2026-04-13 02-17-34
May 25, 2026 14:19
· 13:32
· English
· Whisper Turbo
· 2 સ્પીકર
આ ટ્રાન્સક્રિપ્ટ આજે સમાપ્ત થાય છે.
કાયમી સંગ્રહ માટે સુધારો →
માત્ર બતાવી રહ્યા છે
0:11
S…
Speaker 1 (2026-04-13 02-17-34)
In this video,
0:12
S…
Speaker 1 (2026-04-13 02-17-34)
we're going to take a look at some of the core Windows system
0:17
S…
Speaker 1 (2026-04-13 02-17-34)
processes and what to keep an eye out for when
0:21
S…
Speaker 1 (2026-04-13 02-17-34)
performing threat hunts in a Windows system.
0:25
S…
Speaker 1 (2026-04-13 02-17-34)
So first of all,
0:26
S…
Speaker 1 (2026-04-13 02-17-34)
let's take a look at kind of some ways to be able to identify
0:31
S…
Speaker 1 (2026-04-13 02-17-34)
processes in general.
0:34
S…
Speaker 1 (2026-04-13 02-17-34)
Now remember there's two different kind of definitions,
0:37
S…
Speaker 1 (2026-04-13 02-17-34)
if you will,
0:38
S…
Speaker 1 (2026-04-13 02-17-34)
for a process.
0:39
S…
Speaker 1 (2026-04-13 02-17-34)
We're talking about these specific Windows system processes,
0:43
S…
Speaker 1 (2026-04-13 02-17-34)
not just any running file here,
0:46
S…
Speaker 1 (2026-04-13 02-17-34)
any running executable.
0:47
S…
Speaker 1 (2026-04-13 02-17-34)
So some of the ways that system processes or processes in general really
0:51
S…
Speaker 1 (2026-04-13 02-17-34)
can be identified is through the name.
0:54
S…
Speaker 1 (2026-04-13 02-17-34)
There's the name of the executable that is running.
0:57
S…
Speaker 1 (2026-04-13 02-17-34)
You can also identify a system process through the process ID
1:01
S…
Speaker 1 (2026-04-13 02-17-34)
or PID or PID,
1:03
S…
Speaker 1 (2026-04-13 02-17-34)
sometimes it's called.
1:05
S…
Speaker 1 (2026-04-13 02-17-34)
And also the full path that the executable is
1:09
S…
Speaker 1 (2026-04-13 02-17-34)
running from is another good way to be able to identify a system process.
1:14
S…
Speaker 1 (2026-04-13 02-17-34)
There's several different things that you can kind of think of
1:18
S…
Speaker 1 (2026-04-13 02-17-34)
to be able to try and determine whether or not a given
1:22
S…
Speaker 1 (2026-04-13 02-17-34)
process or an application you see running on a system is
1:27
S…
Speaker 1 (2026-04-13 02-17-34)
a legitimate core system process.
1:30
S…
Speaker 1 (2026-04-13 02-17-34)
Number one.
1:31
S…
Speaker 1 (2026-04-13 02-17-34)
is does it have the expected parent process?
1:35
S…
Speaker 1 (2026-04-13 02-17-34)
A lot of your core processes will have a very specific
1:40
S…
Speaker 1 (2026-04-13 02-17-34)
process that should have launched it.
1:42
S…
Speaker 1 (2026-04-13 02-17-34)
Some of them will not have any that will be visible because the process
1:46
S…
Speaker 1 (2026-04-13 02-17-34)
that launched it terminated after it was launched.
1:49
S…
Speaker 1 (2026-04-13 02-17-34)
But that's something to keep an eye out for.
1:52
S…
Speaker 1 (2026-04-13 02-17-34)
Do you see the expected parent process that
1:56
S…
Speaker 1 (2026-04-13 02-17-34)
spawned the process you are analyzing?
2:00
S…
Speaker 1 (2026-04-13 02-17-34)
Is it running from where you think it should be running from?
