> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/monitoring-users.md).

# Monitoring Users

This page covers tools to observe user activity and collect useful credentials during a Windows engagement. The focus is on passive collection, clipboard and process monitoring, and forced-authentication techniques that can surface passwords, hashes, or high-value user behavior.

## Useful Tools

| TOOL                                                                                                                       | USE CASE                                                                                                                            |
| -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| [Net-Creds](/breakpoint/windows/windows-privilege-escalation/monitoring-users/net-creds-sniffing-interfaces-and-pcaps.md)  | Captures cleartext credentials and hashes from live network interfaces or PCAP files                                                |
| [Invoke-Clipboard](/breakpoint/windows/windows-privilege-escalation/monitoring-users/monitoring-clipboard-activity.md)     | Monitors a user's clipboard in real time and captures copied credentials, commands, and other sensitive data                        |
| [Procmon](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon)                                                | Watches process, registry, file system, and command execution activity to surface useful user actions and sensitive access patterns |
| [Responder](/breakpoint/windows/windows-privilege-escalation/monitoring-users/responder-retrieving-and-cracking-hashes.md) | Captures NTLM authentication on local networks by poisoning name resolution and serving rogue network services                      |
| [Inveigh](https://github.com/Kevin-Robertson/Inveigh)                                                                      | Performs spoofing and credential capture attacks from Windows, including forced-authentication workflows                            |
| [InveighZero](https://github.com/Kevin-Robertson/InveighZero)                                                              | C# version of Inveigh for credential capture and name resolution attacks from Windows hosts                                         |
| [lnkbomb](https://github.com/dievus/lnkbomb)                                                                               | Generates malicious `.lnk` files that trigger outbound authentication when users browse a directory                                 |

## Monitoring for Commands

Here's a short PowerShell snippet from HackTheBox for diffing commands being sent on a system.

{% code title="capture-cmd.ps1" %}

```powershell
while($true)
{

  $process = Get-WmiObject Win32_Process | Select-Object CommandLine
  Start-Sleep 1
  $process2 = Get-WmiObject Win32_Process | Select-Object CommandLine
  Compare-Object -ReferenceObject $process -DifferenceObject $process2

}
```

{% endcode %}

## Vulnerable Services

Always enumerate installed application versions and map them to known CVEs. Older software bugs can still create workable privilege escalation paths on real systems. Docker Desktop provides a good example with [CVE-2019-15752](/breakpoint/windows/windows-privilege-escalation/installed-to-be-wild-privesc-paths-in-windows-apps/docker.md), which affects versions earlier than `2.1.0.1`. See the [Docker](/breakpoint/windows/windows-privilege-escalation/installed-to-be-wild-privesc-paths-in-windows-apps/docker.md) page for the full write-up.