cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Mister_Nobody
Honored Sweeper

I have created report to check processes with hacker's or admin's tools

 

 

Select Distinct Top 1000000 tblAssets.AssetID,
  tblAssets.AssetUnique,
  tblAssets.Domain,
  tblAssets.Username,
  tblADusers.Displayname,
  tblADusers.Department,
  tblADusers.Title,
  tblADusers.Company,
  tblProcesses.ExecutablePath,
  tblProcesses.Caption,
  tblProcesses.Lastchanged
From tblAssets
  Inner Join tblProcesses On tblAssets.AssetID = tblProcesses.AssetID And
      Lower(tblProcesses.Caption) In ('adexplorer.exe', 'psexec',
      'tasklist.exe', 'hostname.exe', 'systeminfo.exe', 'ver.exe',
      'ipconfig.exe', 'netstat.exe', 'ping.exe', 'nslookup.exe', 'nltest.exe',
      'net.exe', 'net1.exe', 'reg.exe', 'schtasks.exe', 'at.exe', 'query.exe',
      'wscript.exe', 'cscript.exe', 'qwinsta.exe', 'quser.exe', 'netsh.exe',
      'wmic.exe', 'mshta.exe', 'curl.exe', 'certutil.exe', 'sc.exe',
      'powershell.exe', 'procdump.exe', 'ngrok.exe')
  Left Join tblADusers On tblADusers.Username = tblAssets.Username And
      tblADusers.Userdomain = tblAssets.Domain
Order By tblAssets.AssetID

 

 

It can help detect some types of attacks.

2 REPLIES 2
brandon_jones
Champion Sweeper III

Under scanning go to scanned items wait time and enable process scanning. Beware that this can cause your database to grow in size.

rader
Champion Sweeper III

Interesting. Any requirements to setup for the report?

New to Lansweeper?

Try Lansweeper For Free

Experience Lansweeper with your own data.
Sign up now for a 14-day free trial.

Try Now