Sysinternals Suite

What Sysinternals Suite does

Guided SUSA tool journey

Sysinternals Suite supports Windows system inspection. In this guide, you will use it to choose one focused utility to observe a process, persistence, file, or network question. The procedure and screenshots provide the practical reference; the surrounding context explains what to record and how to judge the result.

Tool guide at a glance

Investigation task

Choose one focused utility to observe a process, persistence, file, or network question.

Starting material

An isolated Windows lab VM with a recorded baseline and approved observation question.

Successful outcome

A focused live-system observation whose tool, filters, time, output, and system effect are recorded.

Evidence and safety

Use observation features first. Avoid terminating processes or changing persistence until evidence is recorded. Record the input identifier, tool version, relevant commands or settings, time and time zone, output location, and any errors or limitations as you work.

Choose your journey

01Understand the evidenceLearn the Windows system inspection concepts and limitations.Complete when you can explain what the evidence can and cannot show.Beginner · No tool required · 15–25 min 02Follow the Sysinternals Suite guideWork through the commands, screenshots, and instructional sequence below.Complete when the documented workflow produces its expected output.Guided · SUSA workstation · Time varies 03Interactive labPractise the tool workflow in a safe browser simulation.Complete when the guided result is supported by the case evidence.Beginner · Browser only · 10–20 min 04Full LabInvestigate an authorised training scenario with fewer prompts and preserve a reviewable result.Complete when another analyst can reproduce and verify the outcome.Intermediate · Isolated lab · 45–90 min

How the labs complement this guide

The Interactive Lab is a safe browser simulation for practising the workflow and validation logic. The Full Lab is an independent exercise for an isolated, authorised environment. Confirm the installed tool version and expected output before relying on either exercise in a real case.

Download Sysinternals Suite and extract it to C:\Tools\SysinternalsSuite directory:

Add Sysinternals Suite to the PATH environment variable

Open Environment Variables (Start → Environment Variables → Edit the system environment variables → Environment Variables).

Under User variables, select path and click Edit.

Click New and add:

C:\Tools\SysinternalsSuite

Click OK (then OK on other windows to save changes).

Sigcheck

Sigcheck is a command-line utility that shows file version number, timestamp information, and digital signature details, including certificate chains. It also includes an option to check a file’s status on VirusTotal.

Testing Sigcheck

Open a command prompt and verify you can run tools from Sysinternals Suite from any location. For example we will run sigcheck to check the digital signature and metadata of cmd.exe:

sigcheck C:\windows\system32\cmd.exe

When prompted for a license agreement, click Agree.

Autoruns

Autoruns (Autoruns64) is a powerful Windows tool from Microsoft’s Sysinternals suite that shows everything configured to run automatically on a system.

The tool is available in C:\Tools\SysinternalsSuite.

Diskmon

Diskmon is a lightweight tool from Microsoft’s Sysinternals suite that monitors real-time disk activity on a Windows system.

The tool is available in C:\Tools\SysinternalsSuite and needs to be run as administrator.

DiskView

DiskView (DiskView64) is a graphical disk analysis tool from Sysinternals Suite that lets you visualise how files are physically laid out on a disk.

The tool is available in C:\Tools\SysinternalsSuite.

Procexp

Procexp (procexp64), short for Process Explorer), is an advanced process viewer from the Sysinternals suite by Microsoft. It’s essentially a powerful replacement for Windows Task Manager.

The tool is available in C:\Tools\SysinternalsSuite.

Procmon

Procmon (Procmon64), short for Process Monitor, is one of the most powerful Windows monitoring tools in the Sysinternals suite from Microsoft. It captures real-time system activity across processes, files, registry, and more.

The tool is available in C:\Tools\SysinternalsSuite.

RDCMan

RDCMan (Remote Desktop Connection Manager) is a tool from Microsoft that helps you manage and organise multiple Remote Desktop (RDP) connections in one place.

The tool is available in C:\Tools\SysinternalsSuite.

ShareEnum

ShareEnum (ShareEnum64) is a small enumeration tool from the Sysinternals suite by Microsoft that scans computers on a network and lists their shared folders (SMB shares) along with permissions.

The tool is available in C:\Tools\SysinternalsSuite.

TCPView

TCPView (TCPView64) is a real-time network monitoring tool from the Sysinternals suite by Microsoft. It shows all active TCP and UDP connections on a Windows system and which processes own them.

The tool is available in C:\Tools\SysinternalsSuite.

VMMap

VMMap is a memory analysis tool from the Sysinternals suite by Microsoft that shows how a process is using virtual memory in detail.

The tool is available in C:\Tools\SysinternalsSuite.

ZoomIt

ZoomIt is a small utility from the Sysinternals suite used for zooming, drawing, and annotating your screen during presentations or demos.

The tool is available in C:\Tools\SysinternalsSuite.