand in this test booklet and all printouts. Failure to do so will result in disqualification. 2. No equipment, supplies, or materials other than those specified for this event are allowed in the testing area. No previous BPA tests and/or sample tests or facsimile (handwritten, photocopied, or keyed) are allowed in the testing area. 3. Electronic devices will be monitored according to ACT standards. No more than sixty (60) minutes testing time Property of Business Professionals of America. May be reproduced only for use in the Business Professionals of America Workplace Skills Assessment Program competition. INFORMATION TECHNOLOGY CONCEPTS-OPEN - REGIONAL 2019 Page 2 of 8 MULTIPLE CHOICE Identify the choice that best completes the statement or answers the question. Mark A if the statement is true. Mark B if the statement is false. 1. Which of the following appears on the right side of any Windows 8 screen when you move your pointer to a right corner? A. Live tile B. Memory Manager C. Charms bar D. System tray 2. Which element of the Windows 7 GUI gives windows a glassy appearance, but also consumes more hardware resources? A. Control panel B. Aero user interface C. Charms interface D. Logic interface 3. The top of a top-down hierarchical structure of subdirectories is called which of the following? A.
  • How to Evade Application Whitelisting Using REGSVR32

    How to Evade Application Whitelisting Using REGSVR32

    EXTERNAL/INTERNAL, RED TEAM, RED TEAM TOOLS CASEY SMITH, COM+ SCRIPLETS, DLL, FOLLOW US 10 SUBTEE, WEVADE, WHITELISTING MAY 2017 How to Evade Application Whitelisting Using REGSVR32 Jo Thyer // I was recently working on a Red Team for a customer that was very much up to date with their defenses. This customer had tight egress controls, perimeter proxying, strong instrumentation, and very tight application whitelisting controls. My teammate and I knew that we would have to work very hard to get command and control outbound from this environment, and that would be after obtaining physical access (yet another signicant challenge). Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD The week before going on-site, we began to LOOKING FOR research all of the various methods for SOMETHING? potential application whitelisting bypass. We assumed the best case defensive scenario whereby the customer would have all binary execution blocked with the exception of specic applications permitted. In prior tests SUBSCRIBE TO THE with other customers and this same BHISBLOG customer, we had used “rundll32.exe” to execute DLL content. This method is really useful if you can host shellcode Don't get left in the dark! Enter within a DLL, and have a nice controlled entry point. In the Metasploit case, the your email address and every DLL entry point is named “Control_RunDLL”. While this might evade time a post goes live you'll get instant notication! We'll also whitelisting, we also knew this old trick had been played before and we likely add you to our webcast list, so could not count on it again.