Suspicious Services in Windows - Tip #3

Suspicious Services in Windows

Many small/medium companies which don’t have policy, governance, control ..etc. in order to protect their data/services, surely these organizations will suffer from an unstable/insecure environment and in anytime might the whole environment become compromised. Might you have suspicious services are running in your environment but You don't know :). 

There are enterprise solutions might fulfill these requirements to scan such services but if you don't have it you can go ahead and try to play with WMI (Windows Management Instrumentation). Below script will provide all abnormal/suspicious services that are running in the remote desktops and not running in Windows or Program files folder or services are running by different accounts not built-in service logon accounts such localsystem nor networkservice..etc. You can amend on this script based on your requirements.

$Computer = Get-Content "D:\ \ListOfComputers.csv"

Get-WmiObject win32_service -computername $computer| where-object {($_.pathname -notlike "*C:\Windows*" -and $_.PathName -notlike "*C:\Program Files*\*") -or ($_.startname -notlike "*Local*" -and $_.startname -notlike "*NetworkService*")} | Select-object __Server, startname, pathname, name | Sort-object __server, name | Format-table –autosize

You can get list of Computers in specific OU by using below commands :

(Get-ADComputer -Filter * -Searchbase "OU=Computers,DC=ABC,DC=com").Name | Out-File D:\ListOfComputers.txt

Type of built-in Accounts in Windows which running services :

•  Local System (Highest-privilege account on a Windows system)
• Local Service (Minimum privileges on the local computer and allow anonymous credentials)
• Network Service(Used when service require to authenticated with other computers on the network by using the computer's account in the domain )

Note : Services can be run by normal AD account or Managed service accounts and this is the best practices.

Requirements to communicate with remote server via WMI :

• Make suer WMI services is running (Run services.msc and ensure Windows "Management Instrumentation" service Startup Type is set to Automatic)
• WMI will use 135 port then will use a wide range of dynamic ports from 1024 to 65535, follow the below article to set up a fixed port for WMI..

https://docs.microsoft.com/en-us/windows/desktop/WmiSdk/setting-up-a-fixed-port-for-wmi