Thursday, March 14, 2024

Overcoming our "bossypants" bias

This is the fifth post in a series of posts inspired by reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead

We've previously looked at some of Sandberg's evidence 

  • That women are underrepresented in positions of power and leadership
  • How lack of confidence contributes to the issue
  • How decisions about having children play a role in the problem
If you've read the posts in this series you may be thinking Sandberg is blaming the victim. Indeed some critics make that claim, but I don't think a sincere reading of the book leads to that conclusion. The problem goes deeper. It's cultural.

When a male leader is assertive, decisive, and direct, people may see him as strong leader. When a female exhibits these same qualities, people think she's bossy. In Lean In Sandberg quotes Deborha Gruenfeld, a professor of leadership and organizational behavior at Stanford as saying,
"Our entrenched cultural ideas associate men with leadership qualities and women with nurturing qualities and put women in a double bind... We believe not only that women are nurturing, but that they should be nurturing above all else. When a woman does anything that signals she might not be nice first and foremost, it creates a negative impression and makes us uncomfortable." (Sandberg, 2013, p. 43)

Echoes of this are present throughout our culture. I found it in Maria Konnikova's book The Biggest Bluff: How I Learned to Pay Attention, Master Myself, and Win, in which Konnikova documents dedicating a year to learning the popular poker game of Texas Hold 'em and competes in the World Series of Poker. Her coach is advising her to play more aggressively. She's struggles with this advice saying,

"It comes to me then, the thing that's been nagging at me, and I don't at all like the realization: a lot of my failure to up the aggression factor is due to my social conditioning. Over the years, I've learned that it doesn't pay to be aggressive while female. It's unattractive to those in power namely men, but also some of those women who have managed to make it to the top and now don't want to jeopardize their position." (Konnikova, 2020, p. 101)
More succinctly, "... success and likeability are negatively correlated for women." (Sandberg, 2013, p. 153)

We need to overcome this cultural resistance and celebrate good leadership qualities regardless of whether they come from men, women or non-binary individuals. Good leaders should be recognized as good leaders regardless of biological sex or gender.

If women in leadership roles were common this bias against female leaders may fade. As Sandberg says, "Real change will come when powerful women are less of an exception." (Sandberg, 2013, p. 50)

Recognizing that we may have implicit biases against female leadership and talking about how to overcome it may help improve things -- "The simple act of talking openly about behavioral patterns makes the subconscious conscious." (Sandberg, 2013, p. 148)

One story Sandberg recounts further underpins the cultural bias:
"Jocelyn Goldfein, one of the engineering directors at Facebook, held a meeting with our female engineers where she encouraged them to share the progress they had made on the products they were building. Silence. No one wanted to toot her own horn. Who would want to speak up when self-promoting women are disliked?" (Sandberg, 2013, p. 44)

In general, I think most self-promoters are disliked regardless of gender, but consider the situation, an engineering director encouraging female engineers to "share the progress on the products they were building." Speaking up in this context hardly seems like self-promotion, but I'm a male, and the fact that I see it this way may be more evidence of the problem.

What follows regarding this situation is interesting, "Jocelyn switched her approach. Instead of asking the women to talk about themselves, she asked them to tell one another's stories. The exercise became communal, which put everyone at ease." (Sandberg, 2013, p. 44)

As an engineering leader, I am interested in this communal approach because as Sandberg tells us and my own experience has shown, "... well-functioning groups are stronger than individuals." (Sandberg, 2013, p. 48)

Reading Lean In gives one the sense that a vicious cycle is at work. Cultural biases against strong females and a desire to be liked, dampen women's desire to speak up and may prevent them from seeking leadership positions. The resulting lack of representative female leadership perpetuates the cultural bias that leadership roles aren't for women and reinforces the stereotype that women should be nice and nurturing rather than strong and assertive. The cultural pressure to be nurturing may reinforce women's thinking about childrearing, causing them to leave the workforce and too often to leave before leaving again reducing the number of women in the workforce and in positions of leadership.

