For me, it would probably be Process Monitor (ProcMon) from the Sysinternals suite.
Wireshark is incredible for anything network-related, but ProcMon has saved me more time when trying to figure out what a Windows system is actually doing.
You can watch things like:
file creation/modification
registry activity process behavior
DLL loading permission failures
persistence-related changes
* what an installer or suspicious program touches
The filtering is what really makes it useful. Once you learn how to filter by process name, path, operation, result, etc., you can cut through a ridiculous amount of noise.
My other must-haves would probably be:
Wireshark — packet/network analysis
Burp Suite — web application testing
Nmap — network/service discovery
CyberChef — encoding, decoding, hashes, data transformations
Autoruns — Windows persistence/startup investigation
Ghidra — reverse engineering/static analysis
If I could only keep one tool overall, though, I'd probably choose Wireshark simply because understanding what's actually happening on the wire is useful for security, troubleshooting, malware analysis, and learning protocols.
One thing I've learned is that knowing why a tool is giving you a result is a lot more valuable than just knowing the commands/buttons.
That's also why Wireshark and ProcMon are probably my favorites — they force you to understand what's actually happening underneath the GUI.
![[Image: rH1OGR3.gif]](https://i.imgur.com/rH1OGR3.gif)