2:04
S…
Speaker 1 (2026-04-13 02-17-34)
A lot of your core system processes will run from the Windows System
2:08
S…
Speaker 1 (2026-04-13 02-17-34)
32 folder on whatever the boot drive is or
2:12
S…
Speaker 1 (2026-04-13 02-17-34)
wherever Windows is installed.
2:14
S…
Speaker 1 (2026-04-13 02-17-34)
So if you see what looks to be a system process
2:18
S…
Speaker 1 (2026-04-13 02-17-34)
running from,
2:19
S…
Speaker 1 (2026-04-13 02-17-34)
you know, a user's download folder,
2:21
S…
Speaker 1 (2026-04-13 02-17-34)
probably not legitimate.
2:25
S…
Speaker 1 (2026-04-13 02-17-34)
Next question is a pretty obvious one.
2:28
S…
Speaker 1 (2026-04-13 02-17-34)
Is the executable,
2:30
S…
Speaker 1 (2026-04-13 02-17-34)
is the file name spelled right?
2:32
S…
Speaker 1 (2026-04-13 02-17-34)
A lot of times attackers will mimic your legitimate
2:36
S…
Speaker 1 (2026-04-13 02-17-34)
system processes by misspelling them,
2:39
S…
Speaker 1 (2026-04-13 02-17-34)
common misspellings,
2:40
S…
Speaker 1 (2026-04-13 02-17-34)
or adding a letter,
2:41
S…
Speaker 1 (2026-04-13 02-17-34)
or removing a letter,
2:43
S…
Speaker 1 (2026-04-13 02-17-34)
or anything like that.
2:44
S…
Speaker 1 (2026-04-13 02-17-34)
That's an easy one you can keep an eye out for.
2:47
S…
Speaker 1 (2026-04-13 02-17-34)
Is the file name spelled correctly?
2:50
S…
Speaker 1 (2026-04-13 02-17-34)
And if you're performing a threat hunt on the system itself where you have access
2:54
S…
Speaker 1 (2026-04-13 02-17-34)
to the file signing information,
2:56
S…
Speaker 1 (2026-04-13 02-17-34)
another way to determine whether or not it's legitimate is,
2:59
S…
Speaker 1 (2026-04-13 02-17-34)
is the file signed by Microsoft?
3:02
S…
Speaker 1 (2026-04-13 02-17-34)
If it's not signed or not signed by Microsoft,
3:05
S…
Speaker 1 (2026-04-13 02-17-34)
chances are it's not a legitimate system process.
3:09
S…
Speaker 1 (2026-04-13 02-17-34)
So now let's take a look at some of the core system processes that are very
3:13
S…
Speaker 1 (2026-04-13 02-17-34)
commonly abused by your attackers.
3:16
S…
Speaker 1 (2026-04-13 02-17-34)
Number one we're going to look at is the session manager process
3:21
S…
Speaker 1 (2026-04-13 02-17-34)
or SMSS .exe.
3:24
S…
Speaker 2 (2026-04-13 02-17-34)
Now, again,
3:25
S…
Speaker 1 (2026-04-13 02-17-34)
I said a lot of these are going to be running from the Windows System
3:29
S…
Speaker 1 (2026-04-13 02-17-34)
32.
3:30
S…
Speaker 1 (2026-04-13 02-17-34)
The exact path or the exact drive might
3:34
S…
Speaker 1 (2026-04-13 02-17-34)
vary if you have Windows installed on a different drive or a
3:38
S…
Speaker 1 (2026-04-13 02-17-34)
different location.
3:39
S…
Speaker 1 (2026-04-13 02-17-34)
So just keep that in mind.
3:41
S…
Speaker 1 (2026-04-13 02-17-34)
These are the default locations you will find if it is
3:45
S…
Speaker 1 (2026-04-13 02-17-34)
a kind of a typical Windows installation.
3:48
S…
Speaker 1 (2026-04-13 02-17-34)
So the smss .exe,
3:50
S…
Speaker 1 (2026-04-13 02-17-34)
this is in charge of creating new sessions,
3:54
S…
Speaker 1 (2026-04-13 02-17-34)
as the session manager name implies.
