Instructions.md

19 September 2026 Windows windows · powershell · security

Run these checks from PowerShell. They only read system information; none of them remove files, change settings, or start a scan.

For the Defender, scheduled-task, firewall, and protected-process sections, open PowerShell as Administrator. Do not paste credentials into a script.

1. Snapshot active processes

Get-Process |
  Sort-Object ProcessName |
  Select-Object ProcessName, Id, CPU, WorkingSet64 |
  Format-Table -AutoSize

Get-Process |
  Sort-Object WorkingSet64 -Descending |
  Select-Object -First 20 ProcessName, Id,
    @{Name='MemoryMiB';Expression={[math]::Round($_.WorkingSet64 / 1MB,1)}} |
  Format-Table -AutoSize

For a process that deserves closer inspection, replace PROCESS_NAME below. Check its path and Authenticode signature before deciding it is unsafe.

$p = Get-Process -Name PROCESS_NAME -ErrorAction Stop | Select-Object -First 1
$p | Select-Object ProcessName, Id, Path, Company, Product, FileVersion, StartTime | Format-List

if ($p.Path) {
  Get-AuthenticodeSignature -LiteralPath $p.Path |
    Select-Object Status, @{Name='Signer';Expression={$_.SignerCertificate.Subject}} |
    Format-List
}

Path unavailable is normal for some protected services; it is not itself a malware finding.

2. Inspect autostart entries

$runRoots = @(
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)

foreach ($root in $runRoots) {
  if (Test-Path $root) {
    Get-ItemProperty $root | ForEach-Object {
      $_.PSObject.Properties |
        Where-Object Name -notmatch '^PS' |
        ForEach-Object { [pscustomobject]@{ Location=$root; Name=$_.Name; Command=[string]$_.Value } }
    }
  }
} | Sort-Object Location, Name | Format-List

Inspect startup shortcuts and their real targets:

$shell = New-Object -ComObject WScript.Shell
$folders = @(
  "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
  "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"
)

foreach ($folder in $folders) {
  Get-ChildItem -LiteralPath $folder -Filter '*.lnk' -ErrorAction SilentlyContinue |
    ForEach-Object {
      $link = $shell.CreateShortcut($_.FullName)
      [pscustomobject]@{
        Shortcut = $_.FullName
        Target = $link.TargetPath
        Arguments = $link.Arguments
        WorkingDirectory = $link.WorkingDirectory
      }
    }
} | Format-List

Treat entries pointing into Temp, a random AppData folder, an unknown network share, or an unrecognised script as high priority. Do not delete them until the target has been identified and any important data backed up.

3. Check services and drivers

List running services and inspect one service’s executable path:

Get-Service | Where-Object Status -eq 'Running' |
  Sort-Object DisplayName |
  Select-Object Status, StartType, Name, DisplayName |
  Format-Table -AutoSize

sc.exe qc SERVICE_NAME

Find auto-start services whose image paths are outside Windows system folders:

Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services' |
  ForEach-Object {
    $item = Get-ItemProperty $_.PSPath
    if ($item.Start -in 0,1,2 -and $item.ImagePath) {
      [pscustomobject]@{
        Name = $_.PSChildName
        Start = $item.Start
        ImagePath = [string]$item.ImagePath
        Account = [string]$item.ObjectName
      }
    }
  } |
  Where-Object { $_.ImagePath -notmatch '(?i)\\Windows\\System32\\svchost|\\Windows\\system32\\|\\Windows\\System32\\drivers\\' } |
  Sort-Object Name |
  Format-List

Known drivers and services for GPU, audio, Windows Defender, WSL, databases, and input devices are common. Focus on an unrecognised service executable in a user-writable directory or a name that has no corresponding installed program.

4. Check accounts, shares, and remote access

Get-LocalUser |
  Select-Object Name, Enabled, LastLogon, PasswordLastSet, PrincipalSource |
  Format-Table -AutoSize

Get-LocalGroupMember -SID 'S-1-5-32-544' |
  Select-Object Name, ObjectClass, PrincipalSource |
  Format-Table -AutoSize

net share
quser
Get-Service -Name TermService,WinRM,RemoteRegistry,sshd -ErrorAction SilentlyContinue |
  Select-Object Status, StartType, Name, DisplayName |
  Format-Table -AutoSize

To see whether Remote Desktop is enabled, fDenyTSConnections : 1 means it is disabled.

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' |
  Select-Object fDenyTSConnections

Unknown enabled accounts—especially administrators—or unexpected file shares deserve investigation. An inactive standard account is less urgent but should be disabled or removed if it is no longer needed.

5. Check network redirection and persistence mechanisms

netsh winhttp show proxy
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' |
  Select-Object ProxyEnable, ProxyServer, AutoConfigURL

Get-Content 'C:\Windows\System32\drivers\etc\hosts' |
  Where-Object { $_ -notmatch '^\s*(#|$)' }

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' |
  Select-Object Shell, Userinit, Taskman, AppSetup

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows' |
  Select-Object AppInit_DLLs, LoadAppInit_DLLs, RequireSignedAppInit_DLLs

Expected Winlogon values are Shell = explorer.exe and Userinit = C:\Windows\system32\userinit.exe,. AppInit should normally be empty with LoadAppInit_DLLs = 0.

