Ps-Tools Process Monitoring Toolkit for Red Teams

Ps-Tools is a process monitoring toolkit designed to help security professionals collect detailed system information during authorized red team engagements. It provides visibility into running processes, loaded kernel drivers, network connections, process modules, object handles, and active window titles.

Understanding the processes running on a target endpoint can help red team operators assess the environment, investigate system activity, and identify changes that may affect an engagement. Ps-Tools packages several process inspection utilities for integration with command-and-control (C2) frameworks, including Cobalt Strike.

Key Features of Ps-Tools

The toolkit includes six utilities, each designed to collect a different category of process or system information.

• Psx: Displays a detailed list of processes running on the system.
• Psk: Retrieves kernel information, including loaded driver modules.
• Psc: Lists processes with established TCP connections, helping operators correlate running applications with network activity.
• Psm: Displays module information for a specified process ID, including loaded modules and relevant network connection details.
• Psh: Inspects handles associated with a specified process, including object handles and available network-related information.
• Psw: Displays window titles associated with processes that have active Windows.

Together, these utilities provide a broader view of endpoint activity than a basic process listing. Security teams can use the collected information to understand application behavior, review network activity, and support authorized investigations.

Integrating Ps-Tools with Cobalt Strike

Ps-Tools is designed to integrate with Cobalt Strike through a script that registers its commands with the framework. This allows authorized operators to access process inspection functionality within their existing assessment workflow.

Periodic process monitoring can also help identify changes during an engagement. For example, a new process, an unexpected TCP connection, or a change in loaded modules may warrant further investigation. These observations should be validated against the endpoint’s normal activity because legitimate applications can produce similar signals.

Installation and Usage

1. Download the Outflank Ps-Tools repository from GitHub.
2. Locate the Outflank-Ps-Tools folder and its Ps-Tools.cna script.
3. Load the script through the Cobalt Strike Script Manager in an authorized test environment.
4. Use the Beacon help command to review the available commands and their syntax.

Ps-Tools is written in C/C++. Developers can use Microsoft Visual Studio to compile the reflective DLL components from source. Review the repository’s build instructions and dependencies before compiling, as the required setup may vary with the source version and development environment.

Because the toolkit is intended for offensive security operations, use it only on systems covered by explicit authorization. Process and connection data may contain sensitive operational details, so collected output should be protected and retained according to the engagement’s data-handling requirements.

Project Credits and Download

Ps-Tools was developed by Cornelis de Plaa (@Cneelis) and Outflank. It provides a focused set of process inspection utilities for authorized red team operations and endpoint investigations.

Project repository: Download Ps-Tools from GitHub

For related security assessment techniques, explore our guide to forensic tools and investigation workflows.