So what are these tools we're going to be using to monitor? So
there are a lot of different tools that you can use to monitor
just various aspects of the system.
We're going to talk about a couple of ones that are pretty
common. When you install your tools onto your sandbox, we've
talked about making sure you snapshot,
but I would also say make sure you run your tools at least once before you
snapshot because some of these tools have you EULAs that you have to click
through, the end user license agreements.
And so you don't want to have to click through that every single time you run
the tool if you snapshot it in the wrong place. And I've done that, and it's
more of an annoyance, but it's something, kind of lessons learned, make sure
you at least run it once. Absolutely,
especially if you're setting everything up to kind of run
automatically or run from a scripted solution because it's
multiple tools, and so if you're like,
all right, do my monitoring, but you have EULAs waiting to be
accepted, and they're not running. Right. Right. So do you want
to get into some these tools? Like what's the first tool we use
and what's its purpose?
Yeah, so here we're back in my virtual machine,
our sandbox that we've already set up.
I've installed a number of tools. One of the first tools that I
recommend running is Process Explorer. Process Explorer is
basically Task Manager on steroids.
It will do a lot of things,
basically just showing you the processes that are running,
but it shows you a lot more information than that.
And what I'm going to do just to show how it runs,
I'm going to just right‑click on it,
and I'm going to recommend running it as an administrator.
I recommend running all of these tools as administrators on your
sandbox just because if you don't run as administrator,
it could miss something, and some of these tools do require admin privileges.
That's a Sysinternals tool.
Yes, this is a Microsoft Sysinternals tool.
Actually,
all the tools we're talking about are free, so anybody can go
download them. They're not commercial tools.
You don't need to pay anything for them.
You just download them and run them and you're good.
Okay, great.
And we'll make a list of those resources available in the demo content
as well. Right. And what we'll use Process Explorer for is basically
just kind of watching what is going on in our system once we execute
our malware. So what I usually do is I just kind of push Process
Explorer here to the side.
I can see all the different processes that are running.
I'm just going to kind of close this one a little bit because
these are all system processes, and we could see all the
different processes that are running.
So what'll happen is when I execute the malware in my sandbox,
I'm going to kind of watch Process Explorer to see what happens.
Does the process immediately exit, which could mean that it's
detecting that it's in a VM or that my tools are running. Is it
launching another program? And we'll see that by the malware having a
child process underneath it or something like that. Does it restart
itself? This is kind of a visual indicator for us to see what's going
on on the system.
So you have watch it while it's happening.
Yeah, absolutely, absolutely.