“sysinternals”的搜索结果

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

Find WMI event subscriptions that let attackers retain access to Windows systems. Correlate Sysmon events with stored subscriptions and Autoruns results, inspect execution triggers and commands, and document risks and recommended remediation.

中文简介正在准备中。当前显示英语简介。

• Triaging Sysmon alerts for events 19, 20, and 21
• Finding WMI persistence during incident response
• Distinguishing suspicious subscriptions from legitimate settings

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

中文简介正在准备中。当前显示原文说明。

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

中文简介正在准备中。当前显示原文说明。

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

中文简介正在准备中。当前显示原文说明。

Sysinternals DebugView CLI (DbgViewCli) for capturing and analyzing usermode and kernel-mode Windows debug output from the command line. USE FOR: capturing OutputDebugString output, kernel DbgPrint/KdPrint capture, boot-time debug logging, remote debug monitoring, filtering debug output by PID or process name, crash dump analysis, automated debug capture with bounded execution. DO NOT USE FOR: non-Windows platforms, application-level logging frameworks (log4j, serilog), Azure Monitor or cloud telemetry, ETW tracing (use WPR/xperf instead), user-mode crash dumps (use WinDbg). Triggers: "debug output", "DbgView", "DebugView", "kernel debug", "capture debug logs", "boot logging", "OutputDebugString", "DbgPrint", "KdPrint", "remote debug monitor", "debug capture CLI".

中文简介正在准备中。当前显示原文说明。

Execute commands and binaries on remote Windows systems utilizing PsExec and SMB/RPC mechanisms. This skill details the mechanics behind tools like Sysinternals PsExec, Impacket's psexec.py, and their role in lateral movement via hidden administrative shares.

中文简介正在准备中。当前显示原文说明。

Execute and analyze malware samples within a highly controlled, instrumented sandbox environment to observe their true behavior, network communications, file system modifications, and registry changes in real-time.

中文简介正在准备中。当前显示原文说明。