GitBook: [master] 2 pages modified

SUMMARY.md

@@ -464,6 +464,7 @@
     * [Video and Audio file analysis](forensics/basic-forensic-methodology/specific-software-file-type-tricks/video-and-audio-file-analysis.md)
     * [ZIPs tricks](forensics/basic-forensic-methodology/specific-software-file-type-tricks/zips-tricks.md)
   * [Windows Artifacts](forensics/basic-forensic-methodology/windows-forensics/README.md)
+    * [Windows Processes](forensics/basic-forensic-methodology/windows-forensics/windows-processes.md)
     * [Interesting Windows Registry Keys](forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md)
 
 ## A.I. Exploiting

forensics/basic-forensic-methodology/windows-forensics/windows-processes.md

@@ -0,0 +1,93 @@
+# Windows Processes
+
+### smss.exe
+
+It's called **Session Manager**.  
+Session 0 starts **csrss.exe** and **wininit.exe** \(**OS** **services**\) while Session 1 starts **csrss.exe** and **winlogon.exe** \(**User** **session**\). However, you should see **only one process** of that **binary** without children in the processes tree.  
+Also, more sessions apart from 0 and 1 may mean that RDP sessions are occurring.
+
+### csrss.exe
+
+Is the **Client/Server Run Subsystem Process**.  
+It manages **processes** and **threads**, makes the **Windows** **API** available for other processes and also **maps** **drive** **letters**, create **temp** **files** and handles the **shutdown** **process**.  
+There is one **running in Session 0 and another one in Session 1** \(so **2 processes** in the processes tree\).  
+Another one is created **per new Session**.
+
+### winlogon.exe
+
+This is Windows Logon Process.  
+It's responsible for user **logon**/**logoffs**.  
+It launches **logonui.exe** to ask for username and password and then calls **lsass.exe** to verify them.  
+Then it launches **userinit.exe** which is specified in **`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`** with key **Userinit**.  
+Mover over, the previous registry should have **explorer.exe** in the **Shell key** or it might be abused as a **malware persistence method**.
+
+### wininit.exe
+
+This is the **Windows Initialization Process**. It launches **services.exe**, **lsass.exe** and **lsm.exe** in Session 0.  
+There should only be 1 process.
+
+### userinit.exe
+
+Load the **ntduser.dat in HKCU** and initialises the **user** **environment** and runs **logon** **scripts** and **GPO**.  
+It launches **explorer.exe**.
+
+### lsm.exe
+
+This is the **Local Session Manager**.  
+It works with smss.exe to manipulate use sessions: Logon/logoff, shell start, lock/unlock desktop...  
+After W7 lsm.exe was transformed into a service \(lsm.dll\).  
+There should only be 1 process in W7 and from them a service running the DLL.
+
+### services.exe
+
+This is the **Service Control Manager**.  
+It **loads** **services** configured as **auto-start** and **drivers**.
+
+It's the parent process of **svchost.exe**, **dllhost.exe**, **taskhost.exe**, **spoolsv.exe** and many more.  
+Note that services are defined in `HKLM\SYSTEM\CurrentControlSet\Services` and this process maintains a DB in memory of service info that can be queried by sc.exe.
+
+Note how **some** **services** are going to be running in a **process of their own** and others are going to be **sharing a svchost.exe process**.
+
+There should only be 1 process.
+
+### lsass.exe
+
+This the **Local Security Authority Subsystem**.  
+It's responsible for the user **authentication** and create the **security** **tokens**. It uses authentication packages located in `HKLM\System\CurrentControlSet\Control\Lsa`.  
+It writes to the **Security** **event** **log**.  
+There should only be 1 process.  
+Keep in mind that this process is highly attacked to dump passwords.
+
+### svchost.exe
+
+This is the **Generic Service Host Process**.  
+It hosts multiple DLL services in one shared process.  
+Usually you will find that **svchost.exe** is launched with `-k` flag. This will launch a query to the registry **HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost** where there will be a key with the argument mentioned in -k that will contain the services to launch in the same process.
+
+For example: `-k UnistackSvcGroup` will launch: `PimIndexMaintenanceSvc MessagingService WpnUserService CDPUserSvc UnistoreSvc UserDataSvc OneSyncSvc`
+
+If the **flag `-s`** is also used with an argument, then svchost is asked to **only launch the specified service** in this argument.
+
+There will be several process of `svchost.exe`. If any of them is **not using the `-k` flag**, then thats very suspicious. If you find that **services.exe is not the parent**, thats also very suspicious.
+
+### taskhost.exe
+
+This process act as host for processes run from DLLs. It loads the services that are run from DLLs.  
+In W8 is called taskhostex.exe and in W10 taskhostw.exe.
+
+### explorer.exe
+
+This is the process responsible for the **user's desktop** and launching files via file extensions.  
+**Only 1** process should be spawned **per logged on user.**  
+This is run from **userinit.exe** which should be terminated, so **no parent** should appear for this process.
+
+## Catching Malicious Processes
+
+* Is it running from the expected path? \(No Windows binaries run from temp location\)
+* Is it communicating with weird IPs?
+* Check digital signatures \(Microsoft artefacts should be signed\)
+* Is it spelled correctly?
+* Is running under the expected SID?
+* Is the parent process the expected one \(if any\)?
+* Are the children processes the expecting ones? \(no cmd.exe, wscript.exe, powershell.exe..?\)
+