2024网络信息安全应急响应Windows应急手册.docx

应急响应培训WindOWS应急WindOWS手工检查项WindOWS检查工具目录contents手工检查项总结8 .进程检查9 .安装包检查）10 .服务检直飞iwBBi12 .日志第J13 .内存检查J12.网络检查K3.账户检查4.操作记录检直卜5.启动项检意卜6.计划任务检查7.防火墙检查msimfo32值月户名%SystemRootsystem32cmd.exe<SYSTEM>NO<SYSTEM>C:ProgramFileWWptOPenJDWdk8A23209.<SYSTEM>2<SYSTEM>WindOWS_NT<SYSTEM>CPython3ScriptsVCPython37VCProgramFi.<SYSTEM>C:UsersHarveyAppData1.ocalProgram$MiG.WN-UQACO.COM;.EXE；.BAT：.CMD;.VBS;.VBE;JS：JSE：.WSF;.W.<SYSTEM>AMD64<SYSTEM>I11tel64Family6Model165Stepping2,Genuine.<SYSTEM>6<SYSTEM>a502<SYSTEM>%SystemRoot%system32WindowsPowefShe*<SYSTEM>%SystemRoot%TEMP<SYSTEM>%USERPRO111.EAppData1.ocalTempNTAUTHOR1.%USERPRO111.EAppData1.ocalTempWIN1.1QACO.%SystemRoot%TEMP<SYSTEM>%USE三OH1.E%AppData1.ocalTempNtauthori.%USERPROFI1.E%AppData1.ocalTempwinuqaco.SYSTEM<SYSTEM>%SystemRoot%<SYSTEM>3<SYSTEM>C:BVTBinTe$t$Vnstallpackagecsilogfile.iog<SYSTEM>GWdowssystem32cmd.exeMicrosoftUindows版本6.1.76911版权所有c2009MicrosoftCorporation偎所有权利OC：MherSMlarVeyC：MJsersHarey>il1、“系统检查项W)三E)W)觎（三）Ji叶硬件邮ComSpec通组件FPNOHOSTCHECKIJAVA.HOMENUMBEROFPROCESSORSISi胸触月酗正函泡OSPathPath朦的麟PATHEXT朋PR0SS0R.ARCH11ECTUREPROGSSoRjdentifier§»PROasSOR.1.EVE1.O1.E醐照OaSSORFEvIqoNWindows福SmPSModuIePathTEMPTEMPTEMPTMPTMPTMPUSERNAMEwindirWindowSKadng-flagsWindOWSJradngJogfiIe商：造型:Si统理系系系处:值：中:置:ItK用用二录置设需最-能目：修总理位罢：财SnWM需存存嚣诙序版OW目麓法：内的内内内文奥程hzOSnd统动类区理面：言补01302UMware,Inc.UMwareUirtualPlatforn×64-basedPC安装了2个处理器。01：Intel64Family6Model165Stepping2GenuineIntel02：Inte164Pamilv6Mode1165Stepping2GenuineIntelPboeni×TecbnoIogies1.TD6.00,20197Z29C：XWindowsC：Windowss<stem32DeuIceMIarddiskUoIunelNh-Cn；中文<中国）zh-cn；中文中国）<UTC+08：00北京，重庆，香港特别行政区，乌鲁木齐8,191MB5,477MB16,381MB13,499MB2,882MBC：pagefile.sysWoRKGRoUP、SlJJM-T.T安装了4个修补程序。01：KB253411102J：KB2999226E033：KB958488041：KB976902÷,>U"+",".人.：Intel<R>PRO/1000MTNetworkConnection法提名：丢地连袭启用DHCP:是DHCP服务器：192.168.8.1IP地址01：192.168.8.178C022：fe80:：81b0：8cb4：be84：f846：Mic*osoft1.oopbackAdapter连接名:Npcap1.oopbackAdapter启用DHCP:是DHCP服务器：255.255.255.255IP地址E012：169.254.202.20402：Fe80：d488三b576e3dd：caccC：XUsersXHa*Me<>systeninfo"系统”检查项¾Minra"系统”检查项<-CA：catalog.update.microsoftcom/Search.aspx?q=nis17_010Microsoft8UpdateCatalogfAQ-hep0Searchresultsfor"ms17-010,PrgJdSClassikatton1.astUpdatedYefftonSize舒好x64颖KWindoWSEmbedded8Standard的InternetExplorer10的工眼皂!雅号(KB4O122M)Windows8EmbeddedS三W2017/3/12Ma315MBDownloadTWindowsEmbedded8Standard的InternetExplorer10畏织安全亘升号序(K84012204)Windws8Embedded安全更耀字2017/3/12n/a1618MBDov/nload舒WindOWSServer2012的internetEtoer1C累隘鳗娥(K840122M)WindwsServer2012效更髓字2017/3/12Ma325MBDOVmloa。SecurityUpdateforWixiA,s8(KB4012598)WindWS8SecurityUpdates2017/5/12Ma872KBDovzrtoadSecurityUpdateforWiNoWSXPSP3(KB4012598)WindowsXPSecurityUpdates2017/5/12Ma667KBDovmioadSecurityUpdatebWindowjVirte(KB4012598)WindowsVisteSecurityUpdates2017/3/12n/a1.2MBDownloadSecurityUpdateforWirdowsSetw2008(KB4012598)WndwsServer2008SecurityUpdates2017/3/12Ma1.2M8DovmloadSecurityIIPdaxef>WirdOWSSef,er2K3forxW-basedSyStCTS(KB4O12598;WindwsServer20G3,V<indo<vsSmer2003.DatacenterEciticnSecurityUpdates2017/5/12Ma957KBDovmloadSecurityUpdateforWirKfoWS8fXw-basedSystems(KB4012598)Windows8SecurityUpdates2017/5/12Ma984KBDownloadSecurityUpdateforWindowsXPSPSforXPe(K84012598)WindcMsXPEmbeddedSecurityUpdates2017/5/12ra667KBDownloadSecurityUpdateforWiodowsServer2003(KB401259S)WindowsServer2003,WindOWJSever2003DatacenterEditionSecurityUpdetes2017/5/12n688KBDovmloadSecurityUpdateforWindowsXPSP2forx64-basedSystems(KB4012598)WindwsXPx64EditionSecurityUpdates201712ra1.9M8DoWniOadSecurityUpdateforWiMowsVistaforX即basedSyStemS(KS4O12598)WindwsVistaSecurityUpdstes2017/3/12ra1.3M8DovmioadSecurityUpdate尔WirKfow，SeVer2008forItanlUm-basedSystems(KB401259S)WindowsServer2008SecurityUpdates2017/3/12n/a1.2M8DovmioadSecurityUpdateforWindowsSetw2008forx64baswSystemsKB4O12598)WlndCWSSefVef2008SecurityUpdatcs2017/3/12ra1.3MBDovmloadSecurityUpdategWES09andPOSReady2009(K8412598)WindwsXPEmbeddedSecurityUpdates2017/3/12Ma667KBDownloadUpdates:1-6of1(pge1of1：.Pfe.jsNext二2.检查监听端口、检查端口连接情况，是否有可疑连接netstat-abnofindstrn1.ISTENING"netstat-abnofindstr"ESTAB1.ISHED"CrUsersAinistrator>netstat-abnoIfindstr*1.ISTENING'TCP0.