3:57
S…
Speaker 1 (2026-04-13 02-17-34)
You should only see one running instance of
4:01
S…
Speaker 1 (2026-04-13 02-17-34)
this process,
4:02
S…
Speaker 1 (2026-04-13 02-17-34)
and the parent process should be listed as system.
4:07
S…
Speaker 2 (2026-04-13 02-17-34)
Now, again,
4:08
S…
Speaker 1 (2026-04-13 02-17-34)
you may see these in different locations,
4:10
S…
Speaker 1 (2026-04-13 02-17-34)
but they should always be running from wherever the Windows folder
4:15
S…
Speaker 1 (2026-04-13 02-17-34)
is in the System32 folder inside there.
4:19
S…
Speaker 1 (2026-04-13 02-17-34)
Next one is the Client Server Run Subsystem,
4:23
S…
Speaker 1 (2026-04-13 02-17-34)
or CSRSS .exe.
4:26
S…
Speaker 1 (2026-04-13 02-17-34)
This process is in charge of managing processes and
4:31
S…
Speaker 1 (2026-04-13 02-17-34)
threads, mapping drive letters,
4:33
S…
Speaker 1 (2026-04-13 02-17-34)
things like that.
4:34
S…
Speaker 1 (2026-04-13 02-17-34)
Typically, you're going to see two running instances of
4:39
S…
Speaker 1 (2026-04-13 02-17-34)
this process,
4:39
S…
Speaker 1 (2026-04-13 02-17-34)
and normally you're not going to see a parent process.
4:44
S…
Speaker 1 (2026-04-13 02-17-34)
Again, anytime you see a process that doesn't have a parent
4:48
S…
Speaker 1 (2026-04-13 02-17-34)
process, that typically just means that whatever the parent
4:52
S…
Speaker 1 (2026-04-13 02-17-34)
process was is no longer running.
4:55
S…
Speaker 1 (2026-04-13 02-17-34)
It terminated the process after it launched this process
4:59
S…
Speaker 1 (2026-04-13 02-17-34)
at some time.
5:00
S…
Speaker 2 (2026-04-13 02-17-34)
Next one is the Windows login process or
5:04
S…
Speaker 2 (2026-04-13 02-17-34)
winlogon .exe.
5:06
S…
Speaker 1 (2026-04-13 02-17-34)
This,
5:07
S…
Speaker 1 (2026-04-13 02-17-34)
as the name implies,
5:08
S…
Speaker 2 (2026-04-13 02-17-34)
is responsible for user logins and logoffs.
5:12
S…
Speaker 2 (2026-04-13 02-17-34)
Again, usually you're not going to see a parent process on this
5:17
S…
Speaker 1 (2026-04-13 02-17-34)
one.
5:17
S…
Speaker 2 (2026-04-13 02-17-34)
You have the Windows initialization process that is in charge
5:21
S…
Speaker 2 (2026-04-13 02-17-34)
of, you guessed it,
5:22
S…
Speaker 1 (2026-04-13 02-17-34)
initializing Windows subsystems.
5:24
S…
Speaker 1 (2026-04-13 02-17-34)
This is the wininit .exe.
5:27
S…
Speaker 2 (2026-04-13 02-17-34)
You should only normally see one instance of this process
5:32
S…
Speaker 2 (2026-04-13 02-17-34)
running, and again,
5:33
S…
Speaker 2 (2026-04-13 02-17-34)
usually not going to see a parent process on this.
5:38
S…
Speaker 2 (2026-04-13 02-17-34)
Then you have the service control manager.
5:41
S…
Speaker 2 (2026-04-13 02-17-34)
Basically,
5:42
S…
Speaker 2 (2026-04-13 02-17-34)
this is in charge of loading the services that have
5:46
S…
Speaker 2 (2026-04-13 02-17-34)
been defined in the registry on that system.
5:49
S…
Speaker 2 (2026-04-13 02-17-34)
It is the services .exe file.
5:52
S…
Speaker 1 (2026-04-13 02-17-34)
Again,
5:53
S…
Speaker 2 (2026-04-13 02-17-34)
you should see normally only one instance running of
5:57
S…
Speaker 1 (2026-04-13 02-17-34)
this process,
5:58
S…
Speaker 2 (2026-04-13 02-17-34)
and its parent process will actually be wininit
6:02
S…
Speaker 1 (2026-04-13 02-17-34)
.exe.
