SANS Incident Handler's Handbook and PICERL Methodology
Phase 2: Identification – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology I-3: I-3 Check Windows hosts for unusual processes, files, registry run keys, network use, scheduled tasks, accounts and event logs

The handbook's Windows template, following the SANS Intrusion Discovery Cheat Sheet: look for unusual processes and services (Task Manager, tasklist, wmic process list, tasklist /svc); unusual large files and entries in the Run, RunOnce and RunOnceEx registry keys; unusual network activity (shared folders, open sessions, NetBIOS activity, netstat connections); unusual startup and scheduled tasks (msconfig, schtasks, wmic startup); unexpected local administrator or active guest accounts; and warnings, errors and gaps in the event logs, missing logs being a strong sign of compromise.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 2: Identification – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls