Netsh Drivers Or Files

Get-WinEvent -FilterHashtable LogNameSecurity; Id3033; FL TimeCreated,Message.

All thoughts and opinions expressed here are my own, and may not be representative of my employer, or any other entity unless I am specifically quoting someone.

All references to original posts or material will aim to be documented in the Special Thanks section.

If you need to undertake Digital Forensics for legal proceedings, seek specialist advice as this requires more rigor around Identification, Preservation, Collection, Examination, Analysis, and Presentation of findings.

Netsh Drivers Or Files

Theres limitations if the tool requires other drivers or files to execute (such as RamCapture).

Invoke-CimMethod -InputObject ss -MethodName GetDiagnosticInfo -Arguments DestinationPathLOCATIONdmp; IncludeLiveDumptrue.

Get-CimInstance Win32StartupCommand Select-Object Name, command, Location, User FL.

Processes gps.Path -match Malware -or.Name -match Malware FL Name,Path,Id.

Tasks schtasks query fo csv v ConvertFrom-Csv.Task To Run -match Malware FL Taskname,Task To Run,Run As User.

Services gwmi win32service.PathName -match Malware FL Name,PathName.

ServiceDLL reg query HKLMSYSTEMCurrentControlSetServices s v ServiceDLL findstr Malware.

RunKey1 Get-ItemProperty -Path HKLM:SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun -match Malware.

RunKey2 Get-ItemProperty -Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun -match Malware.

UserProfiles (gwmi Win32UserProfile.SID -notmatch S-1-5-(181920).

RunKey3 Get-ItemProperty -Path Registry::HKUSOFTWAREMicrosoftWindowsCurrentVersionRun -match Malware.

Startup Select-String -Path C:UsersAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup -Pattern Malware Select Path.

Startup2 Select-String -Path C:ProgramDataMicrosoftWindowsStart MenuProgramsStartUp -Pattern Malware Select Path.

Get-WinEvent -FilterHashtable LogNameSystem; Id11 FL TimeCreated,Message.

Get-WinEvent -FilterHashtable LogNameMicrosoft-Windows-Bits-ClientOperational; Id59 FL TimeCreated,Message.

The system must be booted through Advanced Startup Options with a Command Prompt, or through a recovery cd.

Get-ChildItem -path C:UsersAppDataLocalGoogleChromeUser DataDefaultExtensions -recurse -erroraction SilentlyContinue -include manifest.json cat.

Get-ChildItem -path C:Program FilesMozilla Firefoxplugins -recurse -erroraction SilentlyContinue.

Using the Windows CheckDisk utility, System File Checker, or Deployment Image Servicing and Management may assist but isnt guaranteed.

If you have a detection based on DLLHost.exe with Processid:xyz, you can match xyz with the CLSID (COM Class Object) or AppID mentioned below to check for any malicious EXE or DLL.

Download Netsh 32 Bit