# situational-awareweness

#### Windows Network Information

```powershell
# IP configuration
ipconfig /all

# ARP table
arp -a

# Routing table
route print
```

#### Windows Protections Enumeration

```powershell
# Windows Defender status
Get-MpComputerStatus

# AppLocker policy (effective)
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

# AppLocker policy (local)
Get-AppLockerPolicy -Local | select -ExpandProperty RuleCollections

# Test AppLocker policy
Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyone
```

#### General Enumeration

```powershell
# Running processes (Windows)
tasklist
```

```bash
# Running processes (Linux)
ps aux
```

```powershell
# File system enumeration (Windows)
dir /s C:\
```

```bash
# File system enumeration (Linux)
find / -type f -print
```

## **Key Concepts:**

* **Situational Awareness:** Understanding your environment to make informed decisions.
* **Enumeration:** Gathering information about the target system.
* **Lateral Movement:** Moving from one compromised system to another.
* **Dual-Homed Hosts:** Systems with multiple network interfaces.
* **EDR/Antivirus:** Endpoint Detection and Response and Antivirus software.
* **Application Whitelisting:** Controlling which applications can run. **Importance of Situational Awareness:**
* Effective planning and execution of attacks.
* Identifying additional attack vectors.
* Avoiding detection by security systems.
* Efficient use of time and resources. **Enumeration Techniques:**

1. **Network Information:**     - `ipconfig /all` (Windows): Displays network interface configurations.     - `arp -a` (Windows): Displays the ARP cache.     - `route print` (Windows): Displays the routing table.     - Purpose: Identifies network interfaces, IP addresses, DNS servers, routing paths, and other connected devices.     - Importance: Reveals potential lateral movement opportunities and network architecture.
2. **Enumerating Protections:**     - `Get-MpComputerStatus` (PowerShell): Checks Windows Defender status.     - `Get-AppLockerPolicy` (PowerShell): Enumerates AppLocker policies.     - `Test-AppLockerPolicy` (PowerShell): Tests AppLocker policies.     - Purpose: Identifies antivirus, EDR, and application whitelisting solutions.     - Importance: Helps determine which tools and techniques are likely to be detected or blocked

**Key Enhancements and Considerations:**

* **Linux Equivalents:**     - Mention Linux commands like `ifconfig`, `ip addr`, `arp`, and `route -n` for network information.     - Mention linux tools like `lynis` and `chkrootkit` for enumeration of protections.
* **EDR Evasion:**     - Discuss basic EDR evasion techniques, such as modifying payloads and using obfuscation.     - Emphasize that EDR evasion is a constant cat and mouse game.
* **Active Directory Enumeration:**     - If the target is part of an Active Directory domain, emphasize the importance of enumerating domain controllers and other domain resources.     - Tools like `PowerView` can be used.
* **Process Enumeration:**     - Tasklist (windows) and ps (linux) are also very important to enumerate running processes.
* **File System Enumeration:**     - Enumerating the file system to find sensitive information or misconfigurations is also very important.
* **Log Analysis:**     - Mention the importance of checking system logs for suspicious activity.
* **Real-World Considerations:**     - Stress the importance of adapting enumeration techniques to the specific environment.     - Emphasize the need for thorough testing in a lab environment before using advanced techniques on a client system.
* **Documentation:**     - Stress the importance of documenting all findings during the enumeration process.
* **Threat Intelligence:**     - Using public threat intelligence can help to understand the most common attacks against the target operating system.