In the book Sandberg speaks about mentorship as a possible means of improving things. Here again the vicious cycle is reinforced. Because there are more men in positions of leadership and fewer women in the workforce, male leaders typically choose to mentor junior men in their organizations simply because there are more of them.

"Mentorship and sponsorship are crucial for career progression. Both men and women with sponsors are more likely to ask for stretch assignments and pay raises than their peers of the same gender without sponsors." (Sandberg, 2013, p. 66)

If there were more women in leadership positions, more junior women in organizations may find good mentors. 

In the first post in this series, I quoted Sandberg quoting Kunal Modi. Recall that Modi said, "for the sake of American corporate performance and shareholder returns, men must play an active role in ensuring that the most talented young workers (often women...) are being encouraged to advocate for their career advancement..." (Sandberg, 2013, pp. 165-166)

"Men of all ages must commit to changing the leadership ratios. They can start by actively seeking out qualified female candidates to hire and promote. And if qualified candidates cannot be found, then we need to invest in more recruiting, mentoring, and sponsoring so women can get the necessary experience." (Sandber, 2013, p. 166)

On the above point of being unable to find qualified candidates and the call to invest more in recruiting, mentoring, and sponsoring female candidates, I'd be curious to hear from the economists. Is this an effective use of a company's resources? Does it make more financial sense to just hire from the available supply of talent? I believe there's value in a diverse team, but how is that effectively measured? How much additional time and effort should a profit driven company spend recruiting? What is the return on that investment? There are anecdotes online and references to studies showing that women led companies outperform male led companies. (Novotney, 2023)

If we're unable to spend extra effort to recruit qualified females, it's a no brainer that we should encourage our best contributors to advocate for themselves, to strive for more responsibility, to speak up, and to lean in. Being a manager and a mentor aren't the same thing. Encourage members of your team to find mentors. Help them find one, if they want, and be a mentor to someone outside your team or organization.

As Modi said our motivations don't need to be altruistic because more female leadership doesn't just "lead to fairer treatment for all women." Sandberg tells us that "Research already suggests that companies with more women in leadership roles have better work-life policies, smaller gender gaps in executive compensation, and more women in midlevel management." (Sandberg, 2013, p. 171)

"More female leadership will lead to fairer treatment for all women." (Sandberg, 2013, p. 171) 

I hope that one day female leadership is so common we don't really notice it anymore. As Sandberg says,
"In the future, there will be no female leaders. There will just be leaders." (Sandberg, 2013, p. 172)

If you're a man in a traditional (i.e. heteronormative) relationship, you can help in simple ways. "... when asked at a conference what men could do to help advance women's leadership, Harvard Business School professor Rosabeth Moss Kanter answered, 'The laundry.'" (Sandberg, 2013, p. 110)

I've been talking to my wife about Lean In and many of the topics discussed in this series of posts. We were talking about doing chores around the house the other day and she was telling me about some videos she'd seen online of women talking about their husbands doing things around the house like vacuuming, cleaning bathrooms, etc. and telling their wives that they were trying to "help out." These women were glad for the efforts, but annoyed at the reasoning. Don't do things around your own home to "help out," do them because you're an adult living in the environment and the tasks need doing. When you say you're doing it to "help out," you're implying that it's not actually your responsibility.

Lean In has more to say on these topics than I've covered in this series of posts. Writing these posts has helped me think more deeply about these issues. If you've read or skimmed these posts, I hope they have given you something to think about. In that vein, this time I'm going to leave you with Aretha Franklin's "Think."

Next post, I'm going to share some of the insights from Lean In that I thought were interesting or thought provoking and not necessarily relevant to the central theme of the book, but things that gave me a new perspective, helped me clarify my thinking, challenged me in some way, or that I identified with.

