应急响应 - 通过PowerShell来识别可疑的DLL服务

$DebugPreference = "Continue"
$services = (Get-WmiObject Win32_Service -EnableAllPrivileges)
foreach ($srv in $services)
{
    $sd = ($srv.GetSecurityDescriptor())
    if ($sd.ReturnValue -ne 0)
    {
        Write-Debug ("Service: "+$srv.name+"`tError "+$sd.ReturnValue) -ErrorAction SilentlyContinue
        continue
    }

    $SDDL = ([wmiclass]"win32_SecurityDescriptorHelper").Win32SDtoSDDL($sd.Descriptor).SDDL
    foreach ($ACE in $sddl.split("()"))
    {
        if ($ACE.Split(";")[0] -ne "A")
        {
            continue #as we have non "allow something" ACE
        }
    
        # we should have set of permissions in the $ACE.Split(";")[2] 
        # and the security principal (user/group/etc) in the $ACE.Split(";")[5]
        
        if ( ($ACE.Split(";")[2]).Contains("WD") -or ($ACE.Split(";")[2]).Contains("WO") -or ($ACE.Split(";")[2]).Contains("DC") )
        {
            if ( (($ACE.Split(";")[5]) -eq "BA") -or (($ACE.Split(";")[5]) -eq "SY"))# we do not care about local administrators and localsystem as they should have such permissions
            {
                continue
            }
            $PrincipalName = ($ACE.Split(";")[5])
            if ($PrincipalName.StartsWith("S-1-5-"))
            {
                $SID = New-Object System.Security.Principal.SecurityIdentifier(($ACE.Split(";")[5]))
                $PrincipalName = $SID.Translate([System.Security.Principal.NTAccount]).Value
            }
            Write-Host $srv.Name - $ACE.Split(";")[2] - $ACE.Split(";")[5] - $PrincipalName
        } 
    }
}