在对目标进行行动期间，深入了解所进入系统的技术细节是决定下一步关键行动的关键条件。从受感染系统收集并分析正在运行的进程数据，能为我们提供丰富的信息，有助于更好地理解目标组织的IT架构。此外，定期轮询进程数据使我们能够对环境变化做出反应，或侦测到调查活动正在进行中时的触发信号。
为了能够从受感染的终端收集详细的进程数据，我们编写了一套进程工具，将这些高级进程实用工具的功能引入C2框架（如Cobalt Strike）。
有关工具及所用技术的更多信息，请参见以下博客： https://outflank.nl/blog/2020/03/11/red-team-tactics-advanced-process-monitoring-techniques-in-offensive-operations/
Psx: Shows a detailed list of all processes running on the system.
Psk: Shows detailed kernel information including loaded driver modules.
Psc: Shows a detailed list of all processes with Established TCP connections.
Psm: Show detailed module information from a specific process id (loaded modules, network connections e.g.).
Psh: Show detailed handle information from a specific process id (object handles, network connections e.g.).
Psw: Show Window titles from processes with active Windows.
Download the Outflank-Ps-Tools folder and load the Ps-Tools.cna script within the Cobalt Strike Script Manager.
Use the Beacon help command to display syntax information.
This project is written in C/C++
You can use Visual Studio to compile the reflective dll's from source.
作者：Cornelis de Plaa (@Cneelis) / Outflank
特别感谢：Stan Hegt (@StanHacked) 以及我在Outflank的其他优秀同事们。