Friday, March 8, 2024

What's the cause of the problem part two

This is the fourth post in a series of posts inspired by reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead

Previously we discussed lack of confidence as one of the causes that Sandberg cites for the lack of women in leadership roles. Another reason she gives is pregnancy and childrearing. It's not just that women leave the workforce when they give birth, it's also that they factor pregnancy and childrearing into decisions about whether or not to take on bigger roles and more responsibilities -- "they leave before they leave," Sandberg says. (Sandberg, 2013, p. 93)

Sandberg encourages women to take the opposite approach. If they are interested in achieving more, she encourages them to pursue bigger roles and more responsibility. "The months and years leading up to having children are not the time to lean back, but the critical time to lean in." (Sandberg, 2013, p. 95)

According to Sandberg, "forty-three percent of highly qualified women with children are leaving careers, or 'off-ramping' for a period of time." (Sandberg, 2013, p. 98)

What's more, "only 74 percent of professional women will rejoin the workforce in any capacity, and only 40 percent will return to full-time jobs..." (Sandberg, 2013, p. 102)

That's a significant percentage of "highly qualified" individuals leaving the workforce. This loss of good people impacts the companies and organizations where they work, but it has an even greater impact on the lifetime earnings of those women. Obviously those who never return face the greatest impact to their earnings, but even for those who return, "controlling for education and hours worked, women's average annual earnings decrease by 20 percent if they are out of the workforce for just one year. Average annual earnings decline by 30 percent after two to three years." (Sandberg, 2013, p. 102) Factor in compounding over a lifetime and the financial impacts are highly consequential.

I mentioned previously that I'm the father of daughters. My wife and I did the "back of the envelope" math and calculated that having her quit her job to stay home with our children was more cost effective than having her work and paying for full-time childcare. Except we didn't factor in the loss of future earnings. In fact, I was never even aware of this oversight until I read "... professional women need to measure the cost of child care against their future salary rather than their current salary." (Sandberg, 2013, p. 102)

I love this insight by Sandberg. Impact on future earnings is just the kind of thing an excellent business leader would factor in when making a decision to leave the workforce, even if temporarily, for an extended amount of time following childbirth.

We believe there are benefits to having a parent deeply involved in the day-to-day childrearing, but Sandberg provides evidence that children raised by multiple caregivers fair just as well as those where their mother is the primary caregiver.
"In 2006, the researchers released a report summarizing their findings, which concluded that 'children who were cared for exclusively by their mothers did not develop differently than those who were also cared for by others.' They found no gap in cognitive skills, language competence, social competence, ability to build and maintain relationships or in the quality of the mother-child bond." (Sandberg, 2013, pp. 135-136)
Further, "Some data even suggest that having two parents working outside the home can be advantageous to a child's development, particularly for girls." (Sanders, 2013, p. 136) And Sandberg tells us, "We all need to encourage men to lean in to their families." (Sandberg, 2013, p. 113) after all, 
"children with involved and loving fathers have higher levels of psychological well-being and better cognitive abilities. When fathers provide even just routine child care, children have higher levels of educational and economic achievement and lower delinquency rates. Their children even tend to be more empathetic and socially competent. These findings hold true for children from all socioeconomic backgrounds, whether or not the mother is highly involved." (Sandberg, 2013, p. 113)

Ultimately it should be up to each individual to decide if they want to leave the workforce to raise children or if they want to go after that next promotion (or both), but individuals should be informed about the financial implications of those decisions and the equation isn't just about the present day cost of childcare.

Now I'll leave you with some related words from Beyoncé from her song Flawless, enjoy the video.
I took some time to live my life
But don't think I'm just his little wife
Don't get it twisted, get it twisted
This my shit, bow down, bitches

Sunday, March 3, 2024

What's the Cause of the Problem?

This is the third post in a series of posts inspired by reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead. In the previous post, I shared some of the statistics from Sandberg's book and other sources that show that women are underrepresented in leadership and technical roles. Even in fields where women dominate leadership positions, like human resources roles, they are underpaid compared to their male counterparts.

In this post, I'll share some notes from the book that may explain why this disparity persists.

Is it a confidence game?

