Find what the red team left behind. Situational awareness for Windows defenders.
This page is dual-purpose. Red team operators use it to understand what defenders will see. Blue team defenders use it to hunt intruders. The same command reveals both perspectives — what matters is who runs it first.
Every command is copy-paste ready. Each section includes a blue team use case, a red team counter-thought, and a live example from authorized lab testing.
What happened: A routine netstat -ano scan revealed a python.exe process listening on 0.0.0.0:5000 and 0.0.0.0:8667. This was the operator's own C2 script (c2_web.py --no-adb), proving that defensive recon catches real backdoors.
PS C:\Users\Ghaleb Jomma> netstat -ano | findstr "LISTENING" TCP 0.0.0.0:5000 0.0.0.0:0 LISTENING 13628 TCP 0.0.0.0:8667 0.0.0.0:0 LISTENING 13628 PS C:\Users\Ghaleb Jomma> tasklist /fi "pid eq 13628" Image Name PID Session Name Session# Mem Usage ========================= ======== ================ =========== ============ python.exe 13628 Console 2 7,476 K PS C:\Users\Ghaleb Jomma> Get-CimInstance Win32_Process -Filter "ProcessId = 13628" | Select-Object CommandLine | Format-List CommandLine : "C:\Users\Ghaleb Jomma\scoop\apps\python\current\python.exe" c2_web.py --no-adb PS C:\Users\Ghaleb Jomma> Get-CimInstance Win32_Process -Filter "ProcessId = 13628" | Select-Object CreationDate CreationDate ------------ 27/06/2026 11:40:03 PM PS C:\Users\Ghaleb Jomma> taskkill /pid 13628 /f SUCCESS: The process with PID 13628 has been terminated.
What this proves: A single netstat command found an unauthorized listener. The follow-up chain — PID → process name → command line → creation time → kill — is the exact workflow defenders need. This is why situational awareness wins.
Mentor says: "Real attacks are carried remotely. If you can't see the network, you can't see the attack."
Before you hunt, know what account you're running as, what privileges you have, and what machine you're on. This baseline prevents false assumptions.
BLUE TEAM RED TEAM# Current user and privileges whoami /all whoami /priv whoami /user # Environment variables $env:USERNAME; $env:USERDOMAIN; $env:COMPUTERNAME; $env:USERPROFILE # OS and system info systeminfo | findstr /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Domain" /C:"Boot Time" /C:"Hotfix" # One-liner baseline whoami /all && systeminfo | findstr /C:"OS" /C:"Domain" /C:"Boot" && ipconfig /all && net localgroup administrators
whoami /priv shows what you can escalate with. If you see SeImpersonatePrivilege, a Potato attack may be possible. If you see SeDebugPrivilege, you can dump LSASS.
The network never lies. Listening ports, established connections, and routing tables reveal persistence, C2, and lateral movement.
BLUE TEAM RED TEAM# Public IP powershell -c "(Invoke-WebRequest -UseBasicParsing https://api.ipify.org).Content" # All network config ipconfig /all # Routing table route print # DNS cache (recent lookups) ipconfig /displaydns | findstr "Record Name"
# Classic netstat
netstat -ano | findstr "LISTENING"
# PowerShell equivalent with process names
Get-NetTCPConnection | Where-Object State -eq Listen | Select-Object LocalAddress, LocalPort, OwningProcess, @{Name="ProcessName";Expression={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} | Format-Table -AutoSize
# Established connections to external hosts
Get-NetTCPConnection -State Established | Where-Object { $_.RemoteAddress -ne '127.0.0.1' -and $_.RemoteAddress -ne '::1' } | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess, @{Name="ProcessName";Expression={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} | Format-Table -AutoSize
Python, PowerShell, or cmd.exe listening on any port. Unknown services on high ports. Processes listening on 0.0.0.0 from user profiles.
TeamViewer, AnyDesk, ScreenConnect, Chrome Remote Desktop. Legitimate tools used as RATs. Check ownership and context.
Repeated connections to uncommon IPs. DNS queries to DGA-like domains. Heavy outbound traffic from non-browser processes.
Browser traffic to Google, Microsoft, CDN edges. Dropbox, OneDrive, Discord, Spotify. Correlate with installed software.
Processes reveal execution. The goal is not just to list them, but to find the odd one out — wrong parent, wrong path, wrong time.
BLUE TEAM RED TEAM# Top CPU consumers
Get-Process | Sort-Object CPU -Descending | Select-Object -First 20 Name, Id, Path, Company
# Detailed tasklist
tasklist /v /fo table
# Process with command line
Get-CimInstance Win32_Process | Select-Object Name, ProcessId, CommandLine | Where-Object { $_.CommandLine -ne $null } | Format-Table -AutoSize
# Find process by PID and kill
Get-Process -Id 13628 | Select-Object Name, Path, StartTime
Get-CimInstance Win32_Process -Filter "ProcessId = 13628" | Select-Object CommandLine, CreationDate
Stop-Process -Id 13628 -Force
# or
taskkill /pid 13628 /f
# Show process tree
Get-CimInstance Win32_Process | Select-Object Name, ProcessId, ParentProcessId | Sort-Object ParentProcessId, ProcessId | Format-Table -AutoSize
# Find suspicious parents (e.g., Word spawning PowerShell)
Get-CimInstance Win32_Process | Where-Object { $_.Name -match "powershell|cmd|wscript|cscript|mshta" } | Select-Object Name, ProcessId, ParentProcessId, @{Name="ParentName";Expression={(Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue).Name}}, CommandLine | Format-Table -AutoSize
Attackers need to survive reboots. They add users, modify services, and schedule tasks. These commands find the hooks.
