Lab 6 of 17 · By Michael Stout
In this lab
Use Copy beside a command to copy it exactly.
Investigate a live host with Sysinternals
Chapter 3 covers system resources, unauthorized processes, and anomalous activity as host-based indicators. Task Manager barely scratches any of that. The Sysinternals Suite — free, from Microsoft — is what analysts actually reach for.
Task Manager wasn't built for this
Task Manager shows you a process name and a CPU number. It won't show you whether that process is digitally signed, what it's connected to, or what launched it at boot — the exact questions Chapter 3 asks about “unauthorized software and suspicious and rogue processes.” Process Explorer, Autoruns, and TCPView answer those questions directly, and they're all free.
The suite is a folder of standalone .exe files — nothing to install, and easy to run from a USB drive on a machine you're investigating rather than your own.
What you'll need
Any supported Windows version — the suite runs from a folder, no install required.
Administrator rights, to see every process and connection rather than just your own.
About 200 MB for the full suite as a zip.
20–30 minutes.
Download the suite
- Download it. Go to
learn.microsoft.com/en-us/sysinternalsand get the Sysinternals Suite, or pull it directly:https://download.sysinternals.com/files/SysinternalsSuite.zip
- Extract it. Unzip to a folder such as
C:\Sysinternals. There's no installer to run — each tool is its own executable. - Accept the license once. The first time you run any tool, it shows a one-time Sysinternals license dialog. Click Agree.
Three tools, three questions
- Process Explorer (
procexp64.exe) — run as administrator. Right-click any process and choose Check VirusTotal (opt-in, uploads a hash) or Properties → Image to check whether its binary is digitally signed. An unsigned process running from a temp folder is worth a second look. - Autoruns (
autoruns64.exe) — run as administrator. Review the entries under the Logon tab: everything set to start automatically. Persistence is how malware survives a reboot, so this is where you'd find it. - TCPView (
tcpview64.exe) — lists every live network connection, live, next to the process that owns it. Sort by state and look for anything ESTABLISHED to an address you don't recognize.
Plenty of legitimate internal tools and small utilities are unsigned. Treat every flag from Process Explorer, Autoruns, or TCPView as a lead to investigate, not a verdict — the same discipline Chapter 3 asks of any single indicator.
Sources. Microsoft, Sysinternals Suite, learn.microsoft.com/en-us/sysinternals, direct download at download.sysinternals.com/files/SysinternalsSuite.zip.