AD.3 — WIN11 Tool Reference | Alerts to Answers

Analyst Tools

The endpoint under observation and the forensic workstation. Sysmon supplies the telemetry the detection labs depend on, and the Zimmerman tools parse artifacts after the fact. Note throughout that Windows event channels are written with a forward slash when queried and with %4 when referenced as a file on disk. Same log, two spellings.

Tool	Path / Command	What It Does
Wazuh Agent	`C:\Program Files (x86)\ossec-agent\ossec.conf`	Same job as the Linux agent config, Windows side: which event channels get forwarded.
	`C:\Program Files (x86)\ossec-agent\ossec.log`	Windows agent log. Check here when win11 shows as disconnected.
Sysmon	`C:\Windows\Sysmon64.exe`	The installed service binary. Sysmon copies itself here during installation.
	`C:\Tools\Sysmon\sysmonconfig.xml`	The config deciding what gets logged. Detection quality depends almost entirely on this file.
	`Microsoft-Windows-Sysmon/Operational`	The event channel name used in queries and in the Wazuh agent configuration.
	`...winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx`	The same channel as a file on disk. %4 replaces the slash, because filenames can’t contain one.
	`HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv`	The kernel driver doing the actual observing.
	`HKLM\SYSTEM\CurrentControlSet\Services\Sysmon64`	The user-mode service that writes the events.
	`Sysmon64.exe -accepteula -i sysmonconfig.xml`	First-time install with a configuration.
	`Sysmon64.exe -c sysmonconfig.xml`	Swaps in a new config without reinstalling.
	`Sysmon64.exe -u`	Uninstalls Sysmon, including the driver.
	`ossec.conf → eventchannel localfile`	Tells the Wazuh agent to forward this channel to the manager.
Sysinternals	`C:\Tools\Sysinternals\`	Suggested lab folder. Directory choice does not remove elevation requirements; tools such as Process Monitor require administrator privileges for tracing.
	`Autoruns64.exe`	Shows everything configured to start automatically. Fastest way to spot persistence.
	`Procmon64.exe`	Live feed of every file, registry, and process operation. Powerful, and overwhelming without a filter.
	`procexp64.exe`	Task Manager with parentage, open handles, and loaded DLLs. Shows which process spawned which.
	`Tcpview64.exe`	Live list of open sockets mapped to the owning process.
	`handle64.exe`	Answers the question: which process is holding this file open?
	`strings64.exe`	Extracts readable text from a binary, often revealing URLs, paths, or commands.
	`HKCU\Software\Sysinternals\<Tool>\EulaAccepted`	Set to 1 to skip the first-run licence prompt, which otherwise blocks scripted runs.
	`\\live.sysinternals.com\tools\`	Run any tool straight off Microsoft’s file share without downloading it.
Windows Event Logs	`C:\Windows\System32\winevt\Logs\`	Where every Windows event log physically lives.
	`Security.evtx`	Logons, logon failures, privilege use, object access. Event 4625 is the failed-logon workhorse.
	`System.evtx`	Service starts and stops, driver loads, and hardware events.
	`Application.evtx`	Events written by installed applications.
	`Microsoft-Windows-PowerShell%4Operational.evtx`	Script block logging: the actual PowerShell code that ran, including deobfuscated one-liners.
	`Windows PowerShell.evtx`	Older-style PowerShell engine events.
	`Microsoft-Windows-Sysmon%4Operational.evtx`	Sysmon’s own channel on disk. See the Sysmon entry above.
	`wevtutil el`	Lists every available channel name on the machine.
	`wevtutil qe <channel> /f:text`	Reads events from a channel at the command line.
	`Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}`	PowerShell query for failed logons. Filtering at the source is far faster than filtering after.
	`HKLM\SYSTEM\CurrentControlSet\Services\EventLog\`	Channel settings including maximum size and retention behavior.
Windows Defender	`C:\ProgramData\Microsoft\Windows Defender\`	Defender’s working directory. Hidden by default.
	`...\Scans\History\Service\DetectionHistory\`	Binary records of past detections — evidence something was caught and removed.
	`...\Platform\<version>\MpCmdRun.exe`	Defender’s command-line interface: scan, update signatures, restore from quarantine.
	`C:\Windows\Temp\MpCmdRun.log`	Log of command-line operations.
	`Microsoft-Windows-Windows Defender/Operational`	The event channel carrying detection and remediation events.
	`Event ID 1116`	Malware detected.
	`Event ID 1117`	Action taken against detected malware.
	`Get-MpComputerStatus`	Shows whether real-time protection is on and how current the signatures are.
	`Get-MpThreatDetection`	Lists what Defender has detected, with timestamps.
	`Add-MpPreference -ExclusionPath <path>`	Excludes a folder so lab test files survive long enough for Wazuh FIM to observe them.
	`HKLM\SOFTWARE\Policies\Microsoft\Windows Defender`	Policy keys that override local settings.
NetworkMiner	`C:\Tools\NetworkMiner\NetworkMiner.exe`	The application. Copy-deploy — there is no installer.
	`...\AssembledFiles\`	Files carved out of a capture: images, executables, and documents that crossed the wire.
	`...\Captures\`	Where live captures land if you capture from the tool itself.
	`Unblock the ZIP before extracting`	Windows marks downloaded archives; extracting without unblocking leaves the DLLs blocked and the tool won’t start.
	`.NET Framework requirement`	Must be present or the executable fails to launch, often with no visible error.
Zimmerman Tools	`C:\Tools\ZimmermanTools\net9\`	Where the .NET 9 builds land. The current default.
	`Get-ZimmermanTools.ps1`	Downloads and updates the entire toolset in one run.
	`!!!RemoteFileDetails.csv`	Hash manifest the updater uses to decide what actually needs re- downloading.
	`EvtxECmd\Maps\`	Templates turning raw event XML into named columns. Update these separately from the tools.
	`RECmd\BatchExamples\`	Prewritten registry query batches for common investigations.
	`MFTECmd.exe`	Parses the NTFS master file table into a file-activity timeline.
	`PECmd.exe`	Parses prefetch: what ran, how many times, and when.
	`LECmd.exe`	Parses shortcut (.lnk) files, which record the original target path and volume serial.
	`SBECmd.exe`	Parses shellbags, showing which folders a user browsed.
	`RBCmd.exe`	Parses recycle bin records: what was deleted, by whom, and when.
	`EvtxECmd.exe`	Converts .evtx logs to CSV or JSON for analysis outside Windows.
	`Registry Explorer`	GUI registry viewer that handles transaction logs and deleted keys.
	`Timeline Explorer`	Opens very large CSVs and lets you filter and pivot them quickly.
	`Archive extraction and trust`	Use an approved extractor. Mark-of-the-Web behavior depends on extractor version and settings; verify provenance before unblocking trusted lab downloads.
	`.NET 9 runtime`	Required. The tools fail with an unhelpful error if it is missing.

Microsoft Defender will quarantine the EICAR test file before Wazuh’s file integrity monitoring observes the change unless a scoped exclusion is configured first. This is not a defect in either product. It is two controls doing their jobs in an order that happens to be inconvenient for teaching. Set the exclusion, run the exercise, then remove it.