In this video we're going to take a look at some of the main Microsoft Windows components
applications that are used within Windows like Word and Internet Explorer rely on processes a process
is an instance of a computer program that is being executed.
The process may be made up of multiple threads.
Threads are the individual program commands that are ran within a process.
For example when I launch my notepad application there would be multiple threads running to take care
of each task.
One thread could be used to collect data input to the notepad file while another thread could be used
to save the data to give you a better idea of how processes and threads work.
I'm going to show you how to download and install a Windows tool called sists internals Ciss internals
gives you the ability to drill down into some of the Microsoft Windows components that are running on
your computer.
If you just Google tsis internals and go to the Windows internals web page and then go to down from
there you can download this internal suite of tools.
So click on that
and then downloading it into a zip file I actually already have it installed.
Once you locate your downloaded internal zip folder you're going to want to open it up and then here
all the tools that you can choose from to look at processes.
On Windows you can use the Process Explorer tool.
So I'll go ahead and extract that to my desktop.
Go back and here is what the process explorer application looks like.
Let's go ahead and launch that give you an example of how you can drill down into see what processes
and threads are running for an application.
I'm going to launch pad here.
Here I found my notepad executable and it shows me Sibiu usage some basic information for the process.
All right click and go to properties and then it actually shows me the threads that are running for
the application.
So if I were to for example click on this option you can see that when I launch that application it
fired up additional threads.
Since I'm doing multiple things with an application and you'll even see a new thread pop up if I were
to save the application.
So I just did control and save and you can see that.
Now there's all these additional threads.
So you can see how this tool can help you really drill into what's happening and you're using an application
in regards to how processes and threads are working in the background.
Computer memory is used to temporarily or permanently store information for applications processes use
virtual memory known as virtual address space.
It acts as a reference point for physical objects in memory for cybersecurity investigations.
Computer memory can provide a lot of valuable forensics information such as active user sessions and
port connections.
The Windows registry contains settings for programs and hardware installed on Microsoft Windows operating
systems for example when a program is installed a new subkey containing settings like a program's location.
It's version and how to start the program are all added to the Windows registry to pull up the windows
registry you can open up a command line prompt and enter the command rads at it.
Or just search for Raaj at it in your windows search bar.
Here in the registry editor you can see that there's five folders each of these main folders are called
HIV's each hive contains different registry entry types.
For example user based settings will be set within the user HIV's and hardware sitings would be set
within the local machine hive.
Just to show you an example of some of the different types of registry things that you could modify
or go to my mouse registry settings the path is user control panel and then mouse you can see all these
default settings in here.
So it has yes or no for if extended sounds are enabled beeping the mouse speed and sensitivity and by
adjusting these values I could modify the behavior of how my mouse program runs.
WMI is only used on Windows systems.
It defines a proprietary set of specifications that allow management information to be shared between
management applications.
It can be used for tasks like modifying system properties and polling system information from devices
although WMI can be very useful to I.T. administrators.
It can also be used to conduct malicious acts.
So access to WMI resources should be limited to only the required systems.
As you can see in the slide if you go to your windows firewall settings you have the ability to enable
or disable WMI handles are used when applications reference objects like memory blocks or databases
as it relates to security.
Handles are at risk of causing memory leaks that are created when computers do not release handles that
are no longer being used to view handles that are associated to processes.
You can either go to our process explorer system internals tool that we looked at earlier.
And again I'm clicked on the notepad application and down below here.
So the associated Handels for that program.
Another way you can view associated handles to processes is using the resource monitor tool.
If you go to the Sibiu tab and then select the program that you want to view Handels for down below
you can see the associated Handels with that program.
Services are computer programs that run in the background.
These services can be used as an attack vector.
Some network services leave extra layer for port open on and points like SMP and RTP that can be used
to gain access to a system.
Services like these should be disabled if they are not in use to view services we can go to the start
menu and then just search for services
and click on View local services.
So here's a list of services running on my computer.
Here is my remote desktop service.
So for my computer I have no reason for my cell for anybody to use remote desktop services and log in
to my computer remotely.
So this'll be a good example of a service that I would want to stop it and keep disabled so it cannot
be used as an attack factor to gain access to my computer.
So if I want to stop the service and go to stop say yes
and this one has to be manual for start up or if I wanted to change that behavior I could right click
on it and go to properties and then choose the startup type.