0xoscp-companion
← Back to search

Running Processes and File Hunting

enumerationwindowschecklist

Summary

Also review Event Viewer for script block logging events and check default PowerShell transcripts.

Walkthrough

List running processes, then hunt the filesystem for sensitive files (KeePass databases, configs, and user documents).

Commands

powershell

Get-Process

Hunt for KeePass DBs, xampp files, and user documents

powershell

Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\dave\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue