-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathwindows_processus_interactive.html
More file actions
756 lines (687 loc) · 48.4 KB
/
Copy pathwindows_processus_interactive.html
File metadata and controls
756 lines (687 loc) · 48.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
<!DOCTYPE html>
<html lang="fr">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Gestion des processus Windows — Guide interactif</title>
<style>
:root{--bg:#f8fafc;--card:#fff;--border:#e2e8f0;--text:#1e293b;--muted:#64748b;--acc:#0067c0;--acc2:#005a9e;--blue600:#2563eb;--green:#16a34a;--red:#dc2626;--orange:#ea580c;--purple:#7c3aed;--grad1:#001a33;--grad2:#00305c}
@media(prefers-color-scheme:dark){:root{--bg:#0d0d0d;--card:#1a1a1a;--border:#2a2a2a;--text:#e2e8f0;--muted:#94a3b8}}
*{box-sizing:border-box;margin:0;padding:0}
body{font-family:'Segoe UI',system-ui,sans-serif;background:var(--bg);color:var(--text);line-height:1.6}
header{background:linear-gradient(135deg,var(--grad1),var(--grad2));padding:2rem 1rem;text-align:center;border-bottom:2px solid var(--acc)}
header h1{font-size:2rem;font-weight:800;color:#fff}
header p{color:#93c5fd;margin-top:.4rem;font-size:.95rem}
nav{position:sticky;top:0;z-index:100;background:var(--card);border-bottom:1px solid var(--border);padding:.5rem 1rem;display:flex;gap:.5rem;flex-wrap:wrap;justify-content:center}
.tab-btn{padding:.4rem 1rem;border:none;border-radius:999px;cursor:pointer;font-size:.85rem;font-weight:600;background:var(--border);color:var(--muted);transition:all .2s}
.tab-btn.active{background:var(--blue600);color:#fff}
.tab-btn:hover:not(.active){background:var(--acc);color:#fff}
section{display:none;max-width:1100px;margin:0 auto;padding:1.5rem 1rem}
section.active{display:block}
h2{font-size:1.4rem;font-weight:700;margin-bottom:1rem;color:var(--acc)}
h3{font-size:1.1rem;font-weight:600;margin:1.2rem 0 .6rem}
.grid{display:grid;gap:1rem}.g2{grid-template-columns:repeat(auto-fit,minmax(280px,1fr))}.g3{grid-template-columns:repeat(auto-fit,minmax(220px,1fr))}
.card{background:var(--card);border:1px solid var(--border);border-radius:.75rem;padding:1.2rem}
.card h4{font-size:1rem;font-weight:700;margin-bottom:.5rem;color:var(--acc)}
.codeblk{background:#1e1e2e;color:#cdd6f4;border-radius:.5rem;padding:1rem;font-family:'Cascadia Code','Fira Code',monospace;font-size:.82rem;overflow-x:auto;margin:.5rem 0;line-height:1.7;white-space:pre-wrap}
.c-kw{color:#89b4fa}.c-str{color:#a6e3a1}.c-comment{color:#6c7086;font-style:italic}.c-val{color:#f9e2af}.c-fn{color:#cba6f7}.c-admin{color:#f38ba8;font-weight:700}
table{width:100%;border-collapse:collapse;font-size:.85rem;margin:.5rem 0}
th{background:var(--acc);color:#fff;padding:.5rem .75rem;text-align:left}
td{padding:.4rem .65rem;border-bottom:1px solid var(--border)}
tr:hover td{background:var(--border)}
.info-box{background:var(--card);border-left:4px solid var(--acc);border-radius:.5rem;padding:.8rem 1rem;margin:.5rem 0}
.info-box.green{border-color:var(--green)}.info-box.red{border-color:var(--red)}.info-box.blue{border-color:var(--blue600)}.info-box.orange{border-color:var(--orange)}.info-box.purple{border-color:var(--purple)}
.badge{display:inline-block;padding:.15rem .55rem;border-radius:999px;font-size:.72rem;font-weight:700;margin-left:.3rem}
.badge-user{background:#dcfce7;color:#15803d}
.badge-admin{background:#fee2e2;color:#b91c1c}
.badge-system{background:#fef3c7;color:#92400e}
@media(prefers-color-scheme:dark){.badge-user{background:#14532d;color:#86efac}.badge-admin{background:#450a0a;color:#fca5a5}.badge-system{background:#451a03;color:#fcd34d}}
.cmd{background:var(--card);border:1px solid var(--border);border-left:4px solid var(--acc);border-radius:.5rem;padding:.7rem .9rem;margin:.5rem 0}
.cmd .name{font-family:'Cascadia Code',monospace;font-weight:700;color:var(--acc);font-size:.95rem}
.cmd .desc{font-size:.85rem;margin-top:.2rem}
.il-row{display:grid;grid-template-columns:80px 1fr 1fr;gap:.5rem;padding:.5rem;background:var(--card);border-radius:.4rem;border-left:4px solid var(--acc);margin:.3rem 0;font-size:.85rem;align-items:center}
.il-row .lt{font-weight:900;font-size:1rem;color:var(--acc);text-align:center}
.quiz-q{background:var(--card);border:1px solid var(--border);border-radius:.75rem;padding:1.2rem;margin:.8rem 0}
.quiz-q p{font-weight:600;margin-bottom:.7rem}
.quiz-opt{padding:.5rem .8rem;border:1px solid var(--border);border-radius:.4rem;margin:.3rem 0;cursor:pointer;transition:all .2s}
.quiz-opt:hover{border-color:var(--acc);background:rgba(0,103,192,.05)}
.quiz-opt.correct{background:#dcfce7;border-color:var(--green);color:#166534}
.quiz-opt.wrong{background:#fee2e2;border-color:var(--red);color:#991b1b}
@media(prefers-color-scheme:dark){.quiz-opt.correct{background:#14532d;color:#86efac}.quiz-opt.wrong{background:#450a0a;color:#fca5a5}}
#quiz-score{display:none;text-align:center;padding:1.5rem;background:var(--card);border-radius:.75rem;margin-top:1rem;font-size:1.1rem;font-weight:700}
</style>
</head>
<body>
<header>
<h1>Gestion des processus — Windows</h1>
<p>Architecture, outils GUI & CLI, services, sécurité, scheduler, traces</p>
</header>
<nav>
<button class="tab-btn active" onclick="showTab('overview')">Vue d'ensemble</button>
<button class="tab-btn" onclick="showTab('arch')">Architecture</button>
<button class="tab-btn" onclick="showTab('user')">Outils utilisateur</button>
<button class="tab-btn" onclick="showTab('admin')">Outils admin</button>
<button class="tab-btn" onclick="showTab('services')">Services</button>
<button class="tab-btn" onclick="showTab('security')">Sécurité & UAC</button>
<button class="tab-btn" onclick="showTab('scheduling')">Priorités & scheduler</button>
<button class="tab-btn" onclick="showTab('traces')">Traces & monitoring</button>
<button class="tab-btn" onclick="showTab('quiz')">Quiz</button>
</nav>
<section id="overview" class="active">
<h2>Vue d'ensemble</h2>
<div class="grid g2">
<div class="card">
<h4>Process / Thread / Handle</h4>
<table>
<tr><th>Concept</th><th>Description</th></tr>
<tr><td><strong>Process</strong></td><td>Conteneur : espace d'adressage, handles, tokens. Identifié par PID</td></tr>
