this post was submitted on 11 Feb 2024
40 points (100.0% liked)
Technology
37719 readers
139 users here now
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Hi there! Information security guy here. This is essentially a super quick Incident Response run-through of the basic tools I use for malicious process discovery on Windows hosts. I'm assuming this is your own personal machine, or you have permission to do this.
They are all included in the rollup installer, or you can grab them individually at those links. Don't install everything, or at least don't leave it all installed when you're done. It includes a lot of tools for debugging, which you don't want to leave lying around on your system.
Fire up Autoruns, and check under Logon and Scheduled Tasks tabs for any unusual entries. If you don't know what something is, and the Publisher is listed as Microsoft, don't mess with it. Any non-MS stuff in those 2 areas should be safe to disable without hurting your system.
Process Explorer gives you a live view of the processes running on your system, basically a more advanced version of Task Manager. You can scroll through it for unusual processes, and you can even check stuff like rundll.exe processes to see the arguments used to launch it, which is SUPER useful.
Process Monitor is essentially a history/ log view of all processes on your system, starting from when the program is run. Think wireshark, but for processes. You can filter out known-good processes. You can search for strings. If the process is launching, executing, and terminating too quickly to catch in Task Manager or Process Explorer, it will still show up in Process Monitor.
TCPView is sort of like netstat, but with lots more info. You can use that to watch for unknown network connections, in case the thing you're seeing is performing some kind of network beaconing.
Lastly, I would personally check for 3rd party driver software like printer software, Razer or other HID controllers, sound card software, etc. I've seen third party hardware controller software do weird stuff like this, because most of it is so badly written. I'd almost be more surprised if it turns out to be malware, than if it turns out some HP Printer software is doing an ink check every 10 minutes or something.
This is the best answer here.