Skip to content

Understanding Sysinternals Suite

Microsoft Sysinternals is a collection of focused Windows utilities for inspecting processes, files, persistence, networking, access, and operating-system behaviour.

What you will learn

By the end, you should be able to choose a utility by question, explain the effect of live inspection, and preserve useful observations.

What is Sysinternals Suite?

Core concept

The suite includes tools such as Process Explorer, Autoruns, Process Monitor, TCPView, Sigcheck, and PsTools. These tools expose different live Windows views; they are not a single automatic forensic examination platform.

ProcessesPersistenceFile activityConnectionsSignatures

Keep in mind: Launching a utility changes the live system and some tools can terminate processes, delete persistence, or run remote commands. Use read-only inspection features first.

01AutorunA location that can start code automatically02HandleA process reference to an operating-system object03TraceA time-ordered record of observed system activity

Tool roles

Process ExplorerProcesses, relationships, handles, modules, and signatures
AutorunsCommon automatic-start and persistence locations
Process MonitorHigh-volume file, Registry, process, and thread activity
TCPViewLive network endpoints associated with processes

Why it matters

Inspect quickly

Focused views help answer immediate questions about a running Windows system.

Connect context

Processes can be related to parents, paths, signatures, handles, and connections.

Capture behaviour

Process Monitor can record selected live activity for later filtering.

Support administration

The same utilities assist troubleshooting, validation, and controlled lab work.

How to use the suite defensibly

  1. DefineState the immediate question and choose the smallest suitable utility.
  2. RecordNote system time, tool version, command or settings, and the starting state.
  3. ObserveUse non-destructive inspection and apply focused filters.
  4. ExportSave relevant output, screenshots, or logs to a controlled destination.
  5. CorroborateCompare live observations with acquired artefacts and other evidence.

Choose the next step

ScenarioTCPView shows an unfamiliar process with an active external connection. What should you do first?

Choose by question

  1. 1QuestionDefine what must be observed.
  2. 2ToolSelect the smallest focused utility.
  3. 3RecordPreserve settings, output, and system effect.
  4. 4CorroborateSupport live observations independently.

Sysinternals in SUSA

Windows inspection

Sysinternals Suite

Learn the available utilities and practical SUSA workflow.

Continue learning