While preparing for the CCNA Cyber Ops SECFND exam, you learned that a process is a program that the system is running. Each process provides the required resources to execute a program. A process is made up of one or more threads, which are the basic unit an operating system allocates process time to.
A thread can be executed during any part of the application runtime, including being executed by another thread. Each process starts with a single thread, known as the primary thread, but can also create additional threads from any of its threads.
Processes can be grouped together and managed as a unit. This is called a job object and can be used to control attributes of the processes they are
associated with. Grouping processes together simplifies impacting a group of processes because any operation performed on a specific job object will impact all associated processes. A thread pool is a group of worker threads that efficiently execute asynchronous callbacks for the application. This is done to reduce the number of application threads and to manage the worker threads. A fiber is a unit of execution that is manually scheduled by an application. Threads can schedule multiple fibers; however, fibers do not outperform properly designed multithreaded applications.
It is important to understand how these components all work together when developing applications and later securing them. There are many threats to applications (known as vulnerabilities) that could be abused to change the intended outcome of an application. This is why it is critical to include security in all stages of developing applications to ensure these and other application components are not abused.
Windows services are long running executable applications that run in their own Windows session. Basically, they are services that run in the background.
Services can automatically kick on when a computer boots up. Services are ideal for running things within a user security context, starting applications that should always be run for a specific user, and long running functionally that doesn’t interface with other users who are working on the same computer. An example would be the desire to have an application that monitors if the storage is consumed past a certain threshold. The programmer would create a
Windows service application that monitors storage space and set it to automatically start at boot, so it is continuously monitoring for the critical condition. If the user chooses not to monitor their system, they could open the services windows and change the Startup type to manual, meaning it must be manually turned on or they could just stop the service. The services inside the service control manager can be started, stopped, or triggered by an event.
Because services operate in their own user account, they can operate when a user is not logged in to the system, meaning the monitor storage space
application example could be set to automatically run for a specific user or for any users including when there isn’t a user logged in.
Windows administrators can manage services using services snap-in, Sc.exe, or Windows PowerShell. The services snap-in is built in with the services management console and can connect to a local or remote computer on a network enabling the administrator to perform some of the following actions.
View installed services
Start, stop, or restart services
Change the startup type for a service
Specify service parameters when available Change the startup type
Change the user account context where the service operates Configure recovery actions in the event a service fails Inspect service dependencies for troubleshooting Export the list of services
The Sc.exe, also known as the Service Control utility, is a command-line version of the services snap-in. This means it can do everything the services snap-in can do, as well as install and uninstall services. Windows PowerShell can also manage Windows services using the following commands, also called cmdlets:
Get-Service: Gets the services on a local or remote computer New-Service: Creates a new Windows service
Restart-Service: Stops and then starts one or more services
Resume-Service: Resumes one or more suspended (paused) services Set-Service: Starts, stops, and suspends a service and changes its
properties
Start-Service: Starts one or more stopped services Stop-Service: Stops one or more running services
Suspend-Service: Suspends (pauses) one or more running services.
Other tools that can manage Windows services are Net.exe, Windows Task Manager, and MSConfig; however, their capabilities are limited compared to the other tools mentioned. For example, MSConfig can enable or disable Windows services while Windows Task manager can show a list of installed services as well as start or stop them.
Like other aspects of Windows, services are targeted by attackers. Windows has improved securing services in later versions of the operating system after finding various attack methods compromising and completely owning older versions of Windows. Windows, however, is not perfect, so best practice dictates securing services such as disabling the following services unless they are needed:
TCP 53: DNS Zone Transfer TCP 135: RPC Endpoint Mapper TCP 139: NetBIOS Session Service TCP 445: SMB Over TCP
TCP 3389: Terminal Services UDP 137: NetBIOS Name Service
UDP 161: Simple Network Management Protocol
TCP/UDP 389: Lightweight Directory Access Protocol
In addition, you should enable host security solutions such as the Windows Firewall filters services from outsiders. Enforcing least privilege access, using restricted tokens, and access control can reduce the damages that could occur if an attacker successfully compromised a Windows system’s services.
Basically applying best practices to secure hosts and your network will also apply to reducing the risk of attacks against Microsoft Windows system services.
The list that follows highlights the key concepts concerning processes and threads:
A process is a program that the system is running and is made of one or
more threads.
A thread is a basic unit an operating system allocates process time to.
A job is a group of processes.
A thread pool is a group of worker threads that efficiently execute asynchronous callbacks for the application.
Microsoft Windows services are long running executable applications that run in their own Windows session
Services are ideal for running things within a user security context, starting applications that should always be run for a specific user, and long running functionally that doesn’t interface with other users who are working on the same computer
Windows administrators can manage services using Services snap-in, Sc.exe, or Windows PowerShell
When performing forensics investigations in Windows or any other operating system, you should look for orphan and suspicious processes and services on the system. Malware could create processes running in your system.