工具：Windows安全检查SeatBelt

有个Windows的安全检查工具，确实不错，推荐给大家。

它是这样介绍自己的，时间太紧，就自己看吧。

一、下载地址

https://github.com/GhostPack/Seatbelt

我编译好了，放在网盘中。

链接：https://pan.baidu.com/s/1O4ooxQK_iSZtqOnh9j5RdA

提取码：ggo5

Exe在这个目录下，

二、使用方法

1）Seatbelt has the following command groups: All, User, System, Slack, Chrome, Remote, Misc

 格式：You can invoke command groups with "Seatbelt.exe <group>"

   1、 "Seatbelt.exe -group=all" runs all commands

   2、 "Seatbelt.exe -group=user" runs the following commands:

            ChromePresence, CloudCredentials, CredEnum, dir, DpapiMasterKeys,
            ExplorerMRUs, ExplorerRunCommands, FileZilla, FirefoxPresence,
            IdleTime, IEFavorites, IETabs, IEUrls,
            MappedDrives, OfficeMRUs, PowerShellHistory, PuttyHostKeys,
            PuttySessions, RDCManFiles, RDPSavedConnections, SecPackageCreds,
            SlackDownloads, SlackPresence, SlackWorkspaces, SuperPutty,
            TokenGroups, WindowsCredentialFiles, WindowsVault

    3、 "Seatbelt.exe -group=system" runs the following commands:

            AMSIProviders, AntiVirus, AppLocker, ARPTable, AuditPolicies,
            AuditPolicyRegistry, AutoRuns, CredGuard, DNSCache,
            DotNet, EnvironmentPath, EnvironmentVariables, Hotfixes,
            InterestingProcesses, InternetSettings, LAPS, LastShutdown,
            LocalGPOs, LocalGroups, LocalUsers, LogonSessions,
            LSASettings, McAfeeConfigs, NamedPipes, NetworkProfiles,
            NetworkShares, NTLMSettings, OSInfo, PoweredOnEvents,
            PowerShell, Processes, PSSessionSettings, RDPSessions,
            RDPsettings, SCCM, Services, Sysmon,
            TcpConnections, TokenPrivileges, UAC, UdpConnections,
            UserRightAssignments, WindowsAutoLogon, WindowsDefender, WindowsEventForwarding,
            WindowsFirewall, WMIEventConsumer, WMIEventFilter, WMIFilterBinding,
            WSUS

     4、"Seatbelt.exe -group=slack" runs the following commands:

            SlackDownloads, SlackPresence, SlackWorkspaces

     5、"Seatbelt.exe -group=chrome" runs the following commands:

            ChromeBookmarks, ChromeHistory, ChromePresence

     6、"Seatbelt.exe -group=remote" runs the following commands:

            AMSIProviders, AntiVirus, DotNet, ExplorerRunCommands, Hotfixes,
            InterestingProcesses, LastShutdown, LogonSessions, LSASettings,
            MappedDrives, NetworkProfiles, NetworkShares, NTLMSettings,
            PowerShell, ProcessOwners, PuttyHostKeys, PuttySessions,
            RDPSavedConnections, RDPSessions, RDPsettings, Sysmon,
            WindowsDefender, WindowsEventForwarding, WindowsFirewall

       "Seatbelt.exe -group=misc" runs the following commands:

            ChromeBookmarks, ChromeHistory, ExplicitLogonEvents, FileInfo, FirefoxHistory,
            HuntLolbas, InstalledProducts, InterestingFiles, LogonEvents,
            McAfeeSiteList, MicrosoftUpdates, OutlookDownloads, PowerShellEvents,
            Printers, ProcessCreationEvents, ProcessOwners, RecycleBin,
            reg, RPCMappedEndpoints, ScheduledTasks, SearchIndex,
            SecurityPackages, SysmonEvents

2）详细列表如下，

1、整体检查

 the following command will run ALL checks and returns ALL output:

Seatbelt.exe -group=all -full

2、system

Runs checks that mine interesting data about the system.

Executed with: Seatbelt.exe -group=system

3、user

Runs checks that mine interesting data about the currently logged on user (if not elevated) or ALL users (if elevated).

Executed with: Seatbelt.exe -group=user

4、misc

Runs all miscellaneous checks.

Executed with: Seatbelt.exe -group=misc

5、Additional Command Groups

Executed with: Seatbelt.exe -group=GROUPNAME

6、命令行参数

6-1、the following command returns 4624 logon events for the last 30 days:

Seatbelt.exe "LogonEvents 30"

6-2、The following command queries a registry three levels deep, returning only keys/valueNames/values that match the regex .*defini.*, and ignoring any errors that occur.

Seatbelt.exe "reg "HKLMSOFTWAREMicrosoftWindows Defender" 3 .*defini.* true"

6-3、the following command will output the results of system checks to a txt file:

Seatbelt.exe -group=system -outputfile="C:Tempsystem.txt"

7、远程枚举

7-1、To enumerate a remote system, supply -computername=COMPUTER.DOMAIN.COM - an alternate username and password can be specified with -username=DOMAINUSER -password=PASSWORD

7-2、the following command runs remote-focused checks against a remote system:

Seatbelt.exe -group=remote -computername=192.168.230.209 -username=THESHIREsam -password="yum "po-ta-toes""


三、效果

不截长图了，效果很好，确实是利器。

感谢无糖学院导师戴华老师分享。

欢迎关注公众号MicroPest

原文始发于微信公众号（无糖反网络犯罪研究中心）：工具：Windows安全检查SeatBelt