6:03
S…
Speaker 1 (2026-04-13 02-17-34)
So keep that in mind.
6:04
S…
Speaker 2 (2026-04-13 02-17-34)
If you see a services .exe running that does not have
6:08
S…
Speaker 2 (2026-04-13 02-17-34)
wininit .exe as the process that spawned it,
6:12
S…
Speaker 2 (2026-04-13 02-17-34)
it's something to look further into.
6:15
S…
Speaker 2 (2026-04-13 02-17-34)
It may be malicious in nature.
6:18
S…
Speaker 1 (2026-04-13 02-17-34)
Some more processes,
6:20
S…
Speaker 1 (2026-04-13 02-17-34)
and this is a big one that is very commonly abused and attacked
6:24
S…
Speaker 1 (2026-04-13 02-17-34)
by attackers.
6:25
S…
Speaker 2 (2026-04-13 02-17-34)
The Local Security Authority Subsystem,
6:28
S…
Speaker 2 (2026-04-13 02-17-34)
or LSASS .exe,
6:31
S…
Speaker 2 (2026-04-13 02-17-34)
very commonly just called LSAS.
6:33
S…
Speaker 2 (2026-04-13 02-17-34)
This is in charge of user authentication,
6:37
S…
Speaker 2 (2026-04-13 02-17-34)
access token generation.
6:39
S…
Speaker 2 (2026-04-13 02-17-34)
It's the process that writes to the security event log.
6:43
S…
Speaker 2 (2026-04-13 02-17-34)
you should see one instance of this process running,
6:47
S…
Speaker 1 (2026-04-13 02-17-34)
only one,
6:48
S…
Speaker 2 (2026-04-13 02-17-34)
and its parent process is wininit
6:52
S…
Speaker 1 (2026-04-13 02-17-34)
.exe.
6:53
S…
Speaker 2 (2026-04-13 02-17-34)
Now, I mentioned this process is very commonly attacked.
6:57
S…
Speaker 2 (2026-04-13 02-17-34)
Attackers will target this process and use it to try
7:01
S…
Speaker 2 (2026-04-13 02-17-34)
and dump the password hashes to get
7:06
S…
Speaker 2 (2026-04-13 02-17-34)
access to those and try to crack those password hashes on
7:10
S…
Speaker 1 (2026-04-13 02-17-34)
a system.
7:11
S…
Speaker 2 (2026-04-13 02-17-34)
You'll also very commonly see this one imitated with different
7:15
S…
Speaker 1 (2026-04-13 02-17-34)
names,
7:16
S…
Speaker 2 (2026-04-13 02-17-34)
either with,
7:17
S…
Speaker 1 (2026-04-13 02-17-34)
you know,
7:18
S…
Speaker 2 (2026-04-13 02-17-34)
the S and an A transposed or one
7:22
S…
Speaker 2 (2026-04-13 02-17-34)
extra S or something like that.
7:24
S…
Speaker 2 (2026-04-13 02-17-34)
So this is one definitely to keep an eye on.
7:26
S…
Speaker 2 (2026-04-13 02-17-34)
It is very commonly abused and attacked.
7:29
S…
Speaker 2 (2026-04-13 02-17-34)
You also have the generic service host process,
7:33
S…
Speaker 2 (2026-04-13 02-17-34)
which is svchost .exe.
7:36
S…
Speaker 1 (2026-04-13 02-17-34)
Normally,
7:37
S…
Speaker 2 (2026-04-13 02-17-34)
you're going to see a lot of these running.
7:39
S…
Speaker 1 (2026-04-13 02-17-34)
This will be multiple instances of this,
7:42
S…
Speaker 2 (2026-04-13 02-17-34)
and the parent process for these should be services .exe.
7:47
S…
Speaker 2 (2026-04-13 02-17-34)
This one also can be commonly abused to launch
7:51
S…
Speaker 2 (2026-04-13 02-17-34)
malware because it is in charge.
