killchain-compendium/Forensics/Windows Network.md

Windows Network

Windows Firewall

Logfiles of the Windows Firewall can be found under C:\Windows\System32\LogFiles\firewall.

Get-Content C:\Windows\System32\LogFiles\Firewall\pfirewall.log

SRUB.dat

Use kape.exe to extract a dump of used system resources from C:\Windows\System32\sru

./kape.exe --tsource C:\Windows\System32\sru --tdest C:\Windows\Temp\sru --tflush --mdest C:\Windows\Temp\module --mflush --moduel SRUMDmp --target SRUM

Use MarkBaggett's srum-dump to take a look at the extracted files.

Network Connections

Take a look at current connections through the following line.

netstat -a -o

See the name of the portable executable that initiated the connection via the following command.

netstat -b

Take a look at the current TCP connections via the following powershell one-liner.

Get-NetTCPConnection | select localAddress,localPort,remoteAddress,remotePort,state,@{name="process";Expression={(get-process -id $_.owningProcess).ProcessName}}, @{Name="cmdLine";Expression={(Get-WmiObject win32_Process -filter "ProcessID = $($_.owningProcess)").commandline}} | sort remoteAddress
 -Descending | ft -wrap -autosize

Take a look at the current UDP connections via the following powershell one-liner.

Get-NetUDPEndpoint | select local*,creationTime,remote* | ft -autosize

There is something similar to TCPDump for catching network packets on windows. Start the packet gathering via pktmon start -c. Convert the stored file, so Wireshark is able to read it via pktmon etl2pcap.

IP Addresses

List unqiue IP addresses through the following one-liner.

(Get-NetTCPConnection).remoteAddress | Sort-Object -unique

List connections of an IP address through the following one-liner.

Get-NetTCPConnection -remoteAddress <IP-Address> | select state,creationTime,localPort,remotePort | ft -autosize

DNS Cache

Gather information about the DNS cache through the following one-liner.

Get-DNSClientCache | ? Entry -noMatch "workst|servst|kerb|ws|oscp" | out-string -width 1000

Hostnames

Take a look at the set hosts inside the hosts file.

Get-Content C:\Windows\System32\Drivers\etc\hosts

Network Services

Current RDP connections can be found through the following one-liner.

qwinsta

Current SMB shares and connections can be found through the following lines.

Get-SmbShare
Get-SmbConnection