<tr><td><strong>Thread</strong></td><td>Unité d'exécution. Un process ≥ 1 thread. Partagent la mémoire du process</td></tr>
<tr><td><strong>Handle</strong></td><td>Référence opaque vers une ressource (fichier, mutex, registry, autre process…)</td></tr>
<tr><td><strong>Token</strong></td><td>Identifie l'utilisateur, ses groupes, ses privilèges (équivalent du UID Linux + plus)</td></tr>
<tr><td><strong>Job</strong></td><td>Groupe de processus avec contraintes communes (équivalent cgroup Linux)</td></tr>
<tr><td><strong>Session</strong></td><td>Logon Windows. Session 0 = services, session 1+ = utilisateurs interactifs</td></tr>
</table>
</div>
<div class="card">
<h4>Processus système incontournables</h4>
<table>
<tr><th>Process</th><th>Rôle</th></tr>
<tr><td>System (PID 4)</td><td>Kernel + drivers</td></tr>
<tr><td>smss.exe</td><td>Session Manager Subsystem — démarre les sessions</td></tr>
<tr><td>csrss.exe</td><td>Client/Server Runtime Subsystem (Win32)</td></tr>
<tr><td>wininit.exe</td><td>Initialise la session 0</td></tr>
<tr><td>winlogon.exe</td><td>Logon des sessions interactives</td></tr>
<tr><td>services.exe</td><td>Service Control Manager (SCM)</td></tr>
<tr><td>lsass.exe</td><td>Local Security Authority — auth, tokens, secrets</td></tr>
<tr><td>svchost.exe</td><td>Hôte de services Windows (plusieurs instances)</td></tr>
<tr><td>explorer.exe</td><td>Shell utilisateur (Bureau, barre des tâches)</td></tr>
<tr><td>dwm.exe</td><td>Desktop Window Manager (compositing)</td></tr>
</table>
<div class="info-box red" style="margin-top:.4rem;font-size:.82rem">
<strong>Cible attaquant :</strong> lsass.exe stocke les hashes NTLM et tickets Kerberos en mémoire → cible de Mimikatz.
</div>
</div>
</div>
<div class="card" style="margin-top:1rem">
<h4>Différences clés vs Linux</h4>
<table>
<tr><th>Aspect</th><th>Windows</th><th>Linux</th></tr>
<tr><td>Création process</td><td>CreateProcess() — atomique</td><td>fork() + exec()</td></tr>
<tr><td>PID 1</td><td>Pas de "init" unique. System (4) + smss + wininit</td><td>init / systemd</td></tr>
<tr><td>Threads</td><td>Coûteux et lourds (~1 MB stack)</td><td>Très légers (clone(2))</td></tr>
<tr><td>Identité</td><td>Token (SID, privilèges, groupes)</td><td>UID/GID</td></tr>
<tr><td>Privileges</td><td>Granulaires (SeBackupPrivilege, SeDebugPrivilege…)</td><td>Capabilities ou root</td></tr>
<tr><td>Élévation</td><td>UAC (split token, "Run as administrator")</td><td>sudo (passe à root)</td></tr>
<tr><td>Signaux</td><td>Pas de signaux Unix. ExitProcess(), TerminateProcess()</td><td>SIGTERM, SIGKILL, etc.</td></tr>
<tr><td>IPC</td><td>Pipes nommés, mailslots, COM, RPC, sockets</td><td>Pipes, sockets, shm, message queues</td></tr>
</table>
</div>
</section>
<section id="arch">
<h2>Architecture Windows</h2>
<div class="grid g2">
<div class="card">
<h4>Sessions Windows</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Une <strong>session</strong> regroupe le bureau, les processus, et les handles d'un logon. Depuis Vista, isolation forte.</p>
<table>
<tr><th>Session</th><th>Contenu</th></tr>
<tr><td><strong>Session 0</strong></td><td>Services Windows uniquement. Pas de GUI interactive accessible. <strong>Isolation Session 0</strong> (depuis Vista) empêche les services de présenter des dialogues directement.</td></tr>
<tr><td><strong>Session 1, 2, ...</strong></td><td>Sessions utilisateur interactives. Console (1) puis sessions RDP.</td></tr>
</table>
<div class="codeblk" style="margin-top:.4rem"><span class="c-comment"># Lister les sessions</span>
query session
<span class="c-comment"># ou</span>
qwinsta
<span class="c-comment"># Forcer un programme à apparaître en session 0 (déconseillé)</span>
<span class="c-admin">sc</span> config <svc> type= interact <span class="c-comment"># NE PAS UTILISER</span></div>
</div>
<div class="card">
<h4>Tokens d'accès</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Chaque processus a un <strong>access token</strong> qui contient :</p>
<ul style="font-size:.85rem;padding-left:1.2rem;line-height:1.9">
<li><strong>SID utilisateur</strong> (S-1-5-21-...)</li>
<li><strong>SIDs de groupes</strong></li>
<li><strong>Privilèges</strong> activés/désactivés</li>
<li><strong>Integrity level</strong> (Low/Medium/High/System)</li>
<li><strong>Logon SID</strong> (lié à la session)</li>
<li><strong>UI Access</strong>, restrictions, claims (RBAC)</li>
</ul>
<div class="codeblk" style="margin-top:.4rem"><span class="c-comment"># Voir le token courant (PowerShell)</span>
[System.Security.Principal.WindowsIdentity]::GetCurrent() | <span class="c-fn">fl</span> *
<span class="c-comment"># whoami</span>
whoami /all
whoami /priv
whoami /groups</div>
</div>
</div>
<div class="grid g2" style="margin-top:1rem">
<div class="card">
<h4>Jobs & Job Objects</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Équivalent des cgroups Linux. Un Job regroupe plusieurs processus avec des limites communes :</p>
<ul style="font-size:.85rem;padding-left:1.2rem;line-height:1.9">
<li>Limite mémoire / CPU</li>
<li>Limite handles / processus</li>
<li>Kill-on-close (tous les process meurent à la fermeture du job)</li>
<li>Silos (isolation forte) — base de Windows Containers</li>
</ul>
<div class="codeblk" style="margin-top:.4rem"><span class="c-comment"># Process Explorer permet de voir et créer des Jobs</span>
<span class="c-comment"># Set-WindowsContainerJobObject (Docker / Windows containers)</span></div>
</div>
<div class="card">
<h4>Handles & objets nommés</h4>
<div class="codeblk"><span class="c-comment"># Lister les handles d'un processus (Sysinternals)</span>
handle.exe -p <span class="c-val">1234</span>
handle.exe -a -p <span class="c-val">1234</span> <span class="c-comment"># tous, y compris non nommés</span>
<span class="c-comment"># Identifier qui a ouvert un fichier</span>
handle.exe <span class="c-str">"C:\path\to\file.txt"</span>
<span class="c-comment"># PowerShell : handles d'un process</span>
<span class="c-fn">Get-Process</span> <span class="c-val">1234</span> | <span class="c-fn">Select-Object</span> Name, HandleCount, Modules</div>
<div class="info-box blue" style="margin-top:.4rem;font-size:.82rem">
Trop de handles = fuite courante. Limite par défaut : ~16 millions par session.
