Identifying normal Windows processes and services pre-incident

// Understanding Baselines

Windows systems run countless processes and services, many of which are benign and integral to system operations. Understanding what constitutes normal behavior is critical for detecting anomalies that may signal an incident. By establishing a baseline for processes and services, you can spot deviations that warrant further investigation.

// Baseline Creation

To establish a baseline, you should create a snapshot of active processes and services under normal operating conditions. Here’s how you can do this effectively:

1. Collect Process Information Use the built-in Get-Process cmdlet in PowerShell to list all running processes:

   Get-Process | Select-Object Name, Id, Path, CPU, WS | Sort-Object CPU -Descending

This command outputs the process name, ID, path, CPU usage, and working set memory, sorted by CPU usage in descending order.

2. Record Service Status To capture the state of services, execute:

   Get-Service | Select-Object DisplayName, Status, StartType | Sort-Object Status

This provides a view of all services with their display names, current status (running, stopped), and their start type (automatic, manual, disabled).

3. Export to CSV for Analysis For easier analysis, export the data:

   Get-Process | Export-Csv -Path C:\temp\processes.csv -NoTypeInformation
   Get-Service | Export-Csv -Path C:\temp\services.csv -NoTypeInformation

This saves the information to CSV files, facilitating comparison later.

// Monitoring Tools

Monitoring tools can help track changes over time. Consider implementing the following:

• Sysinternals Suite

Tools like Process Explorer and Autoruns provide deep insights into running processes and their start-up behavior.

• Windows Event Logs

Leverage the Windows Event Viewer to monitor for specific event IDs that indicate process creation or service changes. For instance, Event ID 4688 logs new process creations:

  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Select-Object TimeCreated, Message

// Recognizing Anomalies

When monitoring for anomalies, keep an eye out for:

• Unrecognized process names or paths, especially those running from unusual directories.
• Services with manual startup types that suddenly change to automatic or start running unexpectedly.
• High CPU or memory usage by a process that is out of the ordinary for that time.

Common Mistakes to Avoid

• Ignoring the Baseline: Regularly review and update your baseline based on normal operational changes.
• Neglecting to Analyze Context: Always consider the context of a process. A known application behaving unusually may require different scrutiny than an unknown process appearing suddenly.

// Defensive Implications

Understanding what is normal allows for quicker identification of potential threats. Implementing monitoring solutions and regularly updating baselines can significantly enhance your defensive posture. Consider integrating alerts based on deviations from your established baselines to streamline incident detection.

Checklist for Establishing a Baseline

• [ ] Collect process information using PowerShell.
• [ ] Record service statuses with the Get-Service cmdlet.
• [ ] Export data for future comparisons.
• [ ] Utilize monitoring tools for deeper insights.
• [ ] Regularly review and update baselines.

// Conclusion

Establishing and maintaining a clear understanding of the normal state of Windows processes and services can drastically improve your incident response capabilities. Leveraging these techniques in a disposable lab environment allows for exploration without risk. The DaemonCore Academy curriculum is freely available to help you enhance your skills further.