Useful Sysinternals Tools for Malware Hunting in Windows OS

Some of the tools in Sysinternals suite are very useful for securing as well as for identifying any malicious activities in Windows operating system.

I have listed the tools, that I frequently use for malware hunting.

Download windows Sysinternals suite and explore the listed tools for malware hunting and securing your windows system.

Tools	Description
AccessEnum	This tool shows access permission of user accounts to the directories, files and Registry keys on the system. Users can use it to find ACL permission holes
EFSDump	View information for encrypted files
MoveFile	Schedule file rename and delete commands for the next reboot. This can be useful for cleaning stubborn or in-use malware files
PendMoves	See what files are scheduled for delete or rename the next time the system boots
Process Monitor	Monitor file system, Registry, process, thread and DLL activity in real-time
Psfile	See what files are opened remotely
Sdelete	Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program
ShareEnum	Scan file shares on your network and view their security settings to close security holes
Sigcheck	Dump file version information and verify that images on your system are digitally signed
Ping	Measures network performance
TCPview	Active socket command-line viewer
Whois	See who owns an Internet address
Autoruns	See what programs are configured to startup automatically when your system boots and you login. Autoruns also shows you the full list of Registry and file locations where applications can configure auto-start settings.
Handle	This handy command-line utility will show you what files are open by which processes, and much more
ListDLLs	List all the DLLs that are currently loaded, including where they are loaded and their version numbers. Version 2.0 prints the full path names of loaded
ProcDump	This new command-line utility is aimed at capturing process dumps of otherwise difficult to isolate and reproduce CPU spikes. It also serves as a general process dump creation utility and can also monitor and generate process dumps when a process has a hung window or unhandled exception
Process Explorer	Find out what files, registry keys, and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.
Psexec	Execute processes remotely
Pskill	Terminate local or remote processes
Pslist	Show information about processes and threads
Psservice	View and control services
Pssuspend	Suspend and resume processes
Shellrunas	Launch programs as a different user via a convenient shell context-menu entry
Autologon	Bypass password screen during logon
LogonSessions	List active logon sessions
PsLoggedOn	Show users logged on to a system
Psinfo	Obtain information about a system
Strings	Search for ANSI and UNICODE strings in binary images.

Exploration of Cyber-Attacks

Attack Definition:

Technique used by hackers to exploit the vulnerability (weakness/flaw in any application/device) is called an attack.

In subsequent posts, we would be exploring attacks to identify their root cause, exploitation and remediation methods.

Attack categories:

Serial No.	Attack Categories
1	Injection
2	Exploitation of authentication
3	Resource manipulation attack
4	Resource depletion attack
5	Abuse of functionality
6	Embedded malicious code execution
7	Protocol manipulation attack
8	Spoofing
9	Data structure attack
10	Path traversal attack

Classification of attacks based upon categories:

1)     INJECTION
SQL Injection	Blind SQL Injection	Static Code Injection
Dynamic Code Injection	Command Injection	LDAP Injection
Comment Injection	Special Character/Element Injection	Server-side Includes Injection
PHP Object Injection	Resource Injection	XPATH Injection
Blind XPATH Injection	Full Path Disclosure	Web Parameter Tampering
Parameter Delimiter	String Format Attack	Cross-site scripting (CSS)
Content Spoofing	Content Security Policy	Cross-Origin Resource Sharing (CORS) RequestPreflighScrutiny

2)     EXPLOITATION OF AUTHENTICATION
Account Lockout Attack	One-click Attack	Session Prediction
Session Hijacking Attack	Session Fixation Attack	Cross Side Request Forgery (CSRF)
Execution after Redirect

3)     RESOURCE MANIPULATION ATTACK
Comment Injection	Special Character/Element Injection	Path Traversal
Relative path Traversal	Repudiation Attack	Application Setting Manipulation
Forced Browsing	Single Encoding Attack	Double Encoding Attack
Malwares

4)     RESOURCE DEPLETION ATTACK
Asymmetric Resource Consumption	Cash Overflow	Denial of Service
Distributed Denial of Service

5)     ABUSE OF FUNCTIONALITY
Account Lockout Attack	Cache Poisoning	Cross-user Defacement
Path Traversal	Mobile code: Invoking Untrusted Mobile Code	Mobile code: Object Hijack
Mobile code: Non-final Public Variable Manipulation

6)     EMBEDDED MALICIOUS CODE EXECUTION
Cross-Site Request Forgery (CSRF)	Logic/Time Bomb	Malwares

7)     PROTOCOL MANIPULATION ATTACK
HTTP Request Smuggling	HTTP Response Splitting	Encryption Protocol Interception
Traffic Flood

8)     SPOOFING
Cross Site Request Forgery (CSRF)	Cash Overflow	Denial of Service (DOS)
Distributed Denial of Service (DDOS)	Man-in-the-Middle (MIM)	Brute Force Attack

9)     DATA STRUCTURE ATTACK
Buffer Overflow Attack	Overflow Binary Resource file	Buffer Overflow via Environment Variables

10)  PATH TRAVERSAL ATTACK
Full Path Disclosure	Relative Path Traversal

Source: OWASP (https://www.owasp.org)