</div>
</div>
</div>
</section>
<section id="user">
<h2>Outils utilisateur (sans élévation) <span class="badge badge-user">user</span></h2>
<p style="color:var(--muted);margin-bottom:1rem">Vous voyez tous les processus mais n'agissez que sur les vôtres (sauf élévation).</p>
<h3>Outils graphiques</h3>
<div class="cmd">
<div class="name">Gestionnaire des tâches (Task Manager)</div>
<div class="desc">Ctrl+Shift+Esc ou Ctrl+Alt+Suppr. Vue rapide.</div>
<div class="codeblk"><span class="c-comment"># Onglets :</span>
- Processus : par catégorie (apps, arrière-plan, Windows)
- Performance : graphes CPU, RAM, GPU, réseau, disque
- Historique des applications : compte ressources cumulé
- Démarrage : ce qui démarre avec Windows
- Utilisateurs : sessions actives
- Détails : vue brute (équivalent <span class="c-fn">ps -ef</span>)
- Services : services et leur état</div>
<div class="info-box orange" style="margin-top:.4rem;font-size:.82rem">
Sans élévation : vous voyez vos processus + ceux des autres users en lecture. Pour tuer / élever : bouton "Plus de détails" puis clic droit "Exécuter en tant qu'administrateur" sur Task Manager au lancement.
</div>
</div>
<div class="cmd">
<div class="name">Process Explorer (Sysinternals)</div>
<div class="desc">Task Manager amélioré, gratuit, par Mark Russinovich.</div>
<div class="info-box">
<ul style="padding-left:1.2rem;margin:.3rem 0">
<li>Arbre des processus (parent / enfant) déplié</li>
<li>Couleurs : nouveau (vert), terminé (rouge), service (rose), .NET (jaune)</li>
<li>Recherche d'un handle ou DLL ouverte (Ctrl+F)</li>
<li>VirusTotal en un clic</li>
<li>Onglet TCP/IP, Strings, Stack, Threads</li>
<li>Remplacer Task Manager : Options → Replace Task Manager</li>
</ul>
</div>
</div>
<div class="cmd">
<div class="name">Resource Monitor (resmon.exe)</div>
<div class="desc">Vue détaillée des ressources : CPU par thread, fichiers ouverts par process, connexions réseau, accès disque.</div>
</div>
<h3>Ligne de commande — CMD</h3>
<div class="cmd">
<div class="name">tasklist</div>
<div class="codeblk">tasklist <span class="c-comment"># tous les processus</span>
tasklist /v <span class="c-comment"># verbose (utilisateur, titre fenêtre)</span>
tasklist /fi <span class="c-str">"IMAGENAME eq chrome.exe"</span>
tasklist /fi <span class="c-str">"PID eq 1234"</span>
tasklist /fi <span class="c-str">"STATUS eq running"</span>
tasklist /svc <span class="c-comment"># services associés aux PID</span>
tasklist /m ntdll.dll <span class="c-comment"># quels process utilisent cette DLL</span>
tasklist /s pc01 /u DOMAIN\admin <span class="c-comment"># distant</span></div>
</div>
<div class="cmd">
<div class="name">taskkill</div>
<div class="codeblk">taskkill /pid <span class="c-val">1234</span> <span class="c-comment"># demande propre (WM_CLOSE)</span>
taskkill /pid <span class="c-val">1234</span> /f <span class="c-comment"># force (équiv kill -9)</span>
taskkill /im chrome.exe /f <span class="c-comment"># tous les chrome.exe</span>
taskkill /im chrome.exe /t <span class="c-comment"># + enfants (tree)</span>
taskkill /fi <span class="c-str">"USERNAME eq alice"</span> /f
<span class="c-comment"># ⚠️ Sans élévation, vous ne pouvez tuer que VOS processus</span></div>
</div>
<h3>PowerShell</h3>
<div class="cmd">
<div class="name">Get-Process</div>
<div class="codeblk"><span class="c-fn">Get-Process</span>
<span class="c-fn">Get-Process</span> chrome
<span class="c-fn">Get-Process</span> -<span class="c-kw">Id</span> <span class="c-val">1234</span>
<span class="c-fn">Get-Process</span> | <span class="c-fn">Sort-Object</span> -<span class="c-kw">Property</span> WS -<span class="c-kw">Descending</span> | <span class="c-fn">Select-Object</span> -First <span class="c-val">10</span>
<span class="c-comment"># Top 10 par working set (RAM)</span>
<span class="c-fn">Get-Process</span> | <span class="c-fn">Where-Object</span> { $_.CPU -<span class="c-kw">gt</span> <span class="c-val">100</span> }
<span class="c-comment"># Processus consommant + de 100s CPU total</span>
<span class="c-comment"># Lister avec colonnes custom</span>
<span class="c-fn">Get-Process</span> | <span class="c-fn">Format-Table</span> Id, Name, CPU,
@{N=<span class="c-str">'RAM_MB'</span>;E={[<span class="c-fn">math</span>]::Round($_.WS/<span class="c-val">1MB</span>,<span class="c-val">2</span>)}}</div>
</div>
<div class="cmd">
<div class="name">Stop-Process</div>
<div class="codeblk"><span class="c-fn">Stop-Process</span> -<span class="c-kw">Id</span> <span class="c-val">1234</span>
<span class="c-fn">Stop-Process</span> -<span class="c-kw">Name</span> chrome -<span class="c-kw">Force</span>
<span class="c-fn">Get-Process</span> -<span class="c-kw">Name</span> chrome | <span class="c-fn">Stop-Process</span> -<span class="c-kw">Force</span></div>
</div>
<div class="cmd">
<div class="name">Wait-Process / Start-Process</div>
<div class="codeblk"><span class="c-fn">Start-Process</span> notepad.exe
<span class="c-fn">Start-Process</span> -<span class="c-kw">FilePath</span> <span class="c-str">"powershell"</span> -<span class="c-kw">Verb</span> RunAs <span class="c-comment"># avec UAC</span>
<span class="c-fn">Start-Process</span> -<span class="c-kw">Wait</span> -<span class="c-kw">FilePath</span> <span class="c-str">"setup.exe"</span> -<span class="c-kw">ArgumentList</span> <span class="c-str">"/silent"</span></div>
</div>
</section>
<section id="admin">
<h2>Outils admin (élévation requise) <span class="badge badge-admin">admin</span></h2>
<p style="color:var(--muted);margin-bottom:1rem">Avec un token élevé (UAC accepté), vous pouvez agir sur tous les processus, modifier les services système, accéder à des handles privilégiés.</p>
<h3>Élévation</h3>
<div class="cmd">
<div class="name">Élever une console</div>
<div class="codeblk"><span class="c-comment"># Menu démarrer → clic droit sur Terminal / cmd / PowerShell</span>
