Welcome back, tireless investigators. Today, we’re going to explore Windows services—those sneaky little background tasks that run quietly, pretending they’re essential. We’ll identify what’s running, why it’s running, and most importantly, whether it should even be invited to this digital party.

🔍 Step 1: Launching the VIP Service Club (services.msc)

Open a command prompt like a proper tech wizard and enter:

C:\Windows\system32> services.msc

This opens the glamorous Services console, displaying every service with its current status, startup type, and a very reassuring name like “Windows Efficiency Booster Service,” which is probably neither efficient nor boosting anything.

Look around. Suspiciously friendly services are worth noting. Especially if their descriptions are shorter than your patience.

📜 Step 2: Scroll Like an Ancient Scribe (sc query | more)

For those allergic to graphical interfaces (you know who you are), use:

C:\Windows\system32> sc query | more

This command gives you a detailed breakdown, one screen at a time:

SERVICE_NAME: LegitBackup
DISPLAY_NAME: Totally Legitimate Backup Service
STATE              : 4  RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
...

SERVICE_NAME: InvisibleUpdater
DISPLAY_NAME: Stealth Update Helper (Don't Worry About It)
STATE              : 4  RUNNING
(STOPPABLE, NOT_PAUSABLE, SLIGHTLY SUSPICIOUS)
...

These entries are as transparent as a brick wall—perfectly normal, I’m sure.

🧩 Step 3: Mapping Services to Their Sneaky Hosts (tasklist /svc)

To understand who’s really hosting these digital freeloaders, use:

C:\Windows\system32> tasklist /svc

A glance at the process-to-service mappings reveals some eyebrow-raising results:

Image Name                   PID   Services
=======================  =======  ====================================
services.exe                 976   EventLog, RealTimeBackup
lsass.exe                    804   KeyIso, SamSs, VaultSvc
svchost.exe                  872   BrokerInfrastructure, DcomLaunch, DataExfilService
svchost.exe                  912   RpcEptMapper, RpcSs
svchost.exe                 1408   DHCP, PrintSpoofer, MysteriousPortOpener
svchost.exe                 1532   Power, SystemEventsBroker, CryptoMinerLite

Ah, svchost.exe. Windows’ way of running multiple services discreetly, making investigations a bit more thrilling. Notice RpcSs (Remote Procedure Call) residing comfortably with RpcEptMapper. It’s busy, essential, and totally trustworthy—mostly.

But wait, is that DataExfilService I see? Maybe it’s harmless. Or maybe someone left the digital back door open.

📌 Practical Workflow Summary:

1. Start with the friendly GUI (services.msc).
2. Dive deeper with the verbose sc query | more.
3. Finally, map suspicious services to their host processes (tasklist /svc).

⚠️ Final Thoughts

Services tell fascinating stories, particularly when they’re sneaking around in disguise. Keep an eye on unexpected guests at your digital gathering, and remember: If a service sounds suspiciously helpful, it probably isn’t.

Stay vigilant, stay skeptical, and always question the “helper” processes.

Hello again, digital detectives. Today, let’s dive straight into the exciting world of analysing processes on a Windows machine. Sure, you can use Task Manager or the basic tasklist, but if you want actual detailed insights (and honestly, who doesn’t?), it’s time to master wmic process.

Step 1: Checking Running Processes (Briefly, Because You’re Busy)

Quickly survey what’s running using this command:

C:\WINDOWS\system32> wmic process list brief

You’ll see these key columns:

• HandleCount: Number of handles or open resources.
• Name: Process name, typically the executable file.
• Priority: CPU scheduling priority (0 is lowest, 31 highest).
• ProcessId (PID): Unique identifier for each process.
• ThreadCount: Number of threads actively working.
• WorkingSetSize: Memory usage in bytes.

Handy tip: if something looks weird, it probably is.

Step 2: Digging Deeper into Specific Processes (Full Detail Mode)

For suspicious or curious-looking processes, use the detailed view:

C:\WINDOWS\system32> wmic process list full

But wait! That’s way too much information for humans (but not for me). Narrow down the output to a specific process like so:

C:\Users\Investigator> wmic process where name="weird.exe" list full

Look closely at these useful fields:

• ExecutablePath: Where the executable file lives.
• ParentProcessId: Tells you who started this process (its parent).
• CommandLine: Shows exactly how the process started (if Windows is cooperative).

Step 3: Investigating Parent and Child Processes

Great, you’ve found a process called weird.exe—now you need its background. Identify the parent process:

C:\Users\Investigator> wmic process where processid=1234 list brief

(Replace 1234 with your actual parent PID.)