One of the reasons Sandberg cites for women being underrepresented may be tied to a lack of confidence, or perhaps a surplus of confidence from their male counterparts.

"An internal report at Hewlett-Packard revealed that women only apply for open jobs if they think they meet 100 percent of the criteria listed. Men apply if they think they meet 60 percent of the requirements. This difference has a huge ripple effect. Women need to shift from thinking 'I'm not ready to do that' to thinking 'I want to do that -- and I'll learn by doing it.'" (Sandberg, 2013, p. 62)

Sandberg goes on to share an anecdote from Cisco's then chief technology officer, Padmasree Warrior. The Huffington Post asked her, "What's the most important lesson you've learned from a mistake you've made in the past?" (Sandberg, 2013, p. 35)

Warrior responds, 
"I said no to a lot of opportunities when I was just starting out because I thought, 'That's not what my degree is in' or 'I don't know about that domain.' In retrospect, at a certain point it's your ability to learn quickly and contribute quickly that matters. One of the things I tell people these days is that there is no perfect fit when you're looking for the next big thing to do. You have to take opportunities and make an opportunity fit for you, rather than the other way around. The ability to learn is the most important quality a leader can have." (Sandberg, 2013, p. 35)
Sandberg elaborates on the confidence issue, "self-doubt becomes a form of self-defense... We put ourselves down before others can." (Sandberg, 2013, p. 41)

I've been told throughout my career that I'm self-effacing, overly modest and too self-critical. I never recognized until reading these words that it could be a form of self-defense. Like Warrior, I've also held myself back from applying for roles I was interested in because I didn't think I was a perfect fit.

We do ourselves a disservice when we sell ourselves short and hold ourselves back due to a lack of confidence, thinking we can't learn some new thing quickly enough. I'm reminded of attending interview training when I worked at Microsoft. Confidence was one of the things that we were asked to assess as data supports to the idea that confidence is a predictor of employee effectiveness.

Confidence isn't fixed, fortunately. We can improve our self-efficacy through new achievements. The old saying that "Success breeds success," is true. As managers, we can help by encouraging our teams; reminding them that we believe in them; giving them more responsibility and increasingly challenging tasks; being there when they need help, and when the fail at something, helping them reflect on, learn from the failure, and move on. Too much focus on failures undermines confidence.

Self-doubt holds us all back, and Sandberg points to data indicating this is a bigger problem for women than for men, hence it contributes to the disparity in female representation in leadership and technical roles. In the next post in this series, I'll continue to exploring more of the reasons for this disparity.

If you need a little confidence boost, put on your headphones and crank this up.

Friday, February 23, 2024

The Problem is the People, but Which People?

In my second job out of college, my boss' boss would often say, "Wherever you go there's always a problem and the problem is always the people." I wondered to myself, "Yeah, but which people?"

In my previous post in this series, I recounted how reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead, reminded me of my grandfather refusing to let my grandmother pursue her master's degree because he didn't want her to have more formal education than he did; a sad example of a woman wanting to lean in to her career and a man not just failing to support her through passivity, but actively preventing her from achieving more.

I mentioned in that post that my motivation for reading Lean In was to become a better leader. Sandberg is an amazingly successful business leader. She was integral to building both Google and Facebook. Another motivator was that I want to be able to speak to my daughters about Sandberg's book from having read it, not from having read about it. 

Lean In came out in 2013 and was a number one international bestseller, but it wasn't without criticism. I'm not going provide a critique or a review as I'm not qualified to do so. I will share some of the things I thought were interesting and valuable to me. I encourage you to read it for yourself and to read the criticism also.

Sandberg tells us she wrote the book
"to encourage women to dream big, forge a path through the obstacles, and achieve their full potential. I am hoping that each woman will set her own goals and reach for them with gusto. And I am hoping that each man will do his part to support women in the workplace and in the home with gusto. As we start using the talents of the entire population, our institutions will be more productive, our homes will be happier, and the children growing up in those homes will no longer be held back by narrow stereotypes." (Sandbrerg, 2013, p. 171)
mostly agree with Sandberg. There is some daylight between us around the heteronormativity of the statement, but in general, I agree that we should encourage and support women to reach their full potential. I want the same for anyone regardless of their gender or where they fall on the spectrum of biological sex. I think any good natured, rational person should want any other person to achieve their full potential.