<span class="c-comment"># → "Exécuter en tant qu'administrateur"</span>
<span class="c-comment"># En PowerShell, relancer la console élevée :</span>
<span class="c-fn">Start-Process</span> powershell -<span class="c-kw">Verb</span> RunAs
<span class="c-comment"># En cmd, runas</span>
runas /user:DOMAIN\admin cmd
runas /noprofile /user:Administrator <span class="c-str">"powershell.exe"</span>
runas /netonly /user:DOMAIN\admin cmd <span class="c-comment"># creds réseau uniquement</span>
<span class="c-comment"># Vérifier l'élévation</span>
whoami /groups | findstr <span class="c-str">"S-1-16-12288"</span>
<span class="c-comment"># S-1-16-12288 = High Integrity Level (élevé)</span></div>
</div>
<h3>Inspection avancée</h3>
<div class="cmd">
<div class="name">Process Explorer (en admin)</div>
<div class="desc">Élévation requise pour voir tous les détails (handles d'autres users, modules signés…).</div>
<div class="info-box red" style="margin-top:.4rem;font-size:.82rem">
Sans élévation, Process Explorer affiche "<Access denied>" sur de nombreux processus. <strong>File → Run as administrator</strong>.
</div>
</div>
<div class="cmd">
<div class="name">handle.exe (Sysinternals)</div>
<div class="codeblk"><span class="c-admin">handle.exe -a -p <span class="c-val">1234</span></span> <span class="c-comment"># tous les handles d'un PID</span>
<span class="c-admin">handle.exe</span> <span class="c-str">"C:\Lock\file.txt"</span> <span class="c-comment"># qui verrouille ce fichier ?</span>
<span class="c-admin">handle.exe -c</span> <span class="c-val">0x4d8</span> -p <span class="c-val">1234</span> <span class="c-comment">⚠️ Forcer la fermeture d'un handle (dangereux)</span></div>
</div>
<div class="cmd">
<div class="name">tasklist / taskkill (sur process élevés)</div>
<div class="codeblk"><span class="c-comment"># Avec une console admin</span>
<span class="c-admin">taskkill /pid <span class="c-val">1234</span> /f</span> <span class="c-comment"># même les process system</span>
<span class="c-admin">taskkill /im lsass.exe /f</span> <span class="c-comment"># ⚠️ BSOD garanti — exemple à NE PAS faire</span>
<span class="c-admin">taskkill /s remotepc /u DOMAIN\admin /im edge.exe /f</span>
<span class="c-comment"># Tuer un process sur un PC distant</span></div>
</div>
<h3>PowerShell admin</h3>
<div class="cmd">
<div class="name">Get-Process / Stop-Process avec accès complet</div>
<div class="codeblk"><span class="c-admin"># En console élevée</span>
<span class="c-fn">Get-Process</span> -<span class="c-kw">IncludeUserName</span> <span class="c-comment"># ne marche qu'en admin</span>
<span class="c-fn">Stop-Process</span> -<span class="c-kw">Name</span> service.exe -<span class="c-kw">Force</span> <span class="c-comment"># ok en admin</span>
<span class="c-comment"># Lister les processus d'un autre utilisateur</span>
<span class="c-fn">Get-Process</span> -<span class="c-kw">IncludeUserName</span> | <span class="c-fn">Where-Object</span> UserName -<span class="c-kw">eq</span> <span class="c-str">"DOMAIN\bob"</span></div>
</div>
<div class="cmd">
<div class="name">wmic / Get-CimInstance</div>
<div class="desc">Accès WMI à beaucoup d'infos système. <code>wmic</code> est déprécié, préférer Get-CimInstance.</div>
<div class="codeblk"><span class="c-comment"># WMI / CIM (PowerShell moderne)</span>
<span class="c-fn">Get-CimInstance</span> Win32_Process | <span class="c-fn">Select</span> ProcessId, Name, CommandLine, ParentProcessId
<span class="c-comment"># Voir ligne de commande complète + parent</span>
<span class="c-fn">Get-CimInstance</span> Win32_Process |
<span class="c-fn">Where-Object</span> Name -<span class="c-kw">eq</span> <span class="c-str">"powershell.exe"</span> |
<span class="c-fn">Format-List</span> *
<span class="c-comment"># Distant</span>
<span class="c-fn">Get-CimInstance</span> Win32_Process -<span class="c-kw">ComputerName</span> server01
<span class="c-comment"># Legacy wmic (déprécié)</span>
wmic process get name, processid, parentprocessid, commandline
wmic process where <span class="c-str">"name='chrome.exe'"</span> call terminate</div>
</div>
<div class="cmd">
<div class="name">Procdump / Process Monitor (Sysinternals)</div>
<div class="codeblk"><span class="c-admin">procdump -ma <span class="c-val">1234</span> dump.dmp</span> <span class="c-comment"># full dump mémoire</span>
<span class="c-admin">procdump -accepteula -e -ma chrome.exe dumps/</span> <span class="c-comment"># dump sur crash</span>
<span class="c-admin">procdump -c <span class="c-val">80</span> -s <span class="c-val">10</span> -ma <span class="c-val">1234</span> dump.dmp</span> <span class="c-comment"># dump si CPU > 80% pendant 10 s</span>
<span class="c-comment"># Process Monitor (procmon.exe)</span>
<span class="c-comment"># Trace en temps réel les opérations File, Registry, Network, Process</span>
<span class="c-comment"># Filtrer par PID, par nom, par opération. Outil indispensable pour debug.</span></div>
</div>
<div class="cmd">
<div class="name">PsExec (Sysinternals) — exécution distante / élevée</div>
<div class="codeblk"><span class="c-admin">PsExec.exe \\server01 cmd</span> <span class="c-comment"># cmd sur machine distante</span>
<span class="c-admin">PsExec.exe -s -i cmd</span> <span class="c-comment"># lancer en SYSTEM (encore + que admin)</span>
<span class="c-admin">PsExec.exe -i -d -s notepad.exe</span> <span class="c-comment"># notepad en SYSTEM, interactif</span>
<span class="c-comment"># Surclasser un compte SYSTEM</span>
<span class="c-admin">PsExec.exe -s -i -d powershell.exe</span></div>
<div class="info-box red" style="margin-top:.4rem;font-size:.82rem">
<strong>PsExec -s</strong> donne le token <strong>NT AUTHORITY\SYSTEM</strong> — plus puissant qu'admin. Outil légitime mais aussi utilisé par les attaquants après compromission.
