English · Français
Practical demonstration of malware tracing on Windows 11, using Microsoft Sysinternals tools.
NetWorking Solutions Inc. (NSI) is an IT services company that designs, deploys and maintains hardware and software infrastructure for its clients.
A client asked NSI for a security analysis of its employees' workstations. A cybersecurity expert is sent on site to assess the computers in use, both desktops and laptops. The assessment covers the installed software, with a particular focus on monitoring running processes to detect vulnerabilities and malware.
Two tools are recommended for this process analysis: Process Monitor and Process Explorer. They give a detailed view of what is happening on each machine, making it possible to spot security flaws and malicious programs. The demonstrations explain how each tool works and why it matters.
- Process Monitor: real-time monitoring of files, registry and processes.
- Autoruns: lists every program that starts automatically.
- Process Explorer: an advanced task manager.
- Git Bash: a Git command line for Windows.
All tools are portable: download them and run them, no installation needed.
Use this project when you suspect malware or a backdoor on a system.