CyberPatriot Resources · Resource 06
Sysinternals & Windows Utilities
Use Microsoft Sysinternals and built-in Windows utilities to inspect processes, persistence, file activity, network endpoints, signatures, permissions, services, and evidence without guessing.
These tools are strongest when they answer a specific question. Collect evidence first, correlate it with mission context, then make the narrowest justified change.
Tool rule
Use the tool to answer a question, not to hunt randomly
A process name, unsigned file, listener, or startup entry is only a clue. Use multiple evidence sources before classifying or changing it.
Official Microsoft references
Sysinternals Suite
Microsoft's bundled collection of Sysinternals troubleshooting and diagnostic utilities.
Open Microsoft reference →
Process Explorer
Inspect active processes, ownership, handles, loaded DLLs, and parent-child process relationships.
Open Microsoft reference →
Process Monitor
Observe real-time file system, Registry, process, thread, and related operating-system activity.
Open Microsoft reference →
Autoruns
Review many Windows auto-start locations including logon entries, services, drivers, scheduled tasks, and other persistence points.
Open Microsoft reference →
TCPView
Inspect TCP and UDP endpoints, local and remote addresses, connection state, and owning processes.
Open Microsoft reference →
Sigcheck
Inspect file versions, hashes, digital signatures, certificate chains, and signing information.
Open Microsoft reference →
Tool map
Process Explorer
Processes, ownership, parent-child relationships, handles, and loaded modules.
Question
What is running, who owns it, and what is it connected to inside the system?
Process Monitor
Detailed activity involving files, Registry keys, processes, and threads.
Question
What is this process actually touching or changing right now?
Autoruns
Startup and persistence locations across Windows.
Question
What is configured to launch automatically and from where?
TCPView
Live TCP and UDP endpoints mapped to processes.
Question
Which process owns this listener or connection?
Sigcheck
Hashes, signatures, publisher information, and file metadata.
Question
What can I verify about this executable without assuming it is safe or malicious?
AccessChk
Effective permissions on files, Registry keys, services, processes, and other securable objects.
Question
Who can access or modify this object?
Handle
Command-line view of open file and object handles.
Question
Which process has this file or object open?
PsTools
Command-line system and process administration utilities.
Question
What system or process information can I inspect efficiently from the command line?
Evidence workflow
01
Start with a question
Choose a tool because you need a specific answer, not because the tool looks powerful.
02
Capture original state
Record the process, path, account, listener, startup entry, signature, or other relevant evidence before remediation.
03
Correlate
Combine Sysinternals evidence with Event Viewer, services, scheduled tasks, firewall state, and mission context.
04
Decide narrowly
Do not treat one suspicious-looking field as proof. Decide only when multiple pieces of evidence support the conclusion.
05
Verify
After an authorized change, confirm the security result and required Windows functionality.
Using the tools in competition practice
Unfamiliar process
Use Process Explorer to inspect process ownership and parent-child relationships.
Review executable path and loaded modules when relevant.
Use Sigcheck to inspect signature and hash information.
Check network behavior with TCPView if the process is communicating.
Correlate with services, startup entries, scheduled tasks, and event evidence before acting.
Suspicious startup behavior
Use Autoruns to identify the exact auto-start location.
Record the entry, executable path, publisher, user context, and category.
Check whether the executable is signed and whether the startup behavior is mission-required.
Correlate with scheduled tasks, services, Registry evidence, and related logs.
Change only the confirmed persistence mechanism and verify normal startup behavior afterward.
Unexpected network listener
Use TCPView or built-in networking tools to identify the endpoint and owning process.
Inspect the process with Process Explorer.
Determine whether the listener belongs to a required service.
Review firewall and service configuration.
Do not terminate the process solely because the port is unfamiliar.
File cannot be changed or removed
Use Process Explorer or Handle to identify which process has the file open.
Record the owning process and file path.
Determine whether the process is required or suspicious.
Preserve evidence before stopping anything.
Verify the affected application or service after the authorized action.
Built-in Windows utilities still matter
Task Manager
Quick process, startup, performance, user, and service visibility.
Event Viewer
Authentication, service, system, application, and audit evidence.
Services
Service state, startup type, account, and description.
Task Scheduler
Scheduled task triggers, actions, accounts, and persistence clues.
Resource Monitor
CPU, disk, network, and process activity.
Windows Security
Defender, firewall, account protection, and security status.
PowerShell
Structured inspection of processes, services, users, networking, and event data.
Command Prompt
Built-in observation and troubleshooting commands.
Weak habit vs better habit
Weak habit
Terminate an unfamiliar process immediately.
Better habit
Identify ownership, path, parent process, service relationship, network behavior, and mission purpose first.
Weak habit
Disable every Autoruns entry that is not Microsoft-signed.
Better habit
Treat signature information as one clue and classify the entry using path, owner, purpose, and scenario context.
Weak habit
A signed executable must be safe.
Better habit
Use signatures to verify publisher information, but still evaluate behavior and context.
Weak habit
A network connection means the process is malicious.
Better habit
Map the connection to the owning process and determine whether that communication is expected.
Weak habit
Keep every Sysinternals tool open during the whole round.
Better habit
Use the smallest tool that answers the current question so evidence stays understandable.
Weak habit
Use VirusTotal-style reputation as the decision by itself.
Better habit
Treat reputation as supplemental evidence and preserve the competition scenario and local system context.
Sysinternals resource checklist
Use official Microsoft Sysinternals documentation as the primary reference.
Choose the tool based on the question you need answered.
Capture original process, file, startup, or network state before remediation.
Use Process Explorer to understand process relationships and ownership.
Use Autoruns to investigate startup and persistence locations.
Use TCPView to map endpoints to processes.
Use Sigcheck to inspect hashes and digital signatures.
Correlate Sysinternals findings with built-in Windows evidence.
Do not assume unsigned means malicious or signed means safe.
Avoid terminating processes before understanding mission impact.
Verify Windows functionality after authorized changes.
Use the competition scenario as the final authority for required services and applications.