| Tool | Use | Typical CTF / DFIR value |
|---|---|---|
| Autoruns | Persistence review | Run keys, services, tasks, browser helpers, WMI |
| Procmon | Filesystem / registry / process trace | See what malware touches on execution |
| Process Explorer | Live process tree + handles + DLLs | Parent/child tree, suspicious threads, command line |
| PsExec | Remote execution | Lateral movement understanding / testing |
| TCPView | Network connections | Beaconing and ephemeral ports |
| Sigcheck | Signature / hash / VT lookup | Fast triage of dropped executables |
| Strings | Unicode + ASCII strings | Richer than bare strings.exe output in Windows workflows |
| Handle | Open file / object handles | Who locks a file? who opened artifact X? |
| PsList / PsKill | CLI process tools | Low-friction shell triage |
- hide Microsoft / Windows entries first - sort by Publisher, then Image Path - inspect Logon, Services, Scheduled Tasks, AppInit, WMI - unsigned + odd temp path = immediate pivot - compare command line with parent folder contents
autorunsc64.exe -a * -c -h -m > autoruns.csv autorunsc64.exe -a ltsv -c -m > focused.csv # flags -a categories -c CSV -h hashes -m hide Microsoft entries
Process Name is malware.exe include
Operation is RegSetValue include
Operation is CreateFile include
Path contains \Run include
Path begins with C:\Users\Public include
Result is NAME NOT FOUND include
# malware loves repeated NAME NOT FOUND probes
- find dropped files and mutex names - identify registry persistence keys - recover config paths and staging folders - see DLL search order hijacks - capture child processes + command lines
- verify parent / child tree - inspect command line column - check image path, signer, VirusTotal score - lower pane: DLLs or handles - view threads for unusual start addresses
sigcheck64.exe -h -q sample.exe sigcheck64.exe -u -e C:\Windows\System32 strings64.exe -n 6 sample.exe handle64.exe suspicious.txt tcpview.exe # GUI; sort by state / remote address
psexec.exe \\host -u user -p pass cmd.exe pslist.exe \\host pskill.exe -t PID # forensic note PsExec itself leaves traces: - service creation - event logs - ADMIN$ / IPC$ usage - dropped PSEXESVC service binary
- identify persistence with Autoruns - execute sample in VM, trace with Procmon - inspect process tree in Process Explorer - confirm network with TCPView - hash/signature with Sigcheck - export observations into timeline notes