This is a draft cheat sheet. It is a work in progress and is not finished yet.
Crypto Mining (XMRig)
Scenario: An attacker wants to use your company's electricity and CPU power to make money. They usually hide the miner in a temp folder. |
|
C:\temp\sys_update.exe -o pool.supportxmr.com:443 -u [Wallet_Address] -p Lab_Worker_01
|
|
How to run workshop
Invoke-WebRequest -Uri [Workshop URL ask Yarin] -OutFile "C:\Users\Administrator\Desktop\workshop.ps1"
|
|
File Management
New-Item -ItemType Directory -Path "C:\temp\data"
|
Creates a Folder |
New-Item -ItemType File -Path "C:\temp\note.txt"
|
Creates a File |
Get-Content -Path "C:\temp\config.txt"
|
Reads a File |
Add-Content -Path "C:\temp\note.txt" -Value "Hacked"
|
Edits a File |
Remove-Item -Path "C:\temp\note.txt"
|
Deletes a File |
|
The "Dirty" Folders (Common Hiding Places)
If you see a file being created or run from these paths, it is highly suspicious: |
|
|
C:\Users\[User]\AppData\Local\Temp
|
|
Identity & Host Recon
|
Shows the name of the logged-in user. |
Look for this running immediately after a suspicious login. |
|
Displays the name of the computer you are on. |
Often the first thing an automated script checks. |
|
Lists every program (process) currently running. |
Look for processes with "odd" names or no description. |
|
|
PowerShell "Smell Test" (The Red Flags)
|
Hides the command in scrambled text. Top priority alert. |
iex
(Invoke-Expression) |
"Download and run." This is how fileless malware starts. |
|
Tells Windows to ignore security policies. |
|
Runs the script silently so the user can't see it. |
The five golden steps for De-Core Investigation
1. Check the Parent: Did a suspicious app like Word or Excel launch PowerShell? |
2. The Smell Test: Look for hidden, scrambled text or "iex" flags in the command. |
3. Follow the Wire: Flag PowerShell connecting to unknown websites or downloading files. |
4. Verify User: Does this specific user have a business reason to run admin scripts? |
5. Trace the Files: Watch for new files created in "Dirty Folders" or evidence being deleted. |
Basic & Network Commands
|
Used to "call" a website or download a file from a remote server. |
Critical: Check the URL. Is it a known site or a strange IP address? |
wget.exe [URL] -OutFile [Name]
|
Similar to curl; used to download tools or malware from the internet. |
PowerShell using wget.exe to save a file in C:\Temp is highly suspicious. |
|
Shows every active "phone call" the computer is making to other computers. |
Look for the State = Established column to see who the machine is talking to right now. |
|
