System Compromise

Unusual Log Entries

• “Event log service was stopped.”
• “Windows File Protection is not active on this system.”
• “The protected System file file name was not restored to its original, valid version because of the Windows File Protection…”
• “The MS Telnet Service has started successfully.”
• Look for a large number of failed logon attempts or locked out accounts.

Access to Event Viewer

Using the command prompt:

Or, to focus on a particular event log:

Unusual Process and Services:

Look for unusual/unexpected processes, and focus on processes with User Name “SYSTEM” or “Administrator” (or users in the Administrators’ group). You need to be familiar with normal processes and services and search for deviations.

Using the GUI, run Task Manager:

C:> taskmgr.exe

Using the command prompt:

Also look for unusual services.

Using the GUI:

Using the command prompt:

For a list of services associated with each process:

Unusual Files and Registry Keys

Check file space usage to look for sudden major decreases in free space, using the GUI (right-click on a partition), or type:

Look for unusually big files:

Look for strange programs referred to in registry keys associated with system start up:

Note that you should also check the HKCU counterparts (replace HKLM with HKCU above).
Using the GUI:

Using the command prompt:

Penetration Testing Cheat Sheet for Unusual Network Usage

Look at file shares, and make sure each has a defined business purpose:

Look at who has an open session with the machine:

Look at which sessions this machine has opened with other systems:

Look at NetBIOS over TCP/IP activity:

Look for unusual listening TCP and UDP ports:

For continuously updated and scrolling output of this command every 5 seconds:

The –o flag shows the owning process id:

The –b flag shows the executable name and the DLLs loaded for the network connection.

Note that the –b flag uses excessive CPU resources.
Again, you need to understand normal port usage for the system and look for deviations.

Also, check Windows Firewall configuration:

Unusual Scheduled Tasks

Look for unusually scheduled tasks, especially those that run as a user in the Administrators group, as SYSTEM, or with a blank user name.

Using the GUI, run Task Scheduler:

Using the command prompt:

Check other autostart items as well for unexpected entries, remembering to check user autostart directories and registry keys.

Using the GUI, run msconfig and look at the Startup tab:

Using the command prompt:

Unusual Accounts

Look for new, unexpected accounts in the Administrators group:

Click on Groups, Double Click on Administrators, then check members of this group.
This can also be done at the command prompt:

Other Unusual Items

Look for unusually sluggish performance and a single unusual process hogging the CPU:

Look for unusual system crashes, beyond the normal level for the given system.

On a periodic basis (daily, weekly, or each time you logon to a system you manage,) run through these quick steps to look for anomalous behavior that might be caused by a computer intrusion. Each of these commands runs locally on a system.

Source