Windows应急排查小脚本

前言:最近好几个应急中毒事件，都不知道这群人上班在干什么。分享一个windows快速排查取证的小脚本。

@echo offmkdir C:ProgramDataquzhengnet user >>C:ProgramDataquzhenguser.txttasklist>>C:ProgramDataquzhengtasklist.txtnetstat -ano>>C:ProgramDataquzhengport.txtSCHTASKS>>C:ProgramDataquzhengrenwujihua.txtsc query>>C:ProgramDataquzhengsercives.txtdir /s /b >> C:ProgramDataquzhengdirs.txtreg query HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionrun /s>>C:ProgramDataquzhengreg.txtreg query HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionrun /s>>C:ProgramDataquzhengreg.txtreg query HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerrun  /s>>C:ProgramDataquzhengreg.txtreg query HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerrun /s>>C:ProgramDataquzhengreg.txtreg query HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices /s >>C:ProgramDataquzhengreg.txtreg query HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServices /s>>C:ProgramDataquzhengreg.txtreg query HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce /s>>C:ProgramDataquzhengreg.txtreg query HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce /s>>C:ProgramDataquzhengreg.txtreg query HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesOnce /s >>C:ProgramDataquzhengreg.txtreg query HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServicesOnce /s>>C:ProgramDataquzhengreg.txtreg query HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsNTCurrentVersionWinlogonUserinit /s>>C:ProgramDataquzhengreg.txtreg query HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun /s>>C:ProgramDataquzhengreg.txtreg query HKEY_CURRENT_USERSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun  /s >>C:ProgramDataquzhengreg.txtwevtutil epl System C:ProgramDataquzhengsystem.evtxwevtutil epl Application C:ProgramDataquzhengApplication.evtxwevtutil epl Security  C:ProgramDataquzhengSecurity.evtxwevtutil epl Windows PowerShell C:ProgramDataquzhengpowershell.evtxwevtutil epl Microsoft-Windows-WMI-Activity/Operational C:ProgramDataquzhengWMI.evtxecho "查鲁特 帅哥" >>C:ProgramDataquzhengxroot_shuaige.txtecho "查鲁特 真帅" >>C:ProgramDataquzhengxroot_shuaige.txtecho "查鲁特 帅到掉渣" >>C:ProgramDataquzhengxroot_shuaige.txt