So let's talk about executing the support tools.
Well,
the first thing to remember is that the Sysinternals
utility output includes a banner.
So,
obviously what that means is whenever you output something from the executable,
it's going to have Microsoft Sysinternals,
which means if you're trying to format it into a
different format to make it look nice, you've got to somehow get rid of that,
but obviously there are ways around that.
Not all the utilities support command line execution as well.
So for example,
if you're trying to do like a memory map of the current memory state,
that's going to be an executable that launches in its own window and
you're going to need to physically interact with that,
which if we're trying to remotely execute a triage script,
that becomes a bit more complicated.
That would be something you would have to get onto the
machine and then execute manually.
They don't always support CSV, XML, or HTML output.
Some of them do.
There's a bit of a mix across the board.
So some of them you can say dash and set the output to CSV,
which is helpful; otherwise, you have to do,
like we did in the PowerShell,
combine the exporting commands of PowerShell with the output from there.
You'll also find that the properties are not always available for querying.
So,
whereas in PowerShell we might do Select‑Object or
Where‑Object to find something,
you're not able to do that because the query engine isn't
available in some of those executables.
So how do we remove the Sysinternals banner?
Well, you can see, on the left‑hand side, we have the banner.
It's called LogonSessions,
and it tells you who created it and Sysinternals,etc., but when I'm out
putting that into a file or into a document or in,
like for example think of a CSV file,
I don't need five lines of stuff at the top.
So we can use a property called ‑nobanner,
and then on the right side here you'll see that it's removed that.
So if we're trying to create supporting files,
such as CSV files or text files or comma‑separated files,
whatever it would be, we can remove that banner.
So how do we execute the support tools and then export them?
Well, let's use a different example.
Let's say I wanted to get TCP information from the network stack on the machine.
Well, I can use a command called tcpvcon 64.
You can see that I'm getting everything and accepting
the pop‑up that comes up that says, hey,
do you agree to this?
And then I'm piping that value out using a PowerShell command called Out‑File
and then setting the FilePath to be whatever it's going to be.
So, for most executions of these,
we can simply just say go and grab me this piece and whatever you've got,
pipe it out to Out‑File and do that.
In fact, if we were to use handle.exe, which goes and gets me processes,
I can do the same thing.
And if I then do retrieve event log, I can use the previous older command,
so the wmic command, and then say output those values too.
So the syntax is the same, but we can simply output those values into log files.
We're not specifying CSV, we're not specifying XML or anything like that,
but we have the ability to just dump them out into supporting files.