Applications
في هذه الصفحة
Applications answers: what software is installed - and which of it is a tunnelling, proxyware, mining or file sharing tool?
At a glance
Question | What software is installed? |
Reads | The uninstall keys of the machine and every user, Windows Installer, every user's Store packages, and Windows Installer's records in the Application log. |
Rule prefix |
|
What it reads
Installed applications (
installed_app), merged per product and account from every place Windows lists them: name, publisher, version, folder, install date, for whom.Installations and removals (
app_install_event): Windows Installer's 1033 and 1034, with the account that ran them.
Every application is listed for stacking across the fleet. Remote access tools are the RemoteAccess module's.
Signals it raises
4 rules: 3 medium, 1 low. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| medium | Cryptocurrency mining software |
|
|
| medium | A proxy server or an interception proxy |
| - |
| medium | Proxyware or bandwidth-sharing software |
|
|
| low | Peer-to-peer file sharing or synchronisation software |
| - |
How to read it
A capability is not its use. The watchlist rules are medium or low: a proxy server installed is not proof of misuse. Look for its use in the other modules.
In period: with a profile window, the table marks what was installed after the window's start.
Install dates are days, as Windows records them - never a precise time.
What it can't see
Next
Backup: can the host be recovered?