7:53
S…
Speaker 2 (2026-04-13 02-17-34)
It's basically in charge of loading processes that run from
7:57
S…
Speaker 1 (2026-04-13 02-17-34)
executables.
7:58
S…
Speaker 2 (2026-04-13 02-17-34)
So this one can be used to launch malware as well.
8:02
S…
Speaker 2 (2026-04-13 02-17-34)
So keep an eye on what this process may be
8:06
S…
Speaker 1 (2026-04-13 02-17-34)
launching.
8:07
S…
Speaker 2 (2026-04-13 02-17-34)
Then you have just the generic host process,
8:11
S…
Speaker 2 (2026-04-13 02-17-34)
which is taskhostw .exe.
8:14
S…
Speaker 2 (2026-04-13 02-17-34)
Now on older versions of Windows,
8:17
S…
Speaker 2 (2026-04-13 02-17-34)
the W was not present in this process file
8:21
S…
Speaker 2 (2026-04-13 02-17-34)
name. It was just taskhost .exe.
8:24
S…
Speaker 2 (2026-04-13 02-17-34)
I don't remember exactly which version of Windows this started changing,
8:28
S…
Speaker 2 (2026-04-13 02-17-34)
but all modern versions of Windows that are running
8:32
S…
Speaker 1 (2026-04-13 02-17-34)
these days should have the W at the end.
8:35
S…
Speaker 2 (2026-04-13 02-17-34)
So it'll be taskhostw .exe.
8:38
S…
Speaker 2 (2026-04-13 02-17-34)
Where your svchost .exe
8:43
S…
Speaker 2 (2026-04-13 02-17-34)
was in charge of loading processes that run from executables,
8:46
S…
Speaker 2 (2026-04-13 02-17-34)
your taskhost is in charge of loading processes
8:50
S…
Speaker 1 (2026-04-13 02-17-34)
that run from DLLs.
8:53
S…
Speaker 2 (2026-04-13 02-17-34)
And again, its parent process should be services .exe
8:57
S…
Speaker 1 (2026-04-13 02-17-34)
as well.
8:58
S…
Speaker 1 (2026-04-13 02-17-34)
And then you have Windows Explorer.
9:01
S…
Speaker 2 (2026-04-13 02-17-34)
This is the one out of this list that is not running
9:05
S…
Speaker 2 (2026-04-13 02-17-34)
out of the System32 folder.
9:08
S…
Speaker 1 (2026-04-13 02-17-34)
Windows Explorer,
9:09
S…
Speaker 2 (2026-04-13 02-17-34)
it's responsible for the user's desktop,
9:11
S…
Speaker 2 (2026-04-13 02-17-34)
adding access to files,
9:14
S…
Speaker 2 (2026-04-13 02-17-34)
things like that.
9:15
S…
Speaker 2 (2026-04-13 02-17-34)
A lot of times you'll see this appearing possibly with no parent
9:19
S…
Speaker 2 (2026-04-13 02-17-34)
process, but you should only see one instance of
9:23
S…
Speaker 2 (2026-04-13 02-17-34)
this running.
9:24
S…
Speaker 2 (2026-04-13 02-17-34)
Now, I mentioned that a lot of these processes will
9:29
S…
Speaker 2 (2026-04-13 02-17-34)
typically run from your Windows folder or your System32 folder,
9:33
S…
Speaker 2 (2026-04-13 02-17-34)
things like that.
9:34
S…
Speaker 2 (2026-04-13 02-17-34)
Your core Windows processes should never run
9:39
S…
Speaker 2 (2026-04-13 02-17-34)
from locations like temp folders or the recycle
9:44
S…
Speaker 2 (2026-04-13 02-17-34)
bin or any other kind of suspicious locations like
9:48
S…
Speaker 2 (2026-04-13 02-17-34)
that. They should always be running from the Windows root folder,
9:52
S…
Speaker 2 (2026-04-13 02-17-34)
Windows or Windows System 32.
9:54
S…
Speaker 2 (2026-04-13 02-17-34)
If you see them running from other locations,
9:56
S…
Speaker 2 (2026-04-13 02-17-34)
that's a red flag.