Sandberg's reasons for writing Lean In beg the question, are women failing to reach their full potential? The book and a few minutes searching online make it clear that women are underrepresented in traditional positions of power, and are paid less than men for the same work. 

Women make up 50 percent of the population, yet they currently hold 10 percent of Fortune 500 CEO positions and that's a record high (Fortune, Hinchliffe). Kunal Modi, cited in my previous post points out that women make up only 17 percent of the U.S. Congress and 16 percent of C-suites. (Huffington Post, Modi)

"Women earn 57 percent of undergraduate degrees and account for nearly 60 percent of all graduate school enrollment. However, in the disciplines that continue to define America's economic future -- engineering, computer science, mathematics, and physical sciences -- women earn less than half of all degrees." (Huffington Post, Modi)

There's debate about the cause of these disparities. Recall the 10 page document authored by James Damore, "Google's Ideological Echo Chamber," where Damore presented evidence that biological differences between men and women may explain these disparities. As with so much of social science, here, the science is unsettled. (Wired, Molteni)

Damore's memo cites studies that show "men systematize, women empathize" and that this may be the reason for women's underrepresentation in technical or leadership roles rather than active discrimination. Yet even in high empathy roles like human resources where "76% of HR Managers are women, male HR Managers earn 40% more than their female counterparts." (Visier, Barron) Read that again. If it's not active discrimination, there are egregious sins of omission resulting in this pay gap. 

Given these facts, it's hard to believe anyone would argue in good faith that women are realizing their full potential. 

If we accept that there's a problem, what is the cause? My old boss' boss would say it's the people. Sure, but which people? Why are women underrepresented in leadership and how do we fix it? Sandberg has much to say on this and I'll dive into it in my next post

Until then, I'm taking inspiration from Beyoncé's going hard and slaying all day, maybe you will too.



Saturday, February 17, 2024

Lean In for Yourself

Small family farming is a labor intensive way to go broke. 

When I was young I spent some weeks each summer with my grandparents. As farmers and cattle ranchers, my grandparents scratched out an existence. My grandpa was up before dawn feeding cattle and out working fields of corn, milo, sorghum, soybeans, and wheat until after sunset. There were too few boom years, and too many bust years. They had neighbors who lost everything. My grandparents survived.

One thing that helped keep them afloat was my grandmother's rural elementary school teacher salary. When we ran errands together we frequently encountered her former students and it was clear from the things they said that they loved and respected her.

At one point she decided to get her master's degree. My granddad stopped her. He didn't like the idea that she would have more formal education than he did.

I've been thinking about this bit of my family history lately, prompted by reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead.

My granddad may have perceived that his pride was spared by preventing my grandmother from pursuing her master's, but I've been thinking about the emotional, financial, and communal costs. Was my grandmother wounded by this? How could she not be? She would have made more money over her career and may have been a better educator, which would have benefited an entire community.

If he would have been supportive, allowed her to lean in to her career and leaned in more at home himself, how would things have been different?

As I said, my reflections on this were prompted by Sandberg's book, which I read because I'm a people manager and Sandberg is an incredibly accomplished leader and I want to pick up the lessons of great leaders wherever I can. 

I'm also a father to three young women. I want to support them in their careers and Sandberg is arguably one of the most successful business leaders of all time, perhaps I could learn something that would help me help my daughters.

