Windbg, Autoruns, Wireshark) - It checks that there are no drivers loaded from security-related software (e.g. groundling32.sys) - It checks that the status of certain services belonging to security-related software meets certain conditions (e.g. windefend, sense, cavp) - It checks that the host “api.solarwinds.com” resolves to an expected IP address