</div>
</div>
</section>
<section id="services">
<h2>Services Windows</h2>
<p style="color:var(--muted);margin-bottom:1rem">Les services tournent en session 0, sans GUI, gérés par le SCM (services.exe). Souvent hébergés dans des <strong>svchost.exe</strong>.</p>
<h3>Outils</h3>
<div class="cmd">
<div class="name">services.msc</div>
<div class="desc">Console graphique. Permet de voir, démarrer, arrêter, configurer les services.</div>
<div class="info-box orange" style="margin-top:.4rem;font-size:.82rem">
Actions de démarrage/arrêt/modification nécessitent une <strong>élévation UAC</strong> <span class="badge badge-admin">admin</span>.
</div>
</div>
<div class="cmd">
<div class="name">sc.exe (Service Controller)</div>
<div class="codeblk"><span class="c-comment"># Lecture (sans admin pour la plupart)</span>
sc query <span class="c-comment"># tous les services running</span>
sc query state= all <span class="c-comment"># incl. stoppés (NOTE: espace après =)</span>
sc query type= driver
sc queryex spooler <span class="c-comment"># détails (PID, dépendances)</span>
sc qc spooler <span class="c-comment"># config (binPath, start type, user)</span>
sc enumdepend RPCSS <span class="c-comment"># quels services dépendent de RPCSS</span>
<span class="c-comment"># Action (admin)</span>
<span class="c-admin">sc start spooler</span>
<span class="c-admin">sc stop spooler</span>
<span class="c-admin">sc config spooler start= auto</span> <span class="c-comment"># auto, demand, disabled</span>
<span class="c-admin">sc create MyService binPath= <span class="c-str">"C:\App\app.exe"</span> start= auto</span>
<span class="c-admin">sc delete MyService</span>
<span class="c-admin">sc failure MyService reset= <span class="c-val">86400</span> actions= restart/<span class="c-val">60000</span>/restart/<span class="c-val">60000</span>/run/<span class="c-val">0</span></span>
<span class="c-comment"># Auto-restart sur crash, après 1 min, deux fois, puis stop</span></div>
</div>
<div class="cmd">
<div class="name">PowerShell — Get-Service / *-Service</div>
<div class="codeblk"><span class="c-comment"># Lecture</span>
<span class="c-fn">Get-Service</span>
<span class="c-fn">Get-Service</span> -<span class="c-kw">Name</span> Spooler
<span class="c-fn">Get-Service</span> | <span class="c-fn">Where-Object</span> Status -<span class="c-kw">eq</span> Running
<span class="c-fn">Get-Service</span> | <span class="c-fn">Where-Object</span> StartType -<span class="c-kw">eq</span> Disabled
<span class="c-comment"># Service détaillé via CIM</span>
<span class="c-fn">Get-CimInstance</span> Win32_Service -<span class="c-kw">Filter</span> <span class="c-str">"Name='Spooler'"</span> | <span class="c-fn">Format-List</span> *
<span class="c-comment"># Action (admin)</span>
<span class="c-admin"><span class="c-fn">Start-Service</span> Spooler</span>
<span class="c-admin"><span class="c-fn">Stop-Service</span> Spooler -<span class="c-kw">Force</span></span>
<span class="c-admin"><span class="c-fn">Restart-Service</span> Spooler</span>
<span class="c-admin"><span class="c-fn">Set-Service</span> Spooler -<span class="c-kw">StartupType</span> Disabled</span>
<span class="c-admin"><span class="c-fn">New-Service</span> -<span class="c-kw">Name</span> MyService -<span class="c-kw">BinaryPathName</span> <span class="c-str">"C:\App\app.exe"</span> -<span class="c-kw">StartupType</span> Automatic</span></div>
</div>
<h3>Comptes de service</h3>
<div class="card">
<h4>Comptes built-in pour les services</h4>
<table>
<tr><th>Compte</th><th>SID</th><th>Privilèges</th></tr>
<tr><td><strong>LocalSystem</strong></td><td>S-1-5-18</td><td>Tout sur la machine — équivalent root local</td></tr>
<tr><td><strong>LocalService</strong></td><td>S-1-5-19</td><td>Minimaux locaux, anonyme sur le réseau</td></tr>
<tr><td><strong>NetworkService</strong></td><td>S-1-5-20</td><td>Minimaux locaux, identité machine sur le réseau</td></tr>
<tr><td><strong>Compte utilisateur</strong></td><td>(SID user)</td><td>Identité d'un user dédié</td></tr>
<tr><td><strong>gMSA / sMSA</strong></td><td>(SID compte)</td><td>Group / Standalone Managed Service Account — mots de passe gérés par AD automatiquement</td></tr>
<tr><td><strong>Virtual Account</strong></td><td>NT SERVICE\<service></td><td>Identité locale dédiée par service</td></tr>
</table>
<div class="info-box red" style="margin-top:.5rem;font-size:.82rem">
<strong>Bonne pratique :</strong> éviter LocalSystem (trop privilégié), utiliser NetworkService, Virtual Account ou gMSA. Auditer régulièrement les services avec des identités élevées.
