Lion Cipher Lab
Triage a Windows endpoint with Sysinternals
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Before anyone can hunt an intruder, they have to know what normal looks like on a real endpoint, and how to pull an honest picture of what a Windows machine is doing right now: what auto-starts at boot and login, which processes are running and who launched them, what they are touching on disk and in the registry, and who they are talking to on the network. Microsoft's Sysinternals suite gives you all of that for free, and it is the same toolkit working defenders reach for first. Learning to read these views on a machine you own turns triage from a vague idea into a repeatable routine, and it…
What you'll learn
- reading auto-start and persistence entries with Autoruns
- reading the process tree, parent/child links, and open handles in Process Explorer
- verifying Authenticode digital signatures (and why signed is not the same as safe)
- watching live file and registry activity with Process Monitor
- turning on durable endpoint logging with Sysmon and a community config
- reading live network connections with TCPView
- building a defensible triage habit on a machine you own
Steps in this lab
- What triage is, and the boundary
- Get the tools from Microsoft
- Autoruns: what starts without you
- Process Explorer: the process tree and its handles
- Verify signatures, and why signed is not safe
- Process Monitor: watch the machine breathe
- Sysmon: durable logging so you are not blind next time
- TCPView, then the honest limit of a clean triage