← Microsoft Interview Insights
I started with the obvious stuff: Task Manager, then moved to Process Explorer for more detail on parent-child relationships and unsigned binaries.
Start by outlining a systematic investigation process, from initial detection to deep analysis, emphasizing built-in Windows tools and logs. Highlight both quick checks and advanced techniques, showing you understand the trade-offs between speed and thoroughness. Conclude with how you would contain and remediate the threat.
Pro tip: Mention that you would first capture volatile data (like memory and network connections) before shutting down the system, as this evidence is lost on reboot. Also, note that you would correlate findings across multiple sources to avoid false positives.
Use Task Manager, Resource Monitor, or Get-Process to identify suspicious processes by name, resource usage, or unusual parent-child relationships.
Inspect active network connections with netstat or Get-NetTCPConnection, and check autorun locations (Registry Run keys, Startup folder, Scheduled Tasks) for persistence mechanisms.
Examine Windows Event Logs (Security, System, Application), Sysinternals tools like Process Explorer and Autoruns, and verify digital signatures of executables.
Capture a memory dump for offline analysis, and scan the file system for recently modified files, hidden directories, or alternate data streams.
Isolate the system from the network, terminate malicious processes, remove persistence, and apply patches or configuration changes to prevent recurrence.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.