## Windows Security Tools

Built-in and Sysinternals tools you should know.

### Native Tools
*   **Task Manager**: Identify resource hogs.
*   **Resource Monitor**: Detailed network/disk view.
*   **Windows Defender Firewall**: Controls Inbound/Outbound traffic.
*   **BitLocker**: Full Disk Encryption. Protects data if laptop is stolen.

### Sysinternals Suite
A set of free tools active maintained by Mark Russinovich (Azure CTO).
1.  **Process Explorer**: "Task Manager on steroids". Shows DLLs loaded, handles open, and verify file signatures (detect malware pretending to be Microsoft).
2.  **Process Monitor (ProcMon)**: Real-time logs of File System, Registry, and Network activity.
    *   *Use*: Run malware, watch ProcMon to see what files it creates.
3.  **Autoruns**: Shows EVERYTHING that starts at boot. (Registry run keys, Scheduled Tasks, Services, Drivers). Best tool for finding persistence.
4.  **TCPView**: Real-time view of open ports and connections.