【应急响应】Windows应急响应操作手册

查看表征异常

系统卡慢、宕机、CPU和内存占用高、网络拥塞或断网、磁盘空余空间无理由大幅度缩小等，根据以上表征，可以初步猜测系统面临的问题。

windows 下查看系统基本信息

PS C:\Users\bobac\Desktop> systeminfo

windows 下查看CPU和内存消耗

根据下图可以进行倒序排列

或者使用命令

PS C:\Users\bobac\Desktop> tasklist /V > 1.txt

windows 下查看网络通信情况

入侵点异常排查

看连接

PS C:\Users\bobac\Desktop> netstat -abo | findstr TCP
  TCP    0.0.0.0:135            WIN-8JQH4CQEJIR:0      LISTENING       708
  TCP    0.0.0.0:445            WIN-8JQH4CQEJIR:0      LISTENING       4
  TCP    0.0.0.0:49152          WIN-8JQH4CQEJIR:0      LISTENING       376
  TCP    0.0.0.0:49153          WIN-8JQH4CQEJIR:0      LISTENING       760
  TCP    0.0.0.0:49154          WIN-8JQH4CQEJIR:0      LISTENING       884
  TCP    0.0.0.0:49155          WIN-8JQH4CQEJIR:0      LISTENING       484
  TCP    0.0.0.0:49156          WIN-8JQH4CQEJIR:0      LISTENING       1716
  TCP    0.0.0.0:49157          WIN-8JQH4CQEJIR:0      LISTENING       492
  TCP    172.16.204.128:139     WIN-8JQH4CQEJIR:0      LISTENING       4
  TCP    [::]:135               WIN-8JQH4CQEJIR:0      LISTENING       708
  TCP    [::]:445               WIN-8JQH4CQEJIR:0      LISTENING       4
  TCP    [::]:49152             WIN-8JQH4CQEJIR:0      LISTENING       376
  TCP    [::]:49153             WIN-8JQH4CQEJIR:0      LISTENING       760
  TCP    [::]:49154             WIN-8JQH4CQEJIR:0      LISTENING       884
  TCP    [::]:49155             WIN-8JQH4CQEJIR:0      LISTENING       484
  TCP    [::]:49156             WIN-8JQH4CQEJIR:0      LISTENING       1716
  TCP    [::]:49157             WIN-8JQH4CQEJIR:0      LISTENING       492
PS C:\Users\bobac\Desktop>

看进程

PS C:\Users\bobac\Desktop> tasklist | findstr 1716
svchost.exe                   1716 Services                   0     18,232 K
PS C:\Users\bobac\Desktop>

看服务

PS C:\Users\bobac\Desktop> tasklist /SVC

映像名称                       PID 服务
========================= ======== ============================================
System Idle Process              0 暂缺
System                           4 暂缺
smss.exe                       244 暂缺
csrss.exe                      324 暂缺
wininit.exe                    376 暂缺
services.exe                   484 暂缺
lsass.exe                      492 SamSs
lsm.exe                        500 暂缺
svchost.exe                    600 DcomLaunch, PlugPlay, Power
vmacthlp.exe                   668 VMware Physical Disk Helper Service
svchost.exe                    708 RpcEptMapper, RpcSs
svchost.exe                    760 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc
svchost.exe                    852 AudioEndpointBuilder, CscService, Netman,
                                   PcaSvc, TrkWks, UxSms
svchost.exe                    884 Appinfo, Browser, gpsvc, IKEEXT, iphlpsvc,
                                   LanmanServer, ProfSvc, Schedule, SENS,
                                   ShellHWDetection, Themes, Winmgmt, wuauserv
svchost.exe                    272 EventSystem, netprofm, nsi, sppuinotify,
                                   WdiServiceHost
svchost.exe                    496 CryptSvc, Dnscache, LanmanWorkstation,
                                   NlaSvc
spoolsv.exe                   1144 Spooler
svchost.exe                   1172 BFE, DPS, MpsSvc
VGAuthService.exe             1332 VGAuthService
vmtoolsd.exe                  1392 VMTools
svchost.exe                   1668 bthserv
svchost.exe                   1716 PolicyAgent
TPAutoConnSvc.exe             1808 TPAutoConnSvc
dllhost.exe                   1988 COMSysApp
msdtc.exe                     1212 MSDTC
WmiPrvSE.exe                  1064 暂缺
SearchIndexer.exe             2888 WSearch
svchost.exe                   2896 FontCache
sppsvc.exe                    1868 sppsvc
ManagementAgentHost.exe       2492 VMwareCAFManagementAgentHost
svchost.exe                    904 WinDefend
csrss.exe                     3656 暂缺
winlogon.exe                  3668 暂缺
taskhost.exe                  2708 暂缺
dwm.exe                       3844 暂缺
explorer.exe                  3836 暂缺
TPAutoConnect.exe             3212 暂缺
conhost.exe                   3980 暂缺
vmtoolsd.exe                  2500 暂缺
cmd.exe                       2744 暂缺
conhost.exe                   2768 暂缺
PCHunter64.exe                1068 暂缺
taskmgr.exe                   1352 暂缺
powershell.exe                3360 暂缺
conhost.exe                   2640 暂缺
notepad.exe                   2652 暂缺
tasklist.exe                  3356 暂缺
PS C:\Users\bobac\Desktop>

看动态链接库

C:\Windows\system32>tasklist /M > 2.txt

看日志

进程日志和登录日志

路径 C:\Windows\System32\winevt\Logs

登录日志

系统日志

服务日志或WEB日志

请配置syslog，WEB日志也是文件，可以使用自动化分析工具

看注册表

查看启动项和计划任务

看账户

看防火墙配置