Security Ripcord

I have taken some time to write an incident response script using only the resources provided by the Windows operating system.  You can find out the why by reading the article I wrote titled Windows Incident Response With Only System Resources or the how by reviewing the code I wrote.  UPDATE: I broke the link when I did a bug fix.  So, this link may break in the future, please refer to the complete article for the most recent version.

I hope that some of you find this useful and that this centralizes a lot of the information necessary to understand the abilities inherent to the Windows operating system.  It is nothing ground breaking.  Just a few things that can be done if you do not have or are not allowed to obtain and use the number of very useful tools that are available online or through a vendor.

Go forth and do good things,

Don C. Weber

wmi, wmic, vbscript, Security Ripcord, incident response

Darknet has pointed out that there is a new rash of malicious programs out there that are extorting money from computer end-users. I know that this is not necessarily new news but all the same it really ticks me off that there are people out there who are willing to resort to this type of behavior. I guess this is one of the reasons that I have chosen to become a security professional. I really wish that I could find a team that was actively targeting these individuals so that I could be of some type of assistance and we could get them arrested and put up on charges. Of course the far reaching tendrils of the Internet make these malicious programmers almost untouchable. Too bad.

For a really great resource that you can use to help educate your end users look to the SANS Stay Sharp program. There are courses for all levels of computer users and new courses are being added all of the time. Take some time and have a look at the course descriptions. Specifically, you may want to send some of your people to the Stay Sharp: Computer and Network Security Awareness. If you cannot get a SANS certified professional to teach this course for you then just contact SANS and I am sure they would be willing to help.

Good luck out there and stay aware,

Cutaway