BLUE TEAM RED TEAM# Local users net user Get-LocalUser | Select-Object Name, Enabled, LastLogon, SID # Admin group members net localgroup administrators Get-LocalGroupMember -Group "Administrators" # RDP users net localgroup "Remote Desktop Users" Get-LocalGroupMember -Group "Remote Desktop Users"
# Running services
Get-Service | Where-Object Status -eq Running | Select-Object Name, DisplayName, StartType
# Services with non-standard paths or unsigned binaries
Get-CimInstance Win32_Service | Where-Object { $_.PathName -notmatch "^\"?C:\\(Windows|Program Files)" } | Select-Object Name, StartMode, State, PathName
# List all scheduled tasks
schtasks /query /fo LIST /v
# Find tasks running scripts
schtasks /query /fo LIST /v | Select-String -Pattern "\.ps1|\.bat|\.vbs|\.cmd"
# PowerShell view
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft\*" } | Select-Object TaskName, TaskPath, Author, Date, State
# Common persistence locations Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-Object Shell, Userinit
Know what protects the machine. If it's disabled, missing, or excluded, that's either an attack or a dangerous misconfiguration.
BLUE TEAM RED TEAM# Installed security products
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName, pathToSignedProductExe, productState
# Windows Defender status
Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled, AntivirusEnabled, NISEnabled, SignatureUpdateDateTime
# Defender preferences and exclusions
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension
# Recent threats
Get-MpThreat | Sort-Object LastDetectedTime -Descending
Get-MpThreatDetection | Sort-Object InitialDetectionTime -Descending | Select-Object -First 10 ThreatName, Resources, InitialDetectionTime
# Find security product services
Get-Service | Where-Object { $_.DisplayName -match 'defender|crowd|sentinel|carbon|amp|fireeye|kaspersky|symantec|mcafee|trend|eset|sophos|avast|avg|bitdefender' }
$env:APPDATA or .exe extensions) are often signs of compromise or deliberate weakening. Red teams hunt for these first.
Credentials, scripts, and payloads hide in predictable places. Quick scans of high-value directories catch lazy attackers.
BLUE TEAM RED TEAM# Drives and filesystem Get-PSDrive -PSProvider FileSystem # Desktop and Downloads Get-ChildItem "$env:USERPROFILE\Desktop" -File | Select-Object Name, Length, LastWriteTime Get-ChildItem "$env:USERPROFILE\Downloads" -File -ErrorAction SilentlyContinue # AppData for scripts, configs, credentials Get-ChildItem "$env:APPDATA" -Recurse -File -ErrorAction SilentlyContinue | Where-Object Name -match '\.rdp|\.kdbx|\.xml|\.ini|\.config|\.txt|\.ps1|\.bat|\.vbs' # LocalAppData for credential artifacts Get-ChildItem "$env:LOCALAPPDATA" -Recurse -File -ErrorAction SilentlyContinue | Where-Object Name -match 'pass|cred|key|token|secret' # Recently created executables in user profile Get-ChildItem "$env:USERPROFILE" -Recurse -Include *.exe -ErrorAction SilentlyContinue | Where-Object CreationTime -gt (Get-Date).AddDays(-7) | Select-Object FullName, CreationTime, Length # PowerShell history (often contains credentials or commands) Get-History Get-Content (Get-PSReadlineOption).HistorySavePath -ErrorAction SilentlyContinue -Tail 80
Remove-Item (Get-PSReadlineOption).HistorySavePath -Force.
Defenders often miss vectors that don't look like malware. These are the sneaky ones.
Suspicious .htm, .html, .zip attachments in Downloads. Browser downloads from unknown domains. Outlook rules forwarding email externally.
Autorun.inf files, LNK files pointing to powershell, suspicious executables on USB drives. Check SetupAPI logs for device insertions.
Malicious Chrome/Edge extensions with excessive permissions. Check extension folders in %LOCALAPPDATA%.
LSASS access, SAM/SECURITY hives copied, Kerberos tickets exported. Monitor for Mimikatz-style access patterns.
Unknown WiFi profiles, Bluetooth pairings, rogue access points. Check netsh wlan show profiles.
OneDrive, Dropbox, Google Drive used for exfiltration. Large or unusual file uploads outside business hours.
TeamViewer, AnyDesk, ScreenConnect, Splashtop, Chrome Remote Desktop. Check for unauthorized installations.
Legitimate executables loading DLLs from unusual paths. Check DLLs in application directories.
# WiFi profiles (could be rogue AP or stolen credentials) netsh wlan show profiles # Recent USB devices Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*" | Select-Object FriendlyName, DeviceDesc # Browser extensions (Chrome example) Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Extensions" -Recurse -Directory -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime # Startup folder Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" Get-ChildItem "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" # Recent files Get-ChildItem "$env:APPDATA\Microsoft\Windows\Recent" | Select-Object Name, LastWriteTime -First 20
Every defensive command is also an offensive recon command. The difference is timing and intent.
# Red team: Run these after landing to understand the environment whoami /priv net user net localgroup administrators Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess Get-NetTCPConnection | Where-Object State -eq Listen Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Cross-links:
Mentor says: "Privilege escalation is easy. Real attacks are carried remotely. Save every rung. Eventually all comes to networking." This page is the networking-aware defender's starting point.