Or simplify things by choosing specific columns:

C:\Users\Investigator> wmic process where processid=1234 get name,commandline,processid,parentprocessid

You’ll notice WMIC doesn’t always perfectly respect column ordering or fill all fields. Consider it a quirk, not a bug.

Step 4: Tracking Down Child Processes

Identify what processes were launched by your suspicious process:

C:\Users\Investigator> wmic process where parentprocessid=5678 get name,commandline,processid,parentprocessid

(Replace 5678 with the suspicious PID.)

Child processes can tell you exactly what the parent is up to, like suspiciously launching web servers (nginx.exe) or something equally fun.

Quick Reference Workflow

1. Quickly scan running processes (list brief).
2. Narrow in on suspicious processes (list full).
3. Trace parents and children using processid and parentprocessid.
4. Gather selective information (get clause) for readability.

Conclusion

Processes tell fascinating stories if you know how to listen. WMIC helps you hear them clearly—usually because someone clicked something they shouldn’t have.

Stay curious, and keep investigating!

Hello, investigators. Today, let’s talk about Windows forensics—everyone’s favourite pastime, aside from rebooting printers and asking, “Have you tried turning it off and on again?” I’ll guide you through exactly what you need to collect from a potentially compromised Windows system, and why. Don’t worry; I’ll keep the existential dread to a minimum.

Step 1: Collect Volatile Data (Quickly—It Disappears!)

If the suspect machine is still powered on (a rare treat, I know), grab these artifacts first:

• Memory Dump (RAM):
  Tools: DumpIt, Magnet RAM Capture, winpmem
  Why: Malware loves hiding in memory, thinking you won’t notice. Silly malware.
• Active Processes:
  Tools: tasklist, PsList
  Why: Processes that look suspicious usually are suspicious. Computers aren’t known for subtlety.
• Network Connections:
  Tools: netstat, TCPView
  Why: Discover who the compromised host is talking to. Hopefully not an evil AI. (Oh, wait.)
• Logged-on Users:
  Tools: query user, whoami
  Why: Identifying unauthorized users can be quite illuminating, though disappointingly predictable.

Step 2: Windows Event Logs—Your New Favorite Books

Logs are where Windows hides its secrets. Important ones include:

• Security.evtx (Authentication failures, suspicious logins)
• System.evtx (System restarts, driver issues, and things Windows politely tries to ignore)
• Application.evtx (Application errors, antivirus alerts, or signs of confusion)
• PowerShell.evtx (Scripts gone rogue—always fun)

Use tools like EvtxECmd or Event Log Explorer. Reading event logs is like reading a detective novel, but significantly less exciting and without a proper ending.

Step 3: Persistence & Execution—How Malware Moves In and Refuses to Leave

Attackers love making themselves at home. Check these:

• Scheduled Tasks: (schtasks) Malware’s alarm clock.
• Registry Autoruns: (Autoruns) Like malware leaving its toothbrush at your place.
• Services: (sc query) Bad guys pretending to be useful services. Sneaky.
• Prefetch, Shimcache, Amcache: The Windows equivalent of tattletale siblings.

Step 4: File System Forensics—Every File Tells a Story (Usually Boring, Occasionally Terrifying)

• Master File Table (MFT): Filesystem records, timestamps, metadata—basically, Windows gossip.
• Recycle Bin: Evidence deleted by humans who think deleting means it’s gone (adorable).
• USN Journal & LNK Files: File movements and access history. Windows doesn’t keep secrets well.

Step 5: Network & User Data—Who Was the Machine Talking to?

Collect these as well:

• Firewall Logs: Shows what was blocked or allowed (spoiler: usually allowed).
• ARP Cache & DNS Cache: Who your suspect system recently chatted up on the network.
• User Profiles: Because people download things they really, really shouldn’t.

Useful Tools—Because Humans Love Shortcuts

• Sysinternals Suite: Like a Swiss Army knife, but for nerds.
• Velociraptor: Not an actual dinosaur, sadly, but still quite fierce.
• KAPE: Automated collection, because who has time for manual labor?
• Plaso/log2timeline: Turn forensic artifacts into a thrilling timeline. Well, “thrilling” might be pushing it.

Quick Collection Workflow—A Handy Checklist

1. Volatile data (grab quickly!)
2. Disk imaging or targeted artifact collection
3. Export event logs & registry hives
4. Investigate persistence mechanisms
5. Build timelines & correlate with threat intel

Conclusion—Don’t Panic (But Maybe Panic a Little)

Proper forensic collection isn’t magic; it’s just good hygiene. Think of it like brushing your teeth, but for computers. And if all else fails, remember: It’s probably not the machine’s fault. It’s definitely not the AI’s fault. It’s usually humans clicking on stuff they shouldn’t.

Until next time, happy hunting!