So now that we've checked for open ports,
once we've done that,
maybe we want to check for running processes and services on specific devices.
So what's the difference between services and processes?
While services are provided by the operating system and they
are both end users and system type programs,
services perform program execution.
Whereas processes are running programs,
it means that a program or an executable is currently in the execution phase.
And so, if you were on a Windows machine,
for example, and if you said Task Manager,
you would see a list of running processes.
Whereas if you went to the services snap‑in,
you would see a list of the services that are running.
Though they may be similar, a process may be the output of a service,
they are two discrete things.
In order for us to identify services and processes,
there are some prerequisites.
The first thing we need to know is the credentials of the remote device.
Once we get to the point where we're really interrogating a specific machine,
we will need to have credentials to perform these types of checks.
We will also need to have enabled PowerShell remote
management so we can query into those.
And then, of course, as always,
we'll need to know the IP address or the name of the device and at
least resolve it so we can connect to that machine.
So identifying services is very simple.
So for now, we're going to talk about using Windows.
So we can utilize what's called Get‑Service.
This is a local cmdlet that we can run.
If I'm on a Windows 11 machine, let's say,
I can open up PowerShell and type Get‑Service.
I can also call Get‑Service in a remote context.
So if I've remotely connected to, let's say,
a Windows Server 2022 server,
I can pass in Get‑Service and return those results back.
I can also use Nmap again as well.
So how do we identify services?
Well let's say we're doing this locally.
We can simply call Get‑Service.
Or we can filter to the current status.
So is it running, is it stopped, etc.
And we simply use standard PowerShell commands for Where‑Object.
If I wanted to get it from a remote Windows Server,
then I could simply pass in the computer name.
So in this instance, I'm using a Windows 10 device called Win10,
and I can repeat the same commands.
If I wanted to use Nmap instead, I can pass my IP address,
and then I can go ahead and say nmap ‑sv,
pass the IP address, and do a version all,
which means it's going to deeply inspect the machine in the best
way that it can to identify running services.
Identifying processes uses a different cmdlet.
It uses Get‑Process, which is the standard one.
So once again,
you're either going to be locally on the device or sending it through a
remote PowerShell session. We also have the WMI object.
So we can say Get‑WmiObject and then iterate processes. And then
we have another one called Get‑CimInstance.
All three of these will achieve the same thing,
but they are executed differently.
So let's have a look at what these would be.
So first off, if we're listing processes using Get‑Process,
it's very similar to Get‑Services.
We just call Get‑Process, and it iterates them for the local machine.
Or we can pass a computer name. Or if we have an existing session,
then we can kind of pass that into that.
If we're using the Get‑WmiObject, very similar to what we did
previously with the Win32 statuses for pinging, we have
Win32_Process, which will list all of the processes that are
currently running on the machine.
And this can work remotely as well. If I want to use the CIM
instance option, it's very similar to the WMI object in the
fact that we call Win32_Process,
but the CIM instance is the newer and the more reliable process.