Tenant Cloud Security Cloud Workload Protection Platform Troubleshooting

Troubleshooting ideas of Windows intrusion issues

Last Updated At: 2025-10-21 09:10:00

This document describes how to troubleshoot Windows intrusion issues.

Analyzing and Identifying the Cause of Intrusion

1. Checking for Accounts and Weak Passwords

  1. Check for weak passwords in the system or application accounts.

    • Description: Check whether system administrator accounts, website backend accounts, database accounts, and other application accounts (such as FTP, Tomcat, and phpMyAdmin) for weak passwords.

      Notes:

      It is recommended to set a complex password that is 12 to 16 characters in length and includes uppercase and lowercase letters, digits, and special characters. You may also use a password generator to automatically generate complex passwords.

    • Method: Check the passwords manually based on the actual environment.

    • Risk level: High.

  2. Check for accounts that are not created by the system or legal users.
    • Description: Hackers often create abnormal accounts, which are typically visible in the local user group list.
    • Method: First, open the Command Prompt (CMD) and enter the command lusrmgr.msc. Then, check for new accounts, especially those in the Administrator group. If such accounts are found, disable or delete them immediately.
    • Risk level: High.
  3. Check for hidden account names.
    • Description: To avoid detection, hackers may create hidden accounts that are not visible in the local user list.
    • Method: (You can also use the LP_Check security tool to identify hidden accounts.)
      a. Open the Run dialog box on the desktop (you can use the shortcut keys Win + R to open it), enter regedit, and you can open the registry editor.
      b. Select HKEY_LOCAL_MACHINE/SAM/SAM. By default, you cannot view the content of this option. Right-click the menu and select Permissions to open the Permission Management window.
      c. Select the current user (usually Administrator), check Full Control under permissions, click OK, and then close the Registry Editor.
      d. Open the Registry Editor again and select HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users.
      e. Under Names, you can see all the usernames of the instance. If there is an account that does not exist in the local account, it is a hidden account. After it is confirmed as a non-system user, you can delete this user.
    • Risk level: High.

2. Checking for Malicious Processes and Ports

  1. Check whether malicious processes are running in the backend.
    • Description: After gaining access, attackers often run malicious processes to communicate externally. By analyzing outbound connections, you can identify the control process used in the intrusion.
    • Method:
      a. Log in to the server and select Start > Run.
      b. Enter cmd, then enter netstat –nao and check whether there are any unauthorized ports being listened on the server.
      c. Open the Task Manager and check whether the process corresponding to the PID process number is a normal one. For example, you can check the path of the running file through the PID number and delete the corresponding path file. You can also use the Process Explorer tool provided by Microsoft for troubleshooting.
    • Risk level: High.

3. Checking for Malicious Programs and Startup Items

  1. Check for abnormal startup items in the system.

    • Description: After compromising a system, attackers often configure malicious programs in the startup configuration for automatic startup.
    • Method:
      a. Log in to the server and select Start> All Programs >Start.
      b. By default, this directory is an empty one. Check whether there are any non-business programs in this directory.
      c. Select Start > Run, enter msconfig, check whether there are any startup items with exception names. If so, untick the startup items with exception names and delete the files in the path displayed in the command.
      d. Select Start > Run, enter regedit, open Registry,and check if startup items are normal. Pay special attention to the following three Registry entries:
      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
      Check if there are any abnormal startup items on the right side of the Registry. If so, please delete them and consider installing antivirus software for a virus scan to clear out any cruft, viruses, or Trojans.
    • Risk level: High.

  2. Check active sessions.

    • Description: Check sessions or scheduled tasks between the server and other servers on the network.
    • Method:
      a. Log in to the server and select Start > Run.
      b. Enter cmd, then enter netstat -ano, check the session between the server and other servers on the network, and confirm whether it is a normal connection. Enter schtasks to check the scheduled tasks on the server and confirm whether they are normal scheduled tasks.
    • Risk level: Medium.

4. Checking for Vulnerabilities in Third-Party Software

  1. If your server hosts publicly accessible applications, such as World Wide Web (WWW) and File Transfer Protocol (FTP), configure the software to restrict its permissions, and disable directory browsing and file write access where not required.
  2. Enable WAF for protection and check its attack logs.

FAQs

How Can I Recover a Website or System After It Has Been Compromised?

After a system is confirmed to have been intruded, the system files are often changed and replaced. At this point, the system has become untrustworthy. The best method is to reinstall the system and install all patches for the new system at the same time.

How Can I Prevent the System or Website from Being Compromised Again?

  1. Change all system account passwords to complex passwords and ensure they differ from pre-compromise passwords.
  2. Perform the following operations to modify the default remote desktop port:
    1. Go to Start > Running and enter regedit.
    2. Open the registry, and enter the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp.
    3. KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Tenninal Server\WinStations\RDP-Tcp
    4. Modify the PortNumber value on the right.
  3. Configure your security group firewall to allow remote desktop access only from specified IP addresses.
  4. Regularly back up important workload data and files.
  5. Regularly update the operating system and application components, such as FTP servers and Struts2, to avoid exploitation through known vulnerabilities.
  6. Install a CWP agent and antivirus software to perform regular system health checks and malware scans.