1st 3 Windows IR Commands - BHIS Nuggets | John Strand

"hot state on state actor action" 😂

wHaT iF tHe MaLwArE iS uSinG rAw SoCkEtZ

Why is svchost a thing?

These nuggets are gold

Great video. I'm glad that all those hours spent looking at the output of netstat haven't been wasted 😂

I would love a bit more of an explanation as to why you'd see those 4 DLLs in a lot of application level backdoor 😊

You taught us this a long time ago in a GCIH class in Vegas. It looks like a lot of the basics don't change so much. Almost every time I teach someone netstat -anob they think I'm some type of wizard :)

Very informative 👍🏾

I like Resource Monitor GUI to see network connections and file access by processes. Perfmon.exe /res

1. netstat -naob
2. wmic process where processid=<process id found from previus command> get commandline
3. tasklist /m /fi "pid eq <process id from above>"
Four dynamic link libraries associated with common basic level backdoors with command line access and network access "ntdll.dll, wow64.dll, wow64win.dll, wow64cpu.dll"

Nailed it