9:58
S…
Speaker 1 (2026-04-13 02-17-34)
Also,
9:59
S…
Speaker 2 (2026-04-13 02-17-34)
your core system processes should never be communicating
10:03
S…
Speaker 2 (2026-04-13 02-17-34)
with outbound IPs.
10:06
S…
Speaker 2 (2026-04-13 02-17-34)
If you see any process that is imitating or
10:10
S…
Speaker 2 (2026-04-13 02-17-34)
looks to be a core system process that's communicating
10:14
S…
Speaker 2 (2026-04-13 02-17-34)
with an IP address,
10:15
S…
Speaker 2 (2026-04-13 02-17-34)
an outside IP address,
10:17
S…
Speaker 2 (2026-04-13 02-17-34)
chances are it is malicious.
10:20
S…
Speaker 2 (2026-04-13 02-17-34)
And that's one location where Sysmon events come
10:24
S…
Speaker 1 (2026-04-13 02-17-34)
in as well.
10:25
S…
Speaker 2 (2026-04-13 02-17-34)
And we'll get into how to identify those with those event
10:29
S…
Speaker 2 (2026-04-13 02-17-34)
IDs and how to look at network communication with Sysmon and things like
10:33
S…
Speaker 2 (2026-04-13 02-17-34)
that as we continue going through this course.
10:36
S…
Speaker 2 (2026-04-13 02-17-34)
But the key to remember here is the locations from where these processes
10:40
S…
Speaker 1 (2026-04-13 02-17-34)
are running.
10:41
S…
Speaker 2 (2026-04-13 02-17-34)
Should be the system 32 or the Windows folders,
10:45
S…
Speaker 2 (2026-04-13 02-17-34)
depending on the process.
10:47
S…
Speaker 2 (2026-04-13 02-17-34)
Not locations like temp folders,
10:49
S…
Speaker 1 (2026-04-13 02-17-34)
not the recycle bin,
10:50
S…
Speaker 2 (2026-04-13 02-17-34)
not download locations,
10:51
S…
Speaker 2 (2026-04-13 02-17-34)
not from a user's folder.
10:53
S…
Speaker 2 (2026-04-13 02-17-34)
No locations like that.
10:56
S…
Speaker 2 (2026-04-13 02-17-34)
So there's a few different ways to be able to just generically recognize
11:01
S…
Speaker 2 (2026-04-13 02-17-34)
some of your more malicious processes.
11:04
S…
Speaker 1 (2026-04-13 02-17-34)
So for example,
11:05
S…
Speaker 2 (2026-04-13 02-17-34)
if you have any process that launches a
11:09
S…
Speaker 2 (2026-04-13 02-17-34)
child process of either cmd .exe or
11:14
S…
Speaker 2 (2026-04-13 02-17-34)
wscript .exe or powershell .exe,
11:18
S…
Speaker 2 (2026-04-13 02-17-34)
any process that launches a child process of any of those
11:23
S…
Speaker 1 (2026-04-13 02-17-34)
three,
11:23
S…
Speaker 2 (2026-04-13 02-17-34)
Chances are it's going to be malicious in nature.
11:27
S…
Speaker 1 (2026-04-13 02-17-34)
Now, of course,
11:28
S…
Speaker 2 (2026-04-13 02-17-34)
there's maybe some exceptions there.
11:30
S…
Speaker 2 (2026-04-13 02-17-34)
These are just guidelines.
11:31
S…
Speaker 2 (2026-04-13 02-17-34)
But that is definitely something you want to look at.
11:34
S…
Speaker 2 (2026-04-13 02-17-34)
So if you have something like wininit .exe that launched PowerShell
11:39
S…
Speaker 2 (2026-04-13 02-17-34)
or lsas .exe that launched command .exe,
11:43
S…
Speaker 2 (2026-04-13 02-17-34)
that is something that you would want to investigate further
11:47
S…
Speaker 1 (2026-04-13 02-17-34)
as well.
