The Sysinternals Suite (Mark Russinovich, Microsoft) is the indispensable toolkit for Windows analysts. CySA+ candidates should know the role of each headline tool:
-
Process Explorer — a supercharged Task Manager: signed binaries, loaded DLLs, VirusTotal lookups, parent/child trees.
-
Process Monitor (Procmon) — file/registry/network activity in real time, with filters; primary tool for behavioural analysis.
-
Autoruns — every autostart location in Windows (Run keys, services, scheduled tasks, BHOs, AppInit DLLs, …).
-
Sysmon — kernel driver + service that emits rich Event Log entries (process create, network connect, file create-time changes, registry).
-
TCPView — live socket viewer.
- PsExec — remote command execution (frequently abused by attackers; SOC analysts must recognise PsExec service install events).