MS Windows Analysis – List

System Information & Configurations

1. OS Information {name|build|version}
2. OS directory
3. Installed drivers
4. Installed hotfixes
5. Shadow copies

Users, Groups, Privileges

1. Current user
2. Deleted user
3. Groups
4. Privileges
5. Login details

Applications and SVC

1. Installed applications
2. Start-up services
3. default services
4. Task Scheduler
5. Application jobs/Timer jobs

Process Executions

1. Running process
2. DLL library
3. Exception handle

Networks

1. IP connections
2. Ports
3. Downloaded files
4. Internet & browsing activities
5. Running connections

Scripts

1. File extension
2. PS1, VBA scripts

Read Full Post »