11:49
S…
Speaker 2 (2026-04-13 02-17-34)
Then you have a couple of event IDs associated with Sysmon
11:53
S…
Speaker 2 (2026-04-13 02-17-34)
that can be used to help hunt your Windows processes
11:57
S…
Speaker 1 (2026-04-13 02-17-34)
as well.
11:58
S…
Speaker 1 (2026-04-13 02-17-34)
Number one is,
11:59
S…
Speaker 1 (2026-04-13 02-17-34)
well, number one,
12:00
S…
Speaker 2 (2026-04-13 02-17-34)
Sysmon event ID one.
12:03
S…
Speaker 2 (2026-04-13 02-17-34)
This is for process creation.
12:05
S…
Speaker 2 (2026-04-13 02-17-34)
This will contain information about newly created
12:09
S…
Speaker 1 (2026-04-13 02-17-34)
processes on a system,
12:11
S…
Speaker 2 (2026-04-13 02-17-34)
including the full command line that was used to launch the process
12:15
S…
Speaker 2 (2026-04-13 02-17-34)
and where the process is launching from.
12:18
S…
Speaker 2 (2026-04-13 02-17-34)
and the file hash of the file that was launched.
12:22
S…
Speaker 2 (2026-04-13 02-17-34)
So that's another good way to be able to compare it against known
12:26
S…
Speaker 2 (2026-04-13 02-17-34)
good Windows system process.
12:29
S…
Speaker 2 (2026-04-13 02-17-34)
You have the hashes for those.
12:31
S…
Speaker 1 (2026-04-13 02-17-34)
If it doesn't match,
12:33
S…
Speaker 2 (2026-04-13 02-17-34)
requires additional investigation.
12:35
S…
Speaker 2 (2026-04-13 02-17-34)
Then you have event ID 10.
12:38
S…
Speaker 2 (2026-04-13 02-17-34)
Again, also Sysmon.
12:40
S…
Speaker 2 (2026-04-13 02-17-34)
This is for process access.
12:42
S…
Speaker 2 (2026-04-13 02-17-34)
This event ID will report on when a process opens
12:47
S…
Speaker 2 (2026-04-13 02-17-34)
another process.
12:49
S…
Speaker 1 (2026-04-13 02-17-34)
Normally,
12:50
S…
Speaker 2 (2026-04-13 02-17-34)
that kind of activity is going to be followed by reading and writing,
12:53
S…
Speaker 1 (2026-04-13 02-17-34)
or one of the two,
12:54
S…
Speaker 2 (2026-04-13 02-17-34)
reading or writing the address space of that target
12:59
S…
Speaker 2 (2026-04-13 02-17-34)
process.
13:00
S…
Speaker 2 (2026-04-13 02-17-34)
This is a common technique that attackers will use to
13:04
S…
Speaker 2 (2026-04-13 02-17-34)
steal credentials to be used later in past the hash attacks.
13:09
S…
Speaker 2 (2026-04-13 02-17-34)
So two event IDs associated with Sysmon that are very
13:13
S…
Speaker 2 (2026-04-13 02-17-34)
useful when you're doing any sort of endpoint threat hunting and
13:18
S…
Speaker 2 (2026-04-13 02-17-34)
looking at what processes or processes
13:22
S…
Speaker 2 (2026-04-13 02-17-34)
that claim to be Windows system processes.
આ ટ્રાન્સક્રિપ્ટ AI (આપોઆપ બોલવાની ઓળખ) દ્દારા બનાવેલ છે. ભૂલો સમાવી શકે છે - મહત્વપૂર્ણ વપરાશ માટે મૂળભૂત ઓડિયો સામે ચકાસો. AI નીતિ
સાર
આ ટ્રાન્સક્રિપ્ટના AI સારને ઉત્પન્ન કરવા માટે સારાંશ પર ક્લિક કરો.
સારાંશ કરી રહ્યા છીએ...
આ ટ્રાન્સક્રિપ્ટ વિશે AI ને પૂછો
આ ટ્રાન્સક્રિપ્ટ વિશે કંઈપણ પૂછો - AI સંબંધિત વિભાગો શોધશે અને જવાબ આપશે.