{"id":247,"date":"2023-06-26T22:03:51","date_gmt":"2023-06-26T22:03:51","guid":{"rendered":"https:\/\/justatrainingblog.co.uk\/?p=247"},"modified":"2023-06-26T22:03:51","modified_gmt":"2023-06-26T22:03:51","slug":"windows-system-processes-what-they-are-and-detecting-malicious-intrusion-or-fakes","status":"publish","type":"post","link":"https:\/\/justatrainingblog.co.uk\/?p=247","title":{"rendered":"Windows System Processes – what they are and detecting malicious intrusion or fakes"},"content":{"rendered":"\n

I’m currently learning the ‘Core Windows Processes’ module on TryHackMe and a topic which stuck out to me is the detection and eradication of Malicious Windows Processes. For the examples used in this article I have used Process Hacker<\/a>.<\/p>\n\n\n\n

What is a malicious Windows process?<\/span><\/h2>\n\n\n\n

Commonly deployed as part of a root kit which compromises the kernel a malicious system process is a background process which can exploit it’s abused system privilege in a number of says such as acting as a APT, C&C, ransomware or providing a ledge for lateral movement.<\/p>\n\n\n\n

System.exe<\/span><\/h2>\n\n\n\n

The System thread is unique which runs in the kernel. This process primarily handles threads that run in system and Kernel NT memory. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

While there are lot of variables here we need to be able to determine if these processes are real or fake. Some ways we can determine this are as follows: <\/p>\n\n\n\n

    \n
  1. System Idle Process (0) is the only possible parent<\/li>\n\n\n\n
  2. Multiple instances of the ‘System’ process<\/li>\n\n\n\n
  3. PID different from 4<\/li>\n\n\n\n
  4. Not running in Session 0 <\/li>\n<\/ol>\n\n\n\n

    smss.exe<\/span><\/h2>\n\n\n\n

    smss.exe is short for the Session Manager Subsystem. It is alternatively known as the Windows Session Manager and is responsible for the creation and management of new sessions. <\/p>\n\n\n\n

    This is a user-mode<\/a> process and starts the follow up processes winlogon.exe and csrss.exe. It runs a number of functions including: <\/p>\n\n\n\n