Motasem Hamdan
<aside>
💡 Understand what normal behavior is and identify malicious processes running on an endpoint!
</aside>
Core Windows Processes TryHackme Walkthrough
Windows System Processes - An Overview For Blue Teams
- Setting up
- Task Manager
- System and System > smss.exe
- csrss.exe
- wininit.exe, wininit.exe > services.exe, and wininit.exe > services.exe > svchost.exe
- lsass.exe
- winlogon.exe
- explorer.exe
- Room Questions
Learn to use the Sysinternals tools to analyze Windows systems or applications.
Sysinternals TryHackme Walkthrough
- Setting up
- Task 1. Introduction
- Task 2. Install the Sysinternals Suite
- Task 3. Using Sysinternals Live
- Task 4 & 5: File and Disk Utilities