{"id":1945,"date":"2020-12-17T17:43:17","date_gmt":"2020-12-17T16:43:17","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1945"},"modified":"2024-09-29T10:24:16","modified_gmt":"2024-09-29T08:24:16","slug":"useful-background-processes","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1945","title":{"rendered":"Background monitoring"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">This site con\u00adtains links to tools \/ tech\u00adniques which can run in the back\u00adground dur\u00ading an engagement.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Linux<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/DominicBreuker\/pspy\">Pspy<\/a> \u2014 Shows the activ\u00adi\u00adty on a system.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Windows<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=1946\">Respon\u00adder<\/a> \u2014 Waits for oth\u00ader Win\u00addows sys\u00adtems to con\u00adnect to third-par\u00adty sys\u00adtems and says \u201c<span class=\"caps\">YES<\/span>, I am this sys\u00adtem!\u201d. Win\u00addows sys\u00adtems then reveal cre\u00adden\u00adtials of the user who start\u00aded the query. Sup\u00adports <span class=\"caps\">SMB<\/span>, <span class=\"caps\">HTTP<\/span>, <span class=\"caps\">DNS<\/span>, <span class=\"caps\">LLMNR<\/span>, <span class=\"caps\">FTP<\/span>, <span class=\"caps\">IMAP<\/span>, <span class=\"caps\">POP3<\/span>, <span class=\"caps\">SMTP<\/span>, <span class=\"caps\">LDAP<\/span>, <span class=\"caps\">RDP<\/span>, <span class=\"caps\">WPAD<\/span>, Kerberos,&nbsp;\u2026<\/li>\n\n\n\n<li>When a user is avail\u00adable and a <span class=\"caps\">RDP<\/span> con\u00adnec\u00adtion, sys\u00admon\u00adtools can be used to analyse the behav\u00adiour of the system.&nbsp;<ul class=\"wp-block-list\">\n<li>Down\u00adload Sys\u00admon from microsoft<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/SwiftOnSecurity\/sysmon-config\">Down\u00adload Sys\u00admon config<\/a><\/li>\n\n\n\n<li>Adapt the con\u00adfig evtl. (e.g. for Domain\u00adCon\u00adtrollers, there are some com\u00adments that things could be activated)<\/li>\n\n\n\n<li>Upload both files to the victim<\/li>\n\n\n\n<li>On the vic\u00adtim in a ter\u00admi\u00adna, start sys\u00admon&nbsp;with&nbsp;<ol class=\"wp-block-list\">\n<li>Sysmon64.exe \u2011i<\/li>\n<\/ol>\n<\/li>\n\n\n\n<li>Apply the con\u00adfig&nbsp;with&nbsp;<ol class=\"wp-block-list\">\n<li>Sysmon64.exe \u2011c sysmonconfig-export.xml<\/li>\n<\/ol>\n<\/li>\n\n\n\n<li>The logs can be seen in the LogView\u00ader in Conesole Root &gt; Event View\u00ader &gt; Appli\u00adca\u00adtions and Ser\u00advices Logs &gt; Microsoft &gt; Win\u00addows &gt; Sys\u00admon &gt; Operational<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This site con\u00adtains links to tools \/ tech\u00adniques which can run in the back\u00adground dur\u00ading an engage\u00adment. Lin\u00adux Windows<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[471,472],"tags":[],"class_list":["post-1945","post","type-post","status-publish","format-standard","hentry","category-privesc","category-postexp"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1945"}],"version-history":[{"count":4,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1945\/revisions"}],"predecessor-version":[{"id":4477,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1945\/revisions\/4477"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}