基于PowerShell脚本的可疑程序取证工具设计  

Design of suspicious program forensics tool of using PowerShell

作　　者：张泽 陈顺材 郭雅楠 余子龙 靖阔 杨建强 Zhang Ze;Chen Shuncai;Guo Yanan;Yu Zilong;Jing Kuo;Yang Jianqiang(School of Computer Engineering,Hubei University of Arts and Science,Xiangyang,Hubei 441053,China)

机构地区：[1]湖北文理学院计算机工程学院,湖北襄阳441053

出　　处：《计算机时代》2022年第2期23-26,30,共5页Computer Era

摘　　要：安全用户经常需要分析并找出系统中的可疑程序。利用Windows的PowerShell、WMI和内置程序实现了一个可疑程序取证工具,它能够辅助安全用户对可疑程序进行分析和取证。相较于第三方工具,该工具更加方便、安全、可靠,在某些方面也更加智能。测试结果表明,该工具能够切实地辅助安全用户识别可疑程序,收集与可疑程序有关的重要数据。Security users often need to analyze suspicious programs in the system.A forensics tool for suspicious program was implemented by using Windows PowerShell,WMI and built-in programs.This tool can assist security users to analyze suspicious programs and collect the evidences.Compared with third-party tools,this tool is more convenient,safe,reliable,and smarter in some aspects.The test results show that the tool runs well and functions normally,and can effectively assist security users in identifying suspicious programs and collecting important data related to suspicious programs.

关 键 词：POWERSHELL 可疑程序 安全 取证 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]