</div>
</div>
<div class="card" style="margin-top:1rem">
<h4>Recovery options</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Actions automatiques si un service crash :</p>
<ul style="font-size:.85rem;padding-left:1.2rem;line-height:1.9">
<li>Take no action</li>
<li>Restart the service</li>
<li>Run a program</li>
<li>Restart the computer (⚠️ destructif si mal configuré)</li>
</ul>
<p style="font-size:.85rem;margin-top:.4rem">Configurable via services.msc onglet "Récupération", ou <code>sc failure</code>.</p>
</div>
</section>
<section id="security">
<h2>Sécurité — UAC, Integrity Levels, privilèges</h2>
<h3>Integrity Levels</h3>
<p style="color:var(--muted);font-size:.85rem">Système hiérarchique de confiance introduit avec Vista. Un processus d'un niveau ne peut pas modifier un objet d'un niveau supérieur.</p>
<div class="il-row" style="border-left-color:var(--muted)"><div class="lt">Untrusted</div><div><strong>S-1-16-0</strong></div><div>Sandbox profonde</div></div>
<div class="il-row" style="border-left-color:#3b82f6"><div class="lt">Low</div><div><strong>S-1-16-4096</strong></div><div>Internet Explorer Protected Mode, navigateurs sandboxés, AppContainer</div></div>
<div class="il-row" style="border-left-color:#16a34a"><div class="lt">Medium</div><div><strong>S-1-16-8192</strong></div><div>Utilisateur standard authentifié — défaut UAC non élevé</div></div>
<div class="il-row" style="border-left-color:#f59e0b"><div class="lt">High</div><div><strong>S-1-16-12288</strong></div><div>Administrateur élevé via UAC ("Run as administrator")</div></div>
<div class="il-row" style="border-left-color:#dc2626"><div class="lt">System</div><div><strong>S-1-16-16384</strong></div><div>NT AUTHORITY\SYSTEM — services et kernel</div></div>
<div class="il-row" style="border-left-color:#7c3aed"><div class="lt">Protected</div><div><strong>S-1-16-20480</strong></div><div>Protected processes (anti-malware, DRM Media Foundation)</div></div>
<div class="grid g2" style="margin-top:1rem">
<div class="card">
<h4>UAC (User Account Control)</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Depuis Vista. Un admin se connecte avec un <strong>token "split"</strong> :</p>
<ul style="font-size:.85rem;padding-left:1.2rem;line-height:1.9">
<li><strong>Filtered token</strong> (Medium IL) — usage quotidien</li>
<li><strong>Linked elevated token</strong> (High IL) — disponible via UAC consent</li>
</ul>
<div class="info-box blue" style="margin-top:.4rem;font-size:.82rem">
Quand vous "Run as administrator", le shell récupère le linked token. Avant ça : Medium IL même si vous êtes admin.
</div>
<h4 style="margin-top:1rem">Vérifier IL d'un process</h4>
<div class="codeblk"><span class="c-comment"># Sysinternals — Process Explorer affiche "Integrity"</span>
<span class="c-comment"># whoami</span>
whoami /groups | findstr <span class="c-str">"Mandatory Label"</span>
<span class="c-comment"># Sortie : Mandatory Label\High Mandatory Level → admin élevé</span></div>
</div>
<div class="card">
<h4>Privilèges (whoami /priv)</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Windows découpe les pouvoirs admin en ~30 privilèges granulaires.</p>
<table>
<tr><th>Privilège</th><th>Effet</th></tr>
<tr><td>SeDebugPrivilege</td><td>Attacher un debugger à n'importe quel process</td></tr>
<tr><td>SeBackupPrivilege</td><td>Lire tout fichier (ignore ACL en lecture)</td></tr>
<tr><td>SeRestorePrivilege</td><td>Écrire tout fichier</td></tr>
<tr><td>SeTakeOwnershipPrivilege</td><td>Prendre possession d'un objet</td></tr>
<tr><td>SeLoadDriverPrivilege</td><td>Charger un driver kernel</td></tr>
<tr><td>SeImpersonatePrivilege</td><td>Impersonate d'autres tokens (services)</td></tr>
<tr><td>SeAssignPrimaryTokenPrivilege</td><td>Assigner un token à un new process</td></tr>
<tr><td>SeShutdownPrivilege</td><td>Éteindre la machine</td></tr>
<tr><td>SeIncreaseQuotaPrivilege</td><td>Ajuster quotas mémoire</td></tr>
<tr><td>SeTcbPrivilege</td><td>Agir comme partie du système ("trusted computing base")</td></tr>
</table>
<div class="info-box red" style="margin-top:.4rem;font-size:.82rem">
<strong>SeDebugPrivilege</strong> est la clé pour <code>mimikatz</code>. Auditer les comptes qui le possèdent.
</div>
</div>
</div>
<div class="card" style="margin-top:1rem">
<h4>Mode kernel vs user</h4>
<table>
<tr><th>Mode</th><th>Caractéristiques</th></tr>
<tr><td><strong>User mode (Ring 3)</strong></td><td>Process applications + services. Accès kernel via syscalls.</td></tr>
<tr><td><strong>Kernel mode (Ring 0)</strong></td><td>Kernel + drivers. Accès direct au hardware. Crash = BSOD.</td></tr>
</table>
<div class="info-box orange" style="margin-top:.4rem;font-size:.82rem">
Les drivers kernel signés peuvent compromettre tout le système. Depuis Windows 11, KSPP (Kernel Software Protection Platform) renforce. Patchguard empêche le patching du kernel à chaud.
</div>
</div>
<div class="card" style="margin-top:1rem">
<h4>Outils d'analyse de tokens</h4>
<div class="codeblk"><span class="c-comment"># Sysinternals AccessChk</span>
accesschk.exe -p <span class="c-val">1234</span>
accesschk.exe -p chrome.exe <span class="c-comment"># détails token, IL, priv</span>
<span class="c-comment"># Privilèges d'un user</span>
secpol.msc → User Rights Assignment
<span class="c-comment"># ou en CLI :</span>
secedit /export /cfg policy.txt</div>
</div>
</section>
<section id="scheduling">
<h2>Priorités & scheduler</h2>
<div class="grid g2">
<div class="card">
<h4>Priority Classes (par process)</h4>
<table>
<tr><th>Classe</th><th>Valeur</th><th>Usage</th></tr>
<tr><td>Idle</td><td>4</td><td>Tâches d'arrière-plan invisibles</td></tr>
<tr><td>Below Normal</td><td>6</td><td>Calculs longs non urgents</td></tr>
<tr><td>Normal</td><td>8</td><td>Défaut applications</td></tr>
<tr><td>Above Normal</td><td>10</td><td>Apps interactives</td></tr>
<tr><td>High</td><td>13</td><td>Critiques courtes</td></tr>
<tr><td>Realtime</td><td>24</td><td>⚠️ Audio temps réel, drivers — nécessite SeIncreaseBasePriorityPrivilege</td></tr>
</table>
<div class="info-box red" style="margin-top:.4rem;font-size:.82rem">
<strong>Realtime</strong> peut bloquer le système (input clavier/souris). Réservé à des cas très spécifiques. Admin requis.