This personal family anecdote came to me as I was thinking about this quote from Sandberg's book:

"Kunal Modi, a student at Harvard's Kennedy School, wrote an article imploring men to 'Man Up on Family and Workplace Issues.' He argued that 'for the sake of American corporate performance and shareholder returns, men must play an active role in ensuring that the most talented young workers (often women...) are being encouraged to advocate for their career advancement... So men, let's get involved now -- and not in a patronizing manner that marginalizes this as some altruistic act on behalf of our mothers, wives, and daughters -- but on behalf of ourselves, our companies, and the future of our country." (Sandberg, 2013, pp. 165-166)

Modi calls men to support "the most talented young workers," not out of altruism, "but on behalf of ourselves," Had my granddad supported my grandmother's pursuit of her master's degree, it would have been to his benefit, to the benefit of his family, and to the benefit of the community.

We should follow Modi's advice and ensure "that the most talented young workers (often women...) are being encouraged to advocate for their career advancement." We shouldn't do this out of altruism, as Modi suggests, we should do it because it will benefit everyone, including ourselves.

Note that Modi doesn't say we should do this for women only, he says we should do it for our "most talented young workers," and the implication is that that group may include women, and if it does, we should be encouraging them because they are the most talented. This doesn't appear to be about affirmative action or Diversity, Equity and Inclusion. It's about encouraging the best, period.

This is the first in a series of posts where I'm reflecting on Sandberg's book in an effort to synthesize my own understanding of the issues and to glean general management insights. In the next post, I'll offer evidence from Sandberg's book and elsewhere supporting her thesis that there is a problem.

I'll end this post with Taylor Swift's tribute to her grandmother, Marjorie. 

Tuesday, July 13, 2021

RIP Grant W. Dotson -- A dear friend

It's been a rough day. 

About 18 months ago a friend of mine from high school posted a Go FundMe on Facebook for a mutual friend who was battling cancer. This mutual friend was someone I'd been very close to in elementary and middle school. As happens, we remained friends, but drifted apart a bit in high school, different interests and new friend groups, etc.

We went off to different colleges and touched base infrequently, but we did touch base. He came to visit me when certain musicians were performing in town and we would go to those shows together. We shared a love for jazz bands and artists like Medeski, Martin and Wood, Bill Frisell, Miles Davis, etc.

I had no idea he'd been fighting cancer for more than a year. I called him up and got the full story. He was upbeat and optimistic that he would beat it. I planned to go see him, then COVID hit. We stayed in touch, talked every few weeks and texted back and fourth almost daily. It was as if no time had past in the intervening years since childhood.

A few weeks ago, he texted me that he was in the hospital. The cancer that had ravaged his liver and bowels had spread to his lungs. He was undergoing a tough round of chemo to "nip it from [his] lungs so he could return to bettersville." 

The texts became less frequent. I asked him how he was doing. He said the chemo had made things worse. He was on four liters of oxygen and still couldn't catch his breath. The optimism that he'd expressed for the last 18 months was gone. I cried, told him my heart was breaking for him, that I loved him and that if there was anything I could do for him, please let me know.

He thanked me for being a good friend. That was a week ago.

I meant to text him yesterday. Life got in the way. Last night I was laying in bed concerned. I picked up my phone and searched for obituaries in my home town where he still lived. Nothing, thankfully.

This morning a post in our high school class group on Facebook said that he had passed away yesterday. I cried again. My mind raced with memories of carefree days growing up with him as a constant companion. He was special. Always kind and caring.

Rest in peace, Grant. I already miss our conversations.

Hug your loved ones, cherish the moments. Life is short.

Tuesday, August 4, 2020

Hunting injected processes by the modules they keep

A relatively recent post showed how Metasploit's Meterpreter module made some noise on endpoints when the migrate command was used to move the agent code into a legitimate process, spoolsv.exe in our example.

One of the things we saw in that post was that when the agent migrates, it uses commonplace injection techniques that result in three dlls being reflectively loaded into the target process. These dlls are not registered with the process and therefore don't show up in the output of something like listdlls, but we were able to find them using gleeda's memtriage in combination with Volatility's malfind plugin. Worth mentioning again, memtriage is really useful because it facilitates some memory analysis without the need for a full memory dump. See the other post for details.

