Using Windows Resource Monitor to detect suspicious network activity

Windows ships with a powerful diagnostic utility that many Australian PC users overlook. While antivirus software handles the heavy lifting, the built-in Resource Monitor can reveal exactly which processes are talking to the internet and how much data they are moving. For anyone concerned about data leaks, ransomware callbacks, or stealthy spyware, this tool provides a transparent window into what is really happening on the network.

Resource Monitor, or resmon, sits a layer deeper than Task Manager. It breaks down CPU, disk, memory, and network usage per process in real time. That depth is particularly valuable when a computer feels sluggish but no scan has flagged anything malicious. By watching the network tab, you can spot unfamiliar processes uploading megabytes of data to distant servers, even when you are not actively browsing.

Australia's shift to remote work across cities like Sydney, Melbourne and Brisbane has placed home networks in the spotlight. Many households now run multiple connected devices over the National Broadband Network, often behind a single consumer router. That arrangement is convenient, but it also means one compromised laptop can quietly phone home without raising alarms on the router's basic admin page. Knowing how to use Resource Monitor gives you a second pair of eyes.

This guide walks through opening the tool, reading its panels, identifying red flags, and pairing it with other utilities. Whether you are a small business owner in Perth or a student in Adelaide, the steps below apply to any modern Windows 10 or 11 machine.

Opening Resource Monitor quickly

The fastest path is the Start menu. Type "resmon" and press Enter. Windows will launch the Resource Monitor window directly, without needing administrative credentials. If you prefer the longer route, open Control Panel, head to Administrative Tools, and double-click Resource Monitor.

You can also pin it to your taskbar or create a desktop shortcut. Right-click the executable, choose "Pin to taskbar", and the next time you suspect something unusual, one click brings up the live view. Power users sometimes launch it from the Run dialog by pressing Windows key plus R, typing resmon, and hitting Enter.

Keep the tool running in the background while you browse or work. Resource Monitor uses negligible system resources, so it does not skew the readings it reports. If you ever close it accidentally, simply relaunch it the same way.

Reading the network activity panel

Click the Network tab and you will see four sub-panels: Processes with Network Activity, Network Activity, TCP Connections, and Listening Ports. Each one answers a different question. The first lists every executable currently sending or receiving data. The second shows real-time send and receive speeds for each process, measured in bits per second.

The TCP Connections panel mirrors what tools like netstat display, showing local and remote addresses along with the destination port. The Listening Ports panel reveals which services on your machine are waiting for inbound traffic. For most Australian households, you should only see a handful of familiar names here: your browser, your email client, perhaps Steam, OneDrive, or Dropbox.

Anything that does not belong is worth a second look. If you spot an unfamiliar .exe holding an open connection to a server in a country you have no business with, that is a strong signal of compromise. Take note of the process name, the full file path, and the remote IP address before closing the window.

Recognising suspicious behaviour patterns

Unusual network activity rarely announces itself. It tends to hide among legitimate traffic. Watch for processes that consistently upload data even when your computer is idle. A web browser sending a few kilobytes per second during a video call is normal. The same browser sending hundreds of kilobytes per second at 3 a.m. is not.

Pay attention to outbound connections on non-standard ports. Web traffic almost always travels over port 80 or 443. Mail uses 25, 465, 587, or 993. A process communicating over high-numbered ports, or over unusual ports like 8080 or 4444, deserves investigation. Ransomware families in particular often favour custom ports to dodge firewalls, and resources on the ransomware category page describe several recent examples.

Equally telling is a process that has no visible window but maintains a steady connection. svchost.exe is a common culprit because the legitimate file is genuine, but malware sometimes replaces it. Right-click any suspect process in Resource Monitor and select "End Process" only after you have verified it. Ending the wrong system file can destabilise Windows.

Cross-checking with companion tools

Resource Monitor shows what is happening but not always why. Pair it with other built-in utilities for context. Press Ctrl plus Shift plus Esc to open Task Manager, then head to the Details tab to see the publisher name and description for each process. Microsoft signed binaries carry a "Microsoft Corporation" publisher; random executables typically do not.

The Windows Security app adds another layer. Run a full scan and review the threat history. Many Australian users also rely on Malwarebytes or similar secondary scanners because they catch different threat families. For persistent concerns, the Sysinternals Process Explorer offers more detail than Resource Monitor, including the ability to check file signatures online via VirusTotal.

If you notice a process you cannot identify, search for its exact name and file path using a search engine, prefixed with the word "malware". Security forums often have threads describing the same indicator. Document your findings before deleting anything, since false positives do exist.

Responding when you find something suspicious

Disconnect from the internet first. Unplug the Ethernet cable or turn off Wi-Fi to stop the data flow. This prevents further leaks and limits what the attacker can do remotely. For Australian small businesses, this step is also a precursor to any notification under the Notifiable Data Breaches scheme if personal information may have been exposed.

Next, identify and quarantine the offending file. Use Resource Monitor's right-click menu to open the file location. Run the file through an online scanner. If confirmed malicious, delete it and empty the Recycle Bin. For deeply embedded infections, boot into Safe Mode and repeat the cleanup.

Once the machine is clean, change passwords for any accounts you accessed while the device was compromised. Enable two-factor authentication wherever possible. If the infection involved data exfiltration tied to advertising-network spyware, the dedicated removal guide walks through additional browser cleanup steps.

Building ongoing monitoring habits

Spotting unusual network activity once is useful. Spotting it regularly requires routine. Make a habit of opening Resource Monitor at least once a week, ideally while performing a normal task like sending email or downloading a large file. The patterns you observe become your baseline, making deviations easier to recognise.

Keep your operating system and applications updated. The Australian Cyber Security Centre's Essential Eight maturity model highlights patching as one of the most effective controls against malware-driven network abuse. Enable automatic updates for Windows, your browser, and any plugin-like runtimes such as Java or Node.js.

Consider pairing Resource Monitor with a lightweight outbound firewall such as Windows Defender Firewall with Advanced Security. Create rules that block unfamiliar executables from connecting to the internet until you have verified them. This proactive posture turns a reactive tool into a preventive shield, and over time, Resource Monitor becomes less of an emergency hatch and more of a routine inspection panel.

Choosing the right tool for the job

Several Windows utilities reveal network activity, each with strengths suited to different situations. Resource Monitor is rarely the only answer, and pairing it with complementary tools produces a clearer picture than any single utility on its own.

For a quick check during a meeting or while streaming, Task Manager's Processes tab is enough to confirm nothing is uploading gigabytes in the background. For deeper investigation, Sysinternals Process Explorer lets you verify digital signatures and submit files to VirusTotal without leaving the application. For continuous oversight, third-party firewalls such as GlassWire or TinyWall produce historical graphs that Resource Monitor does not retain once you close the window.

Match the tool to the task rather than trying to force one utility to do everything. A practical Australian setup might use Resource Monitor for ad-hoc checks during a suspected incident, while a long-running firewall app quietly logs connections in the background. Together, they cover both the immediate and the cumulative.

Tool	Strength	Best For	Limitation
Resource Monitor	Real-time per-process network breakdown	Quick live inspection during suspected compromise	No historical logging, manual review required
Task Manager	Fast overview, easy access	Glance checks during calls or gaming	Less detailed network columns, fewer filters
Sysinternals Process Explorer	Digital signature verification, VirusTotal lookup	Deep investigation of unknown executables	Steeper learning curve, separate download
Third-party firewall (e.g., GlassWire)	Visual graphs, long-term history, alerts	Continuous monitoring across sessions	Paid tiers for full features, extra background load