</div>
</div>
<div class="card">
<h4>Priorité d'un thread</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Chaque thread a une priorité <strong>0 à 31</strong>, calculée comme : base de la priority class + offset thread (-15 à +15 / TIME_CRITICAL).</p>
<table>
<tr><th>Niveau</th><th>Valeur typique</th></tr>
<tr><td>Idle</td><td>1</td></tr>
<tr><td>Lowest</td><td>base - 2</td></tr>
<tr><td>Below Normal</td><td>base - 1</td></tr>
<tr><td>Normal</td><td>base</td></tr>
<tr><td>Above Normal</td><td>base + 1</td></tr>
<tr><td>Highest</td><td>base + 2</td></tr>
<tr><td>Time Critical</td><td>15 (ou 31 si Realtime)</td></tr>
</table>
</div>
</div>
<div class="grid g2" style="margin-top:1rem">
<div class="card">
<h4>Changer la priorité — PowerShell</h4>
<div class="codeblk"><span class="c-comment"># Voir la classe</span>
<span class="c-fn">Get-Process</span> chrome | <span class="c-fn">Select</span> Id, Name, PriorityClass
<span class="c-comment"># Définir la classe (user pour ses process)</span>
$p = <span class="c-fn">Get-Process</span> -<span class="c-kw">Id</span> <span class="c-val">1234</span>
$p.PriorityClass = <span class="c-str">'BelowNormal'</span>
<span class="c-comment"># Admin pour les process d'autres users</span>
<span class="c-admin">$p = Get-Process -Id 1234</span>
<span class="c-admin">$p.PriorityClass = 'High'</span>
<span class="c-comment"># Démarrer avec une priorité</span>
<span class="c-fn">Start-Process</span> -<span class="c-kw">FilePath</span> notepad.exe -<span class="c-kw">PriorityClass</span> BelowNormal</div>
</div>
<div class="card">
<h4>Affinité CPU</h4>
<div class="codeblk"><span class="c-comment"># Voir l'affinité courante (bitmask)</span>
<span class="c-fn">Get-Process</span> chrome | <span class="c-fn">Select</span> Id, ProcessorAffinity
<span class="c-comment"># Restreindre à CPU 0 et 1 (bitmask 0x3 = 0b11)</span>
$p = <span class="c-fn">Get-Process</span> -<span class="c-kw">Id</span> <span class="c-val">1234</span>
$p.ProcessorAffinity = [<span class="c-fn">IntPtr</span>]<span class="c-val">3</span>
<span class="c-comment"># Via Task Manager : clic droit process → Affinité</span>
<span class="c-comment"># Via cmd : start /affinity 3 program.exe</span></div>
</div>
</div>
<div class="card" style="margin-top:1rem">
<h4>Boost de priorité Windows</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Le scheduler Windows applique automatiquement des boosts temporaires :</p>
<ul style="font-size:.85rem;padding-left:1.2rem;line-height:1.9">
<li><strong>Foreground boost</strong> : process avec focus voit ses threads boostés (+0 à +2)</li>
<li><strong>I/O completion boost</strong> : threads en sortie d'I/O boostés (clavier +6, souris +6, disque +1, réseau +2)</li>
<li><strong>GUI thread boost</strong> : threads d'interface graphique privilégiés</li>
<li><strong>Priority inheritance</strong> : un thread bloquant un thread plus prioritaire hérite de sa priorité temporairement (lock convoy avoidance)</li>
</ul>
</div>
</section>
<section id="traces">
<h2>Traces & monitoring</h2>
<div class="grid g2">
<div class="card">
<h4>ETW — Event Tracing for Windows</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Système de traces kernel + user de très bas niveau, ultra performant (~milliers d'événements/s). Base de Performance Monitor, Process Monitor, Procmon, WPR/WPA.</p>
<ul style="font-size:.85rem;padding-left:1.2rem;line-height:1.9">
<li><strong>Providers</strong> : milliers (kernel, .NET, IIS, AD, Defender…)</li>
<li><strong>Sessions</strong> : groupes d'événements collectés</li>
<li><strong>Consumers</strong> : lecteurs (xperf, PerfView, WPA)</li>
</ul>
<div class="codeblk" style="margin-top:.4rem"><span class="c-admin">logman query -ets</span> <span class="c-comment"># sessions ETW actives</span>
<span class="c-admin">logman query providers</span> <span class="c-comment"># providers disponibles</span>
<span class="c-comment"># Activer une trace</span>
<span class="c-admin">wpr.exe -start CPU -filemode</span>
<span class="c-admin">wpr.exe -stop trace.etl</span>
<span class="c-comment"># Analyser : WPA (Windows Performance Analyzer)</span></div>
</div>
<div class="card">
<h4>Performance Monitor (perfmon)</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Affiche des compteurs de performance (Counters) en temps réel ou archivés.</p>
<ul style="font-size:.85rem;padding-left:1.2rem;line-height:1.9">
<li>Processor → % Processor Time, % User Time</li>
<li>Memory → Available MBytes, Page Faults/sec</li>
<li>Process → Working Set, Handle Count, Thread Count, Private Bytes</li>
<li>Disk → Avg. Disk sec/Read, Write</li>
<li>Network Interface → Bytes Total/sec</li>
</ul>
<div class="codeblk" style="margin-top:.4rem"><span class="c-comment"># Lancer</span>
perfmon
<span class="c-comment"># PowerShell : récupérer un compteur</span>
<span class="c-fn">Get-Counter</span> <span class="c-str">"\Processor(_Total)\% Processor Time"</span>
<span class="c-fn">Get-Counter</span> -<span class="c-kw">Counter</span> <span class="c-str">"\Process(chrome*)\Working Set"</span> -<span class="c-kw">SampleInterval</span> <span class="c-val">1</span> -<span class="c-kw">MaxSamples</span> <span class="c-val">10</span></div>
</div>
</div>
<div class="grid g2" style="margin-top:1rem">
<div class="card">
<h4>Event Viewer (eventvwr)</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Affiche les logs Windows. Particulièrement utile :</p>
<table>
<tr><th>Journal</th><th>Contenu</th></tr>
<tr><td>System</td><td>Drivers, services Windows</td></tr>
<tr><td>Application</td><td>Erreurs apps (.NET, MSI…)</td></tr>
<tr><td>Security</td><td>Audit (logon, accès, élévation) — voir audit policies</td></tr>
<tr><td>Setup</td><td>Installations</td></tr>
<tr><td>Applications and Services Logs/...</td><td>PowerShell, Sysmon, AppV, etc.</td></tr>
</table>
<div class="codeblk" style="margin-top:.4rem"><span class="c-comment"># PowerShell</span>
