lca

System Account#

Are there weak passwords on the server (inquiries, tool brute force)?

Suspicious accounts

lusrmgr.msc

net user/wmic UserAccount get

Hidden accounts

HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users/Names/

D Shield account detection

Ports, Processes#

netstat -ano

tasklist | findstr <pid>

netstat -ano | findstr <port>

The Task Manager can view the PID corresponding to the process; selecting the corresponding process allows you to view the file location.

Process viewing: msinfo32

Services: services.msc

Huorong Sword, Process Explorer

Process Observation#

• No signature information
• No description information
• Owner of the process
• Process path

Terminate suspicious processes

taskkill /f /pid <pid>

Startup Items, Scheduled Tasks, Services#

Startup Items#

Startup Folder

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

C:\Users\CurrentUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Registry

REG query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

REG query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runonce

REG query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

REG query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

REG query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

REG query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx

msconfig

Group Policy: gpedit.msc

Scheduled Tasks#

taskschd.msc

Automatic Services#

services.msc

Suspicious Files#

Sort suspicious directories by time.

Are there new user directories?

find /var/www/ -name "*.php" |xargs egrep 'assert|phpspy|c99sh|milw0rm|eval|(gunerpress|(base64_decoolcode|spider_bc|shell_exec|passthru|($_\POST[|eval (str_rot13|.chr(|${"_P|eval($_R|file_put_contents(.*$_|base64_decode'

grep -i -r eval($_post /app/website/*

find /app/website/ -type f|xargs grep eval($_post

Temporary files: c:\windows\temp\

Recent files: %UserProfile%\Recent

View access requests to the upload directory within a specific time frame.

findstr /s /m /I “UploadFiles” *.log

Patch Information#

systeminfo

Virus Scanning#

Antivirus software

D Shield - webshell scanning

Log Analysis#

Prerequisite: Logs retained, server logs, attack logs retained by security devices.

System logs: eventvwr.msc, tool: log parser

Log location:

%SystemRoot%\System32\Winevt\Logs\

Main logs include application, security, system logs, etc. The default log size is 20484K (20M), and the excess part will overwrite expired logs.

Event ID#

See Appendix 1

Each successful login event will mark a login type, and different login types represent different login methods.

Web (middleware) logs: log analysis tools, script filtering analysis.

Tools#

Antivirus software

http://devbuilds.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe

Huorong: https://www.huorong.cn

Weibu Threat Intelligence: https://x.threatbook.cn

DBApp Security Cloud Sandbox: https://sandbox.dbappsecurity.com.cn/

D Shield - webshell scanning: http://www.d99net.net/index.asp

Sangfor webshell detection: http://edr.sangfor.com.cn/backdoor_detection.html

Hippo scanning: http://www.shellpub.com/

thor-lite: https://www.nextron-systems.com/thor-lite/

Memory shell scanning: https://github.com/c0ny1/java-memshell-scanner

Logs#

EVTX-ATTACK-SAMPLES

https://docs.google.com/spreadsheets/d/12V5T9j6Fi3JSmMpAsMwovnWqRFKzzI9l2iXS5dEsnrs/edit#gid=164587082

Log analysis tool logparser: https://www.microsoft.com/en-us/download/details.aspx?id=24659

LogParser Lizard: http://www.lizard-labs.com/log_parser_lizard.aspx

Event Log Explorer: https://www.majorgeeks.com/files/details/event_log_explorer.html

Win-Logs-Parse-tool: https://github.com/Clayeee/Win-Logs-Parse-tool

360 Star Map: Can automatically identify IIS/Apache/Nginx logs.

The following is the IIS log:

The following is the Apache log:

IOC#

References#

https://github.com/Lorna-Dane/Blue-Team/tree/8e0e2e9dde536bc3941b56f915165db764d7119e

https://github.com/Blue-number/Security/blob/9ade37050b1f8e164208191545d457d14a1e341d/1earn/Integrated/Windows/Secure-Win.md

Appendix 1 Event ID#