🔬 Sysinternals Suite

Sysinternals Suite is a collection of advanced Windows utilities created by Mark Russinovich (now part of Microsoft). Many professional incident responders use these daily. CyberPatriot advanced/platinum teams should know the key tools.

Process Explorer (procexp.exe)

• •Like Task Manager but far more powerful — shows parent-child process relationships
• •'Verify Image Signatures' (Options menu) — shows which processes are signed by Microsoft vs unsigned (suspicious)
• •VirusTotal integration — right-click any process to check its hash against 70+ antivirus engines online
• •Shows exactly what DLLs each process has loaded, and what network connections it's using
• •Finds malware that hides from Task Manager using rootkit techniques

Autoruns (Autoruns.exe)

• •Shows everything that runs automatically at startup — services, scheduled tasks, registry run keys, browser extensions, DLL hijacks, and more
• •Enable 'Verify code signatures' and 'VirusTotal' under Options → Scan Options
• •Look for entries with no publisher / unknown signer and high VirusTotal detections = malware
• •Uncheck a box to disable an autorun entry without deleting it (reversible)

TCPView (Tcpview.exe)

• •Shows all active TCP/UDP connections — which process, which port, which remote address
• •Enable 'Resolve Addresses' to see domain names instead of IP addresses
• •Look for connections on unusual ports or to unexpected remote addresses
• •Competition: nc.exe (netcat) listening on port 1337 = backdoor — terminate and investigate

Common Competition Scenario: Netcat Backdoor

# Detect backdoor with netstat
netstat -ano          # look for unusual listening ports (e.g. 1337, 4444, 9001)
 
# Find the process using port 1337
netstat -b -ano | findstr 1337
 
# Kill it (replace PID with actual number)
taskkill /PID <PID> /F
 
# Check Autoruns for persistence — does nc.exe start at login?
# Open Autoruns → Logon tab → look for nc.exe entries