Comment

Comment on A terminal window periodically flashes on my screen every few minutes. It goes away in one second. I have no idea what it is, nor how to stop it.

t3rmit3@beehaw.org ⁨10⁩ ⁨months⁩ ago

Hi there! Information security guy here. This is essentially a super quick Incident Response run-through of the basic tools I use for malicious process discovery on Windows hosts. I’m assuming this is you own personal machine, or you have permission to do this.

Grab the Sysinternals suite’s installer here and install:

TCPView
Process Explorer
Process Monitor
Autoruns They are all included in the rollup installer, or you can grab them individually at those links. Don’t install everything, or at least don’t leave it all installed when you’re done. It includes a lot of tools for debugging, which you don’t want to leave lying around on your system.

Fire up Autoruns, and check under Logon and Scheduled Tasks tabs for any unusual entries. If you don’t know what something is, and the Publisher is listed as Microsoft, don’t mess with it. Any non-MS stuff in those 2 areas should be safe to disable without hurting your system.
Process Explorer gives you a live view of the processes running on your system, basically a more advanced version of Task Manager. You can scroll through it for unusual processes, and you can even check stuff like rundll.exe processes to see the arguments used to launch it, which is SUPER useful.
Process Monitor is essentially a history/ log view of all processes on your system, starting from when the program is run. Think wireshark, but for processes. You can filter out known-good processes. You can search for strings. If the process is launching, executing, and terminating too quickly to catch in Task Manager or Process Explorer, it will still show up in Process Monitor.
TCPView is sort of like netstat, but with lots more info. You can use that to watch for unknown network connections, in case the thing you’re seeing is performing some kind of network beaconing.

source

Sort:hotnew top

renard_roux@beehaw.org ⁨10⁩ ⁨months⁩ ago
That’s fantastic! 😮

Do you have a similar list for macOS? 😅

source
- t3rmit3@beehaw.org ⁨10⁩ ⁨months⁩ ago
  Most of the IR that I do is within corporate production environments, so I can answer this with the tools I would use for Linux incident response, but there will be areas like Kernel Extensions that are MacOS-specific, which I don’t have IR experience in, and can’t speak to. Assume that sudo permissions are required for these. Also not that I’m not including commands to look for active user intrusions, just binary implantation like malware. Active human intrusion blows up the amount of places and things to check for, and for regular users who don’t have regulatory reporting requirements, you’re better off just restoring from a backup.
  
  ps aux : This lists all processes running under all users, not attached to a terminal session. This is a static list, unlike the live-updating list you get with top
  
  lsof -b -c |-u | -p -R : This lists open files. You can specify process names, PIDs, usernames, and more, to filter on. If you filter on PID, include the -R argument to get the parent process info for that process.
  
  lsof -i : This lists open files that have an active network port. netstat -antv -p tcp : It’s important to note that on MacOS, netstat doesn’t perform like it does on Linux (e.g. it won’t give you process names), so you need to use the Mac-specific flags for it, and you’ll need to combine that with lsof or ps to get more info about the processes.
  
  There is apparently also a tool made by Apple called sysdiagnose that you can run to basically do a large-scale debug dump of your system, including lots of data about applications and processes. I can’t claim any personal experience with this, but this guide (and part 2 here) go into using it to hunt for malware.
  
  source
  - renard_roux@beehaw.org ⁨10⁩ ⁨months⁩ ago
    Thank you! I’ll save this, just in case! 😁🤘
    
    source