windows installed software risto - sans technology … · gold, gpen, gcfa, gsec, gcpm) sans...
TRANSCRIPT
![Page 1: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/1.jpg)
1SANS Technology Institute - Candidate for Master of Science Degree 1
How to inventory Windows installed software
Jonathan RistoDecember 2016
GIAC (GAWN Gold, GCIH Gold, GSLC Gold, GLEG Gold, GWAPT Gold, GCCC Gold, GSNA
Gold, GPEN, GCFA, GSEC, GCPM)
![Page 2: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/2.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 2
Objective
• Importance of a software inventory• Why is this such a problem to collect• Where is this information stored• Methods to collect the information• Scripting for speed and accuracy• Conclusion
![Page 3: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/3.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 3
Control 2 of the 20 Critical Controls
• The second item of the 20 CSC is software inventory
• Without a software inventory– Cannot know vulnerabilities– Cannot keep systems updated– Cannot validate authorized software
![Page 4: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/4.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 4
Where can we find it?
• Windows does not have just one location to register an installed program
• Example registry key locations include:– 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Uninstall\'– 'HKLM\SOFTWARE\Wow6432Node\Microsoft\Wind
ows\CurrentVersion\Uninstall\'• No single query can return the required
information
![Page 5: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/5.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 5
Collection problems
![Page 6: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/6.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 6
Available tools for collection
• Commercial tools– E.g. Tripwire, Software Inspector,
Nessus• Free tools
– E.g. OCS inventory, PsInfo• Built-in tools
– E.g. WMIC, PowerShell
![Page 7: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/7.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 7
PsInfo
• PsInfo is a Microsoft Sysinternals tool that can collect local or remote system information
• Version 1.77 used in paper• Run from command line
psinfo.exe -s applications
![Page 8: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/8.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 8
PsInfo output example
![Page 9: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/9.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 9
WMIC
• Windows Management Instrumentation Command-line
• Permits access to query and change system functionality
• To collect inventory informationwmic product get name,version
![Page 10: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/10.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 10
WMIC example
![Page 11: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/11.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 11
WMIC output issues
![Page 12: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/12.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 12
PowerShell
• Uses the OpenSubKey and GetValue cmdlets within PowerShell
• Accesses the following registry locations and iterates through each subkey– SOFTWARE\Microsoft\Windows\CurrentVers
ion\Uninstall\ ,– SOFTWARE\Wow6432Node\Microsoft\Wind
ows\CurrentVersion\Uninstall\
![Page 13: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/13.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 13
Scripting it all together
• Running commands on individual systems is tedious at best– Summer student project J
• However, scripts provide a quicker means to accomplish the tasks
• Two primary methods to create Windows scripts– Batch scripting– PowerShell
![Page 14: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/14.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 14
Scripts within the paper
• Scripts examples include:– Batch file for PsInfo and WMIC collection– PowerShell script for PS commands
• All query for IP address to inventory• Some checking is performed for valid
data types and entry• Output stored in text file for archiving
and future reference
![Page 15: Windows Installed Software Risto - Sans Technology … · Gold, GPEN, GCFA, GSEC, GCPM) SANS Technology Institute - Candidate for Master of Science Degree 2 Objective ... Windows_Installed_Software_Risto](https://reader031.vdocuments.mx/reader031/viewer/2022022606/5b81b2927f8b9a2b6f8cdd58/html5/thumbnails/15.jpg)
SANS Technology Institute - Candidate for Master of Science Degree 15
Conclusion
• 3 methods discussed in paper– Scripts provided automate the process
• Increases visibility and understanding of the network
• Major first step to remediation