Enter your search text in the box above

Select a result to preview

Lab Tools Inventory — Windows 11 (.114)

#windows #windows-11 #lab #sysinternals #sysmon

Lab Tools Inventory — Windows 11 (.114)

Summary

Research tooling installed 2026-09-01 on lab host 192.168.50.114. Re-run the installer after VM snapshots restore or major rebuilds.
Installer ~/code/CodeCollector/win11_lab_tools_install.ps1
On VM C:\Users\tester808\win11_lab_tools_install.ps1
Install log C:\Tools\install-lab-tools.log
Baseline 20-lab-baseline-win11-114

Install / refresh

From MiniMac:

scp ~/code/CodeCollector/win11_lab_tools_install.ps1 tester808@192.168.50.114:C:/Users/tester808/
ssh tester808@192.168.50.114
powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\tester808\win11_lab_tools_install.ps1

Flags: -SkipSysmon, -SkipWingetExtras, -WhatIf

Directory layout

Path Contents
C:\Tools\Sysinternals\ Full Sysinternals Suite (151 .exe tools)
C:\Tools\Sysmon\ Sysmon64.exe, SysmonDrv.sys, SwiftOnSecurity config
Machine PATH Both directories added

GUI access — why VNC? where does it run?

VNC is not on the Mac mini

TightVNC Server runs inside the Windows VM (.114 on Proxmox). Your Mac mini (.127) is only the viewer — you open a VNC client there and connect to the VM.

flowchart LR
  subgraph proxmox [Proxmox host]
    VM["Win11 VM .114
TightVNC Server :5900
ProcExp / Procmon"]
  end
  MAC["Mac mini .127
VNC Client
SSH / scp"]
  MAC -->|"TCP 5900 (lab LAN)"| VM
  MAC -->|"TCP 22"| VM

Why you need it (or RDP)

Tool Runs where Works over SSH?
PowerShell, Sysmon queries, fltmc .114 Yes
Process Explorer, Procmon, Autoruns .114 GUI No — need a remote desktop

SSH gives you a shell on the VM. Sysinternals GUI tools need a graphical session on the Windows desktop — that’s what VNC (or RDP) provides from the Mac mini.

Your options (pick one)

Method Server location Client on Mac mini Status on .114
RDP .114:3389 Microsoft Remote Desktop app Working (preferred)
TightVNC .114:5900 Screen Sharing / VNC client Working (fallback)
Proxmox console Hypervisor Proxmox web UI → VM → Console Always works; no extra install

Connect from Mac mini

RDP:  192.168.50.114        (Microsoft Remote Desktop)
VNC:  vnc://192.168.50.114:5900   (fallback)
SSH:  ssh tester808@192.168.50.114

Firewall on .114 allows VNC/RDP only from 192.168.50.0/24 (lab LAN). The Mac mini at .127 is on that subnet.

Set TightVNC password (first time, Proxmox console or VNC):

"C:\Program Files\TightVNC\tvnserver.exe" -controlservice -setpassword
Tool Binary Module / use
Process Explorer procexp64.exe Module 5 — processes, DLLs, handles, tokens
Process Monitor Procmon64.exe DLL Part 1 — file/registry/thread activity
Autoruns Autoruns64.exe Module 6 — persistence inventory
TCPView tcpview64.exe Live network connections per process
Handle handle64.exe Open handles by process
Sigcheck sigcheck64.exe Authenticode, version, hash
VMMap vmmap64.exe Virtual memory map
Strings strings64.exe ASCII/Unicode strings in binaries
AccessChk accesschk64.exe ACL audit
ProcDump procdump64.exe On-demand process dumps
DbgView Dbgview.exe Debug print capture

Launch from Run or PowerShell after opening a new session (PATH refresh):

procexp64.exe
Procmon64.exe
Autoruns64.exe
EULA

Installer pre-accepts Sysinternals EULA in HKCU\Software\Sysinternals\*. GUI tools may still prompt once on first interactive launch.

Sysmon (installed)

Field Value
Service Sysmon64 — Running
Driver SysmonDrv — altitude 385201 (Activity Monitor band)
Config C:\Tools\Sysmon\sysmonconfig-export.xml (SwiftOnSecurity baseline)
Log Microsoft-Windows-Sysmon/Operational 
Get-Service Sysmon64
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 5 |
  Select-Object TimeCreated, Id, Message
fltmc filters | Select-String Sysmon

Update config after edit:

C:\Tools\Sysmon\Sysmon64.exe -c C:\Tools\Sysmon\sysmonconfig-export.xml

Top hunt IDs: 1 (process), 3 (network), 7 (DLL load), 10 (process access), 11 (file create), 22 (DNS). See Module 9.

Additional packages (winget)

Package Purpose
7-Zip (7zip.7zip) Archive extraction
WinDbg (Microsoft.WinDbg) Crash dump / kernel debugging

Logging enabled (installer)

Setting Status
PowerShell script block logging (4104) On (HKLM\...\ScriptBlockLogging)
Task Scheduler Operational log Enabled

Minifilter stack (post-install)

Filter Altitude Role
SysmonDrv 385201 Sysmon file/registry/network telemetry
WdFilter 328010 Defender real-time scan
UCPD 385250.5 User-mode crash/activity
applockerfltr 265000 AppLocker (if policy)

Procmon quick start (lab)

  1. Run Procmon64.exe as Administrator (RDP or local console — not over headless SSH).
  2. Filter → Filter… — e.g. Process Name is powershell.exe then Include.
  3. Capture 30–60 seconds during a lab exercise.
  4. File → Save → .PML under C:\Users\tester808\Documents\.
  5. Stop capture when done — Procmon fills disk quickly.

ProcExp quick start (lab)

  1. Run procexp64.exe as Administrator.
  2. Select powershell.exe → Ctrl+D (lower pane DLLs).
  3. View → Select Columns — enable Verified Signer, Command Line.
  4. Find Handle or DLL — search amsi.dll across processes.

Autoruns baseline export

Autoruns64.exe -accepteula -a * -c -o C:\Users\tester808\Documents\autoruns-baseline.csv

Re-export after software changes; diff CSVs for persistence drift.

Verification checklist

← Lab baseline · Evidence & EVTX · Lab workbook