Installed Programs¶
A work machine should have the software needed for its work. Everything else is a policy violation, a security risk, or both. Hacking tools are the first thing to look for, because they mean either an attacker was here or a user was doing something they shouldn't.
List them¶
Settings → Apps → Installed apps, or appwiz.cpl, or:
Get-Package | Select Name, Version, ProviderName | Sort Name
Go down the list. For each program: does the README, or the machine's obvious job, give a reason for it? If not, uninstall.
Names to recognize on sight¶
| Type | Examples |
|---|---|
| Password cracking | Cain & Abel, John the Ripper, Hashcat, Ophcrack, L0phtCrack, Mimikatz |
| Scanning and sniffing | Nmap, Zenmap, Wireshark, Angry IP Scanner, Advanced IP Scanner, Ettercap, tcpdump |
| Remote access | TeamViewer, AnyDesk, VNC servers (TightVNC, UltraVNC, RealVNC), netcat, ncat, Ammyy |
| Exploitation | Metasploit, Armitage, Burp Suite, sqlmap |
| Keyloggers and spyware | Anything with "keylog," "spy," or "monitor" in the name |
| Peer-to-peer | uTorrent, BitTorrent, qBittorrent, Deluge, LimeWire, FrostWire |
| Games | Steam, Epic Games, anything under a Games folder |
| Unnecessary | Toolbars, "PC optimizer" and "driver updater" programs, coupon finders |
"Legitimate" doesn't settle it. Network engineers use packet sniffers every day; the same tool on a machine with no reason for it captures passwords. The question is whether this machine has a reason.
Uninstall¶
Settings → Apps → Installed apps → three dots → Uninstall.
winget uninstall "Wireshark"
Or for programs winget doesn't know:
Get-Package -Name "*wireshark*" | Uninstall-Package
Programs that don't show as installed¶
Portable tools don't register. Check the folders where they'd sit:
Get-ChildItem "C:\Program Files", "C:\Program Files (x86)", "C:\ProgramData", "C:\Users\*\AppData\Local", "C:\Users\*\AppData\Roaming", "C:\Users\*\Downloads", "C:\Users\*\Desktop" -Directory -ErrorAction SilentlyContinue | Select FullName
A folder named nmap or cain under a user's AppData is a tool that was dropped there on purpose.
Windows features¶
optionalfeatures (or Turn Windows features on or off). Untick on a workstation: Telnet Client, TFTP Client, SMB 1.0/CIFS File Sharing Support, Internet Information Services, Simple TCPIP services, Internet Explorer 11.
On Server 2022, roles and features replace the optional features dialog, and the README is the list of roles the machine is supposed to have. Everything else installed is attack surface (STIG WN22-00-000270).
Get-WindowsFeature | Where Installed | Select Name, DisplayName
The server STIG names these as never acceptable unless the README requires them (WN22-00-000320 to 000410):
| Feature name | What it is | Why remove it |
|---|---|---|
Fax |
Fax Server role | Unused role with its own service and share |
Web-Ftp-Server |
FTP in IIS | Plain-text logins unless configured carefully; see IIS if the README needs FTP |
PNRP |
Peer Name Resolution Protocol | Peer-to-peer name resolution nobody uses on a server |
Simple-TCPIP |
Simple TCP/IP Services | Echo, discard, chargen: 1980s test services usable for amplification |
Telnet-Client |
Telnet client | Clear-text remote login tool; handy for an attacker already on the box |
TFTP-Client |
TFTP client | Unauthenticated file transfer tool, same reason |
FS-SMB1 |
SMB 1.0 | See SMB |
PowerShell-V2 |
Windows PowerShell 2.0 engine | Bypasses script block logging and AMSI |
Uninstall-WindowsFeature Fax, Web-Ftp-Server, PNRP, Simple-TCPIP, Telnet-Client, TFTP-Client, FS-SMB1, PowerShell-V2
Some of these need a restart to finish. Get-WindowsFeature shows Install Pending or Removed until then.
Verify¶
Re-run Get-Package and confirm the removed programs are gone. Re-check the folders.
Example¶
Installed apps lists Wireshark, uTorrent, and "Driver Booster." The README describes an office workstation. All three go. Then C:\Users\bob\AppData\Local\ has a folder named nc containing nc.exe. Delete it and check what starts it (Malware Persistence).
Try it¶
- Install a harmless program on a practice image, find it with
Get-Package, and remove it withUninstall-Packageor its uninstaller. - Read the installed list on a practice image and sort each entry into README-required, Windows, or unknown.
Build it¶
A script that prints Get-Package names not in an allow file. Start the allow file from a clean install and add the README's software per image.