基于PowerShell脚本的可疑程序取证工具设计

Design of suspicious program forensics tool of using PowerShell

安全用户经常需要分析并找出系统中的可疑程序。利用Windows的PowerShell、WMI和内置程序实现了一个可疑程序取证工具,它能够辅助安全用户对可疑程序进行分析和取证。相较于第三方工具,该工具更加方便、安全、可靠,在某些方面也更加智能。测试结果表明,该工具能够切实地辅助安全用户识别可疑程序,收集与可疑程序有关的重要数据。

Security users often need to analyze suspicious programs in the system.A forensics tool for suspicious program was implemented by using Windows PowerShell,WMI and built-in programs.This tool can assist security users to analyze suspicious programs and collect the evidences.Compared with third-party tools,this tool is more convenient,safe,reliable,and smarter in some aspects.The test results show that the tool runs well and functions normally,and can effectively assist security users in identifying suspicious programs and collecting important data related to suspicious programs.