<span class="c-fn">Get-WinEvent</span> -<span class="c-kw">LogName</span> System -<span class="c-kw">MaxEvents</span> <span class="c-val">50</span>
<span class="c-fn">Get-WinEvent</span> -<span class="c-kw">FilterHashtable</span> @{LogName=<span class="c-str">'Security'</span>;ID=<span class="c-val">4624</span>} -<span class="c-kw">MaxEvents</span> <span class="c-val">20</span>
<span class="c-comment"># 4624 = Logon réussi</span></div>
</div>
<div class="card">
<h4>Sysmon (Sysinternals)</h4>
<p style="font-size:.88rem;margin-bottom:.5rem">Driver + service qui logue les événements système avancés vers Event Log. Outil de référence pour les blue teams.</p>
<ul style="font-size:.85rem;padding-left:1.2rem;line-height:1.9">
<li>Process creation (avec commandline + hash + parent)</li>
<li>Network connections</li>
<li>File creation</li>
<li>Registry modifications</li>
<li>Process injection (CreateRemoteThread)</li>
<li>Loaded modules</li>
</ul>
<div class="codeblk" style="margin-top:.4rem"><span class="c-admin">Sysmon.exe -accepteula -i sysmonconfig.xml</span>
<span class="c-comment"># Config populaire : SwiftOnSecurity/sysmon-config</span>
<span class="c-comment"># Logs dans :</span>
<span class="c-comment"># Microsoft-Windows-Sysmon/Operational</span></div>
</div>
</div>
<div class="card" style="margin-top:1rem">
<h4>Outils Sysinternals utiles</h4>
<table>
<tr><th>Outil</th><th>Usage</th></tr>
<tr><td>Process Explorer</td><td>Task Manager amélioré</td></tr>
<tr><td>Process Monitor (procmon)</td><td>Trace fichiers, registry, réseau, process</td></tr>
<tr><td>Autoruns</td><td>Tout ce qui démarre avec Windows (services, drivers, Run keys, scheduled tasks…)</td></tr>
<tr><td>TCPView</td><td>Connexions TCP/UDP par process</td></tr>
<tr><td>handle.exe</td><td>Handles ouverts</td></tr>
<tr><td>listdlls.exe</td><td>DLLs chargées</td></tr>
<tr><td>procdump</td><td>Dumps mémoire</td></tr>
<tr><td>PsTools (PsExec, PsKill, PsInfo, PsList...)</td><td>Suite admin distante</td></tr>
<tr><td>VMMap</td><td>Visualisation mémoire d'un process</td></tr>
<tr><td>RAMMap</td><td>Carte mémoire physique</td></tr>
<tr><td>Sysmon</td><td>Trace sécurité (cf. supra)</td></tr>
</table>
<div class="info-box green" style="margin-top:.4rem;font-size:.82rem">
Téléchargement officiel Microsoft : <a href="https://learn.microsoft.com/sysinternals" style="color:var(--acc)">learn.microsoft.com/sysinternals</a>. Ou en ligne : <code>\\live.sysinternals.com\tools\</code>.
</div>
</div>
</section>
<section id="quiz">
<h2>Quiz — Windows processus</h2>
<div id="quiz-container"></div>
<div id="quiz-score"></div>
</section>
<script>
function showTab(id){document.querySelectorAll('section').forEach(s=>s.classList.remove('active'));document.querySelectorAll('.tab-btn').forEach(b=>b.classList.remove('active'));document.getElementById(id).classList.add('active');event.target.classList.add('active')}
const quizData=[
{q:"Quel PID a le noyau / system Windows ?",opts:["1","4","100","0"],a:1},
{q:"Quel processus gère l'authentification et stocke les hashes credentials ?",opts:["csrss.exe","lsass.exe","winlogon.exe","services.exe"],a:1},
{q:"À quoi sert smss.exe ?",opts:["Print spooler","Session Manager Subsystem — démarre les sessions","Antivirus","Shell"],a:1},
{q:"Quelle session contient uniquement les services Windows ?",opts:["Session 0","Session 1","Session 99","Toutes"],a:0},
{q:"En tant qu'utilisateur non-admin, puis-je tuer le processus d'un autre utilisateur ?",opts:["Oui toujours","Non, sauf élévation","Oui si même groupe","Oui via taskmgr"],a:1},
{q:"Quelle commande PowerShell tue un processus ?",opts:["Kill-Process","Stop-Process","Remove-Process","End-Process"],a:1},
{q:"Quel privilège est utilisé par Mimikatz pour dump LSASS ?",opts:["SeBackupPrivilege","SeDebugPrivilege","SeShutdownPrivilege","SeImpersonatePrivilege"],a:1},
{q:"Que signifie le Integrity Level 'High' (S-1-16-12288) ?",opts:["Process utilisateur normal","Process admin élevé via UAC","System","Sandbox Low"],a:1},
{q:"Quel outil Sysinternals trace en temps réel les opérations File/Registry/Network ?",opts:["Process Explorer","Process Monitor","Autoruns","TCPView"],a:1},
{q:"Quelle commande montre les services en cours ?",opts:["sc query","tasklist /svc","Get-Service","Toutes ces réponses"],a:3},
{q:"Quel compte de service est le plus privilégié localement ?",opts:["LocalService","NetworkService","LocalSystem","Virtual Account"],a:2},
{q:"Quelle Priority Class peut bloquer le système si mal utilisée ?",opts:["Idle","Normal","High","Realtime"],a:3},
{q:"Que fait PsExec -s ?",opts:["Run silencieux","Lance le processus en tant que SYSTEM","Service installation","Sleep"],a:1},
{q:"Quel événement Security Windows correspond à un logon réussi ?",opts:["4625","4624","4634","4720"],a:1},
{q:"Qu'est-ce qu'un Job Object Windows ?",opts:["Une tâche planifiée","Un groupe de processus avec contraintes communes (équivalent cgroup)","Un thread","Un service"],a:1}
];
let answers=new Array(quizData.length).fill(null);
function buildQuiz(){const c=document.getElementById('quiz-container');c.innerHTML=quizData.map((q,i)=>`<div class="quiz-q"><p>${i+1}. ${q.q}</p>${q.opts.map((o,j)=>`<div class="quiz-opt" onclick="answer(this,${i},${j})">${o}</div>`).join('')}</div>`).join('')}
function answer(el,qi,oi){const parent=el.parentElement;if(parent.querySelector('.correct,.wrong'))return;answers[qi]=oi;const correct=quizData[qi].a;parent.querySelectorAll('.quiz-opt').forEach((o,j)=>{if(j===correct)o.classList.add('correct');else if(j===oi&&oi!==correct)o.classList.add('wrong')});if(answers.every(a=>a!==null)){const score=answers.filter((a,i)=>a===quizData[i].a).length;const sc=document.getElementById('quiz-score');sc.style.display='block';sc.innerHTML=`Score : ${score}/${quizData.length} ${score>=12?'Excellent !':score>=8?'Bien !':'À revoir'}`}}
buildQuiz();
</script>
</body>
</html>