Don’s Windows Incident Response Script

Just had a quick play with Don’s Windows Incident Response Script and am very happy that someone else has put in the time and effort for something as useful as this, and then provided it for all. Some of the useful information it captures includes:

• User Account Information - Account name, Full name, SID, LocalAccount
• System Information - Hostname, manufacturer, OS Type, version, SP etc
• PreFetch File Information (this is AWESOME) - the metadata of about the last 128 programs that were executed
• Installed Software
• Windows Setup Log
• USBSTOR Registry Key
• Windows Firewall Exception List
• Log On and Off Events (if auditing is turned on of course)
• Event Logs
• Temp Internet Information
• Running Processes
• Active Network Connections (ahh netstat)
• Anti-malware logs (dependant on your AV vendor)

So yeah, go check it out.

Posted by Christian 19 April 2008

Post A Comment