Live Monitoring¶
Logs show the past. These tools show what the machine is doing right now: what's running, what's using the network, who's logged in.
Task Manager¶
Ctrl+Shift+Esc.
| Tab | Use it for |
|---|---|
| Processes | What's running and how much CPU, memory, disk, and network each uses. Sort by network to find something talking when it shouldn't be. |
| Performance | Live graphs. Steady network traffic on an idle machine is worth a look. Open Resource Monitor at the bottom for detail. |
| Startup apps | What runs at logon. Disable anything unfamiliar. |
| Users | Who is logged in. Right-click to disconnect or sign out. |
| Details | Every process with PID, user, and path. Right-click → Open file location. |
| Services | Services and status. Right-click → Open Services for the full tool. |
Resource Monitor¶
resmon, or from Task Manager's Performance tab. The Network tab shows every process with a network connection and the address it's talking to. A process you don't recognize connected to an address you don't recognize is a lead.
Command line¶
Who's logged in:
query user
Connections right now, with the program behind each:
netstat -abno | findstr ESTABLISHED
Processes sorted by CPU:
Get-Process | Sort CPU -Descending | Select -First 10 Name, Id, CPU, Path
Processes with a network connection:
Get-NetTCPConnection -State Established | Select LocalPort, RemoteAddress, RemotePort, @{n='Process';e={(Get-Process -Id $_.OwningProcess).Name}}
What "wrong" looks like¶
- A process named like a Windows component running from a user folder.
powershell.exeorcmd.exerunning with no window, started by something other than you.- An established connection to an outside address on an odd port from a process that isn't a browser or updater.
- A second session under Users that you didn't start.
- CPU pegged by something you don't recognize (cryptominers).
Example¶
Resource Monitor's Network tab shows svchost.exe (PID 5820) connected to an external address on port 4444. Real svchost.exe runs from System32 and doesn't talk to port 4444. Task Manager → Details → PID 5820 → Open file location: C:\Users\bob\AppData\Roaming\svchost.exe. Kill it, find the persistence (Malware Persistence), remove it.