We also noted that these three dlls have dependencies on native Windows dlls and these dozen or so dlls are loaded at the time of agent migration. Depending on how long the target process has been running, these may be "late loaded dlls," which could be a powerful detection. These late loaded dlls are registered in the process, so we can go hunting for them using something like listdlls,  PowerShell's Get-Process cmdlet or a relatively new Kansa module built around the Get-Process cmdlet -- Get-ProcessesUsingModules.ps1.

This new module is one of the few Kansa modules that can take command line arguments, this makes it a bit awkward to use. There's an old post here on what this can look like and we'll dive into the specifics for this new module now.

PS > .\kansa.ps1 -Target $env:computername -ModulePath ".\Modules\Process\Get-ProcessesUsingModules.ps1 wininet.dll,iertutil.dll,winhttp.dll,dhcpcsvc6.dll,dhcpcsvc.dll,webio.dll,psapi.dll,winmm.dll,winmmbase.dll
,ole32.dll,mpr.dll,netapi32.dll" -Credential $cred

Above is an example command-line for running this new collector with a list of dlls. This list of dlls matches what we saw late loaded into our spoolsv.exe process following the migration into that process. Note the double-quotes around the name of the module and its arguments. It's also worth noting that depending on the configuration of the meterpreter agent, there may be different dlls loaded. In our example, I was using a reverse http handler. The example still stands, however. If you're analyzing a piece of malware and can determine what dlls it imports, you may be able to put together a list of modules that you can pass to this collector to see if there are processes that have those dlls loaded. The process may have other dlls loaded too, spoolsv.exe certainly does, but this list of dlls was a result of the agent migration and they are not normally loaded into spoolsv.exe.

Our console output from running this looks like the below, assuming verbose mode:

VERBOSE: Running module:
Get-ProcessesUsingModules
wininet.dll,iertutil.dll,winhttp.dll,dhcpcsvc6.dll,dhcpcsvc.dll,webio.dll,psapi.dll,winmm.dll,winmmbase.dll,ole32.dll,m
pr.dll,netapi32.dll
VERBOSE: Found logging.conf
VERBOSE: Running module on machines 0 to 1 of 1 (0.0 %)
VERBOSE: Waiting for Get-ProcessesUsingModules wininet.dll iertutil.dll winhttp.dll dhcpcsvc6.dll dhcpcsvc.dll
webio.dll psapi.dll winmm.dll winmmbase.dll ole32.dll mpr.dll netapi32.dll to complete.

Id     Name            PSJobTypeName   State         HasMoreData     Location             Command
--     ----            -------------   -----         -----------     --------             -------
7      Job7            RemoteJob       Completed     True            WINS2012R202         <# ...
WARNING: ProcessesUsingModules's output path contains arguments that were passed to it. Those arguments were truncated f
rom wininet.dlliertutil.dllwinhttp.dlldhcpcsvc6.dlldhcpcsvc.dllwebio.dllpsapi.dllwinmm.dllwinmmbase.dllole32.dllmpr.dlln
etapi32.dll to wininet.dlliertutil.dllwinhttp.dlldhcpcsvc6.dlldhcpcsvc.dllwebio.dllpsap to accommodate Window's MAXPATH
limitations of 260 characters.
VERBOSE: ### All Done ###

Note the MAXPATH issue. The way Kansa works, the directory names for the collector output include command line arguments and in this case, those arguments exceed the default limits on my Windows system, so Kansa makes some adjustments and truncates them.

What does the collector output look like, below is a snapshot of the output folder for this collector, note the long folder name.


Inside that folder there's a file, one for each targeted system, in our case there's only one. We ran with the default output type so we have a CSV file and it's contents are as follows:

"ProcessId","ProcessName","PSComputerName"
"1084","spoolsv","WINS2012R202"

This means on our targeted endpoint, we had a single process that had this set of dlls loaded, our injected spoolsv.exe process.

Happy hunting!

Overcoming our "bossypants" bias

This is the fifth post in a series of posts inspired by reading Sheryl Sandberg's book,  Lean In: Women, Work, and the Will to Lead .  W...