Installed Programs¶
A work machine should have the software needed for its work. Everything else is a policy violation, a security risk, or both. Hacking tools are the first thing to look for, because they mean either an attacker was here or a user was doing something they shouldn't.
List them¶
Settings → Apps → Installed apps, or appwiz.cpl, or:
Get-Package | Select Name, Version, ProviderName | Sort Name
Go down the list. For each program: does the README, or the machine's obvious job, give a reason for it? If not, uninstall.
Names to recognize on sight¶
| Type | Examples |
|---|---|
| Password cracking | Cain & Abel, John the Ripper, Hashcat, Ophcrack, L0phtCrack, Mimikatz |
| Scanning and sniffing | Nmap, Zenmap, Wireshark, Angry IP Scanner, Advanced IP Scanner, Ettercap, tcpdump |
| Remote access | TeamViewer, AnyDesk, VNC servers (TightVNC, UltraVNC, RealVNC), netcat, ncat, Ammyy |
| Exploitation | Metasploit, Armitage, Burp Suite, sqlmap |
| Keyloggers and spyware | Anything with "keylog," "spy," or "monitor" in the name |
| Peer-to-peer | uTorrent, BitTorrent, qBittorrent, Deluge, LimeWire, FrostWire |
| Games | Steam, Epic Games, anything under a Games folder |
| Unnecessary | Toolbars, "PC optimizer" and "driver updater" programs, coupon finders |
"Legitimate" doesn't settle it. Network engineers use packet sniffers every day; the same tool on a machine with no reason for it captures passwords. The question is whether this machine has a reason.
Uninstall¶
Settings → Apps → Installed apps → three dots → Uninstall.
winget uninstall "Wireshark"
Or for programs winget doesn't know:
Get-Package -Name "*wireshark*" | Uninstall-Package
Programs that don't show as installed¶
Portable tools don't register. Check the folders where they'd sit:
Get-ChildItem "C:\Program Files", "C:\Program Files (x86)", "C:\ProgramData", "C:\Users\*\AppData\Local", "C:\Users\*\AppData\Roaming", "C:\Users\*\Downloads", "C:\Users\*\Desktop" -Directory -ErrorAction SilentlyContinue | Select FullName
A folder named nmap or cain under a user's AppData is a tool that was dropped there on purpose.
Windows features¶
optionalfeatures (or Turn Windows features on or off). Untick on a workstation: Telnet Client, TFTP Client, SMB 1.0/CIFS File Sharing Support, Internet Information Services, Simple TCPIP services, Internet Explorer 11.
On Server 2022, Get-WindowsFeature | Where Installed lists installed roles and features. Remove any the README doesn't call for with Uninstall-WindowsFeature.
Verify¶
Re-run Get-Package and confirm the removed programs are gone. Re-check the folders.
Example¶
Installed apps lists Wireshark, uTorrent, and "Driver Booster." The README describes an office workstation. All three go. Then C:\Users\bob\AppData\Local\ has a folder named nc containing nc.exe. Delete it and check what starts it (Malware Persistence).