应急取证window脚本（测试中）

测试发现还是有很多问题，继续改进中，欢迎大家提供建议，小白学习中

::取证应急脚本  v2.0::2018年/5/02del c:\antiy_information.txtdel c:\antiy_executablepath.csvdel c:\antiy_process.htmldel c:\antiy_startup.csvchcp 65001@echo *******************************************>> c:\antiy_information.txt@echo *       Antiy Information Gathering       *>> c:\antiy_information.txt@echo *******************************************>> c:\antiy_information.txt::不显示命令行本身@echo off::获取系统时间echo ************************************   System time     *******************************>>c:\antiy_information.txtdate /t>>c:\antiy_information.txttime /t>>c:\antiy_information.txtecho Get system time  Success!::用户组信息echo ************************************   User Information     *******************************>>c:\antiy_information.txtnet user>>c:\antiy_information.txtecho **************User Group*************************************net localgroup>>c:\antiy_information.txtecho **************localgroup administrators**********************net localgroup administrators>>c:\antiy_information.txt::文件共享信息echo ************************************  File   Share        **********************************>>c:\antiy_information.txtnet share>>c:\antiy_information.txt::获取主机信息echo ************************************   HOST Name      *******************************>>c:\antiy_information.txthostname>>c:\antiy_information.txtecho ************************************   User Name      *******************************>>c:\antiy_information.txtwhoami>>c:\antiy_information.txtecho ************************************   System Version *******************************>>c:\antiy_information.txtver>>c:\antiy_information.txtecho Get system information  Success!::获取进程及对应网络信息echo ********************Get Process Path  And  Net Information***************************>>c:\antiy_information.txtnetstat -bno>>c:\antiy_information.txtecho Get Process Path  And  Net Information   Success!::进程信息获取echo ********************Get Process Information  (taskkill)***************************>>c:\antiy_information.txttasklist>>c:\antiy_information.txtecho Get Process  Information   Success!::网络信息获取echo ********************Get net  config inforemation       ***************************>>c:\antiy_information.txtipconfig>>c:\antiy_information.txtecho Get net config  Information   Success!::网络连接获取echo ********************Get net  connection inforemation       ***************************>>c:\antiy_information.txtnetstat -ano>>c:\antiy_information.txtecho Get net connection  Information   Success!::WMIC  进程路径获取echo ***********************************WMIC  PPROCESS Path*******************************>>c:\antiy_information.txtwmic process list full /format:hform>>c:\antiy_process.html::wmic process list brief /format:hform>>c:\antiy_information.html::wmic process get description,executablepath,CommandLine,ProcessId,ParentProcessId /format:hform>>c:\antiy_information2.csvwmic process get executablepath,ProcessId>>c:\antiy_executablepath.csvecho WMIC  PPROCESS Path  Success!::启动项wmic startup >>c:\antiy_startup.csvecho Get startup inforemation  Success!::计划任务echo ****************************************Task LIST************************************>>c:\antiy_information.txtschtasks /query /FO LIST /V>>c:\antiy_information.txtecho Get tasklist  Success!::服务echo ***********************************Services  LIST************************************>>c:\antiy_information.txttasklist /svc>>c:\antiy_information.txtsc query state=all>>c:\antiy_information.txtecho Get services list  Success!::DNS缓存echo ***********************************DNS  Information************************************>>c:\antiy_information.txtipconfig /displaydns>>c:\antiy_information.txtecho Get DNS Information  Success!echo logs save to  C:\antiy_*.* path.pause

目前发现的几个问题

（1）服务和计划任务过多，容易被正常的淹没
（2）发现的文件没有更多信息，比如最后修改时间

先告一段落。。。。。。有空再更新一次／