Built-in Windows commands to determine if a system has been hacked

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1303709,00.html

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Nice article. To bad they did not screen it better for errors.

For example:

The [N] here is an integer, indicating that WMIC should run the given command every [N] seconds. That way, users can look for changes in the settings of the system over time, allowing careful scrutiny of the output. Using this function to pull a process summary every 5 seconds, users could run:
C:\> wmic process list brief /every:1

 

Tinus, you should send them an email shairing that with them. You never know.

 

The only problem with those tools is that if your computer has been rootkitted those tools can't be trusted as they rely on the system itself to report to them. If the system has been rootkitted it will lie to the tools, and the output from the tools will therefore be useless.

 

Isnt that the same for Linux?

 

Interesting article! thanks

 

Yup. Once any system is rootkitted it's completely unreliable, so putting forth tools that rely on the system to be truthful when a system has been hacked is at best a very iffy proposition.

That's why Linux tools include tools that run from a cd to check binaries, and system settings. That way they don't depend on the compromised system to check itself.

 

Will do.

 

Mitzs, are you a member there? I can't find a link to respond to that article. Could you do me the favor?

 

Well done Mitzs - that's an interesting article