Inspect Image File Execution Options overrides, which are sometimes used for debugging but can also be abused for persistence:

$root = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'
Get-ChildItem $root | ForEach-Object {
  $item = Get-ItemProperty $_.PSPath
  if ($item.Debugger -or $item.VerifierDlls -or $item.GlobalFlag) {
    [pscustomobject]@{
      Image = $_.PSChildName
      Debugger = $item.Debugger
      VerifierDlls = $item.VerifierDlls
      GlobalFlag = $item.GlobalFlag
    }
  }
} | Format-List

Do not remove an override until you have confirmed that its related application is gone or that the setting is not deliberately used for debugging.

6. Review Defender protection and retained detections (Administrator)

Get-MpComputerStatus |
  Select-Object AMServiceEnabled, AntivirusEnabled, AntispywareEnabled,
    BehaviorMonitorEnabled, IoavProtectionEnabled, IsTamperProtected,
    NISEnabled, OnAccessProtectionEnabled, RealTimeProtectionEnabled,
    QuickScanAge, FullScanAge, AntivirusSignatureLastUpdated,
    NISSignatureLastUpdated, AntivirusSignatureVersion |
  Format-List

Get-MpPreference |
  Select-Object DisableBehaviorMonitoring, DisableIOAVProtection,
    DisableRealtimeMonitoring, DisableScriptScanning, PUAProtection,
    ExclusionPath, ExclusionProcess, ExclusionExtension |
  Format-List

Review detection history without changing it:

function Get-DefenderField([string]$text,[string]$name) {
  $match = [regex]::Match($text,"(?m)^\s*$name\s*:\s*(.+)$")
  if ($match.Success) { $match.Groups[1].Value.Trim() }
}

Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-Windows Defender/Operational'
  Id = 1116
} | Select-Object -First 40 | ForEach-Object {
  [pscustomobject]@{
    Time = $_.TimeCreated
    Threat = Get-DefenderField $_.Message 'Name'
    Severity = Get-DefenderField $_.Message 'Schweregrad'
    Path = Get-DefenderField $_.Message 'Pfad'
    Source = Get-DefenderField $_.Message 'Erkennungsquelle'
  }
} | Format-List

An Event ID 1116 is a detection; the following Event ID 1117 records Defender’s remediation action. A successful quarantine is evidence that Defender acted, not proof that every related historical copy or installer has been removed. See Microsoft’s event reference.

7. Check scheduled tasks (Administrator)

Get-ScheduledTask |
  Where-Object { $_.TaskPath -notlike '\Microsoft\*' -and $_.State -ne 'Disabled' } |
  ForEach-Object {
    [pscustomobject]@{
      Task = $_.TaskPath + $_.TaskName
      State = $_.State
      Actions = (($_.Actions | ForEach-Object { ($_.Execute + ' ' + $_.Arguments).Trim() }) -join ' | ')
    }
  } |
  Sort-Object Task |
  Format-List

Investigate tasks that run scripts from AppData or Temp, or use powershell -enc, mshta, wscript, cscript, or unrecognised rundll32 commands.

8. Browser extensions and policies

Review extension manifests rather than browser history. For Brave, each extension’s manifest.json is normally under:

%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Default\Extensions\<extension-id>\<version>\manifest.json

Check the extension name, version, permissions, and update_url. Also inspect forced-install policies:

Get-ChildItem 'HKLM:\SOFTWARE\Policies\BraveSoftware\Brave' -Recurse -ErrorAction SilentlyContinue |
  ForEach-Object { Get-ItemProperty $_.PSPath } |
  Format-List

Get-ChildItem 'HKCU:\SOFTWARE\Policies\BraveSoftware\Brave' -Recurse -ErrorAction SilentlyContinue |
  ForEach-Object { Get-ItemProperty $_.PSPath } |
  Format-List

If another account owns the browser profile, run this section from that account or with an administrator account that has read access. Do not copy browser databases, cookies, or saved passwords.

9. Hash an untrusted executable

Use only a hash lookup; do not upload personal files or wallets to a third-party scanner.

$file = 'C:\path\to\suspicious.exe'
Get-FileHash -LiteralPath $file -Algorithm SHA256
Get-AuthenticodeSignature -LiteralPath $file |
  Select-Object Status, @{Name='Signer';Expression={$_.SignerCertificate.Subject}}

Search the resulting SHA-256 in a reputable reputation service. A missing result is inconclusive; a valid signature confirms the publisher identity but does not make an unwanted program necessary or safe to keep.

10. Decision rules

Keep Windows, hardware-driver, and security processes unless there is specific evidence of tampering.
Prefer uninstalling an unneeded remote-access tool, miner, database server, VPN, or peripheral utility through Installed apps rather than deleting its executable.
Back up wallets, databases, and files before removing anything.
Disable or remove old local accounts only after confirming they are not used for a share, backup, or scheduled task.
If Defender reports a password dumper, a malicious script, or an unknown remote-access tool, treat that as a reason for an administrator review and an offline scan—even if a previous full scan completed months earlier.