2024windows安全常用排查命令集.docx
Windows常用排查命令集目录一、账号安全3二、检查异常端口进程5三、启动项检查6四、查看系统定时任务7五、查看系统服务8六、文件查看9一、账号安全queryuser查看当前登录账户C:ProgramFiles(x86)1.ogParser2.2>queryuser用户名会话名ID世态空闲时间登录时间>hahaconsole1运行中无2021/2/248:40IogoffID注销用户idnetuser查看用户netuserusername查看用户登录情况Iusrmgnmsc打开本地用户组描述管理计算机（域）的内置帐户系统管理的用户帐户.供来宾访问计算机或访问域的内表本地用户和组（本地）用户23蛆名称全名AdministratorftaDefauItAcco.&Guest原hahaWDAGUtilit.系统为WindowsDefender应用regedit注册表查看账户，确认系统是否存在隐藏账户rrn11RtylulalMA1.ENtAMAv1.>omansACCoUrnusersNameswuA9uuyAccoUnlV>计算机名称类型> HKEY_C1.ASSES_ROOT瞄CKiA)0x1f8> HKEY_CURREN1.USERVHKEYi1.oCA1.MACHINE> BCb(X)OOOOOO> HARDWAREvSAMvSAMvDomainsvAccount>1Aliases>iGroupsVUsers000001F4OO(X)OIFS000001F7000001F8000003E9vNamesAdministratorDefauItAccountGuesthahaWDAGUtiIityAccount>Builtin1.dstSkuUpgradeRXACT> SECURITY> SOFTWARE> SYSTEM> HKEY_USERS> HKEY_CURRENT_CONFIG利用1.ogParsenexe查看event日志，查询用户登录情况1.ogParsenexe-i:EVT"SE1.ECTTimeGenerated,EXTRACTJOKEN(StringS,5,'')ASUSERNAME,EXTRACTJOKEN(StringsbT)ASSERVICE_NAME,EXTRAeTjOKEN(StringS5T)ASCIientJPFROM'C:UsershahaDesktopSecurity.evtx'WHEREEventlD=4624"(AProgramFiles(x86)1.ogParser2.2>1.ogParser.exe-i:EVT"SE1.ECTTimeGenerated,EXTRACT_TOKEX(Strings,5,EiEXTRACTTOKEN(Strings,5/')FROM'C:UsershahaDesktopSecurity.evt,WHEREEventID=4624*TimeGeneratedUSERXAMEEXTRACT_TOKEN(Strings,5,'')2020-10-1411:05:55SYSTEMSYSTEM2020-10-1411:05:56SYSTEMSYSTEM2020-10-1411:05:56UMFD-OUMFD-O2020-10-1411:05:56SYSTEMSYSTEM2020-10-1411:05:561.OCA1.SERVICE1.OCA1.SERVICE2020-10-1411:05:56NETWORKSERVICENETWORKSERVICE2020-10-1411:05:56SYSTEMSYSTEM2020-10-1411:05:56UMFD-IUMFD-I2020-10-1411:05:56DWM-IDWM-12020-10-1411:05:56DwM-IDWM-I1.ogParsenexe日志分析工具更多用法可参考:https:WOOyUnJs.org/drops/WindoWS%E5%AE%89%E5%85%A8%E6%97%A5%E5%BF%97%E5%88%86%E6%9E%90%E4%B9%8Blogparser%E7%AF%87.html二、检查异常端口进程查看目前连接:netstat-ano一般是查看已经成功建立的连接:netstat-anofindstr"ESTAB1.ISHED"C:ProgramFiles(x86)1.ogParser2.2>netstat-anofindstr"ESTAB1.ISHED"TCP127.0.0.1:443127.0.0.1:7294ESTAB1.ISHED5264TCP127.0.0.1:1080127.0.0.1:7242ESTAB1.ISHED10140TCP127.0.0.1:1080127.0.0.1:7281ESTAB1.ISHED10140TCP127.0.0.1:1080127.0.0.1:7283ESTAB1.ISHED10140TCP127.0.0.1:1080127.0.0.1:7285ESTAB1.ISHED10140TCP127.0.0.1:1543127.0.0.1:8900ESTAB1.ISHED3756TCP127.0.0.1:1549127.0.0.1:1550ESTAB1.ISHED4184TCP127.0.0.1:1550127.0.0.1:1549ESTAB1.ISHED4184TCP127.0.0.1:1554127.0.0.1:8900ESTAB1.ISHED6368TCP127.0.0.1:1555127.0.0.1:8900ESTAB1.ISHED6288TCP127.0.0.1:1557127.0.0.1:8900ESTAB1.ISHED6216TCP127.0.0.1:1658127.0.0.1:1659ESTAB1.ISHED4724TCP127.0.0.1:1659127.0.0.1:1658ESTAB1.ISHED4724根据Pid定位程序名称tasklistIfindstr"pid"C:ProgramFiles(x86)1.ogParser2.2>tasklistfindstr"5808”XshellCore.exe5808Console135,652KC:ProgramFileS(x86)1.ogParSer2.2运行中输入msinfo32,可打开系统信息，在“正在运行任务”中可获取进程详细信息，包括进程的开始时间、版本、大小等信息。!三三MOO保OD9，tenIRftiwi然切W体三珠噢HfDfMTM络连播1正在运行任穷加馥酗CM服外程方班启动我库OtEiim根据端口查看Pidb引讲线ID优小大ttH'it版本大小130968wf,I2021/2/241.-<11Chromeexec.pf09rmNes(96)g0091.42021/2/249880431.96Fexplorer.exec11dowsexploc*r.exe82021/2/241_100l8_4.471wvchatwbexeprogramfiles(x6)tnc82021/2/2414”.13一1.141xplorrxcww>dowsxplfrtx2021/2/248IoN1.447»chromeEc:pr09r.mf<s(x86)gcc982021/2/2488043IX，Svchostexe没有结科82021/2/24HWOsoftedgeex.CvMndOW5sysnappsmic.82002021/2/241_11.0.18-15.12smartscreen.execHdowssyse<n32smMt.82002021/2/241_10.0.18-2.63»WeChatWebexeeprogramfiles(x86)tence82002021/2/24E453.13-1.141Mechatwebexeeprogramfiles(x86)tence82002021/2/249.453.13_1.14»everythingx8没有.2021/2/248发有泓Tlv*rvflwtrvAAw*vttMAnMrvfKinnvft>rtM>SQ4A1-AAA1tAInetstat-anofindstr"8080"C:ProgramFiles(x86)1.ogParser2.2>netstat-anofindstr*8080*TCP172.16.222.193:160258.251.100.102:8080ESTAB1.ISHED9932C:ProgramFiles(x86)1.ogParSer2.2>利用wmic查看进程执行时的命令Wmicprocesswherename='irefox.exe,getnamezCaptionzexecutablepathzCommand1.inezprocessid,ParentProcessld/value':ProgramFiles(x86)1.ogParser2.2>三三icprocesswherename=*irefox.exe,getname,Caption9executablepath,Command1.ineprocessidvParentProcessId/valueCaption=irefox.exeCommand1.ine=*E:Progra三FilesXMozillaFirefoxXirefox.exe*ExecutablePatheEzXProgramFilesMozillaFirefoxirefox.exeXame=irefox.exeParentProcessId=7568Processld2040Wmicprocesswhereprocessid='2040,getname,Caption,executablepath,Command1.inezprocessid,ParentProcessId/value'ProgramFiles(x8
