Sysinternals for Incident Responders: Triage Guide

When a Windows host is suspected of compromise, responders need to see what is running, what starts at boot, what is talking to the network and whether binaries are genuinely signed, often before an EDR console or forensic image is available. Microsoft's Sysinternals utilities answer those questions with small, portable tools that need no installer. This guide covers the tools a responder reaches for first (Process Explorer, Autoruns, Process Monitor, TCPView, Sigcheck, Strings and ProcDump), how to obtain and verify them, what the licence allows, how to use them without destroying evidence, and how to detect the same tools when attackers bring them. It is written for incident responders, SOC analysts and Windows administrators, and describes defensive use only, based on Microsoft's own documentation. Sysmon is covered in its own guide.

Key takeaways

Triage, not a forensic suite. Sysinternals tools answer live questions quickly on one host; they complement, and never replace, memory capture, disk imaging and EDR telemetry.
Autoruns and Sigcheck find persistence fastest. Hiding signed Microsoft entries and verifying signatures turns hundreds of autostart entries into a short list of third-party and unsigned items.
Every action changes the host. Running a tool creates processes, prefetch entries and registry keys, so record what you ran, when and from where.
Get binaries from Microsoft and check them. Use download.sysinternals.com, Sysinternals Live or the Microsoft Store, verify the Microsoft signature, and keep a known-good copy on read-only media.
Attackers use the same tools. PsExec and ProcDump appear in intrusions, so monitor for their service installs, LSASS access and EULA registry keys rather than blocking them blindly.

What the tool does

Sysinternals began in 1996 as Mark Russinovich's utilities site and is now part of Microsoft Learn. The tools are free downloads under a Microsoft licence, distributed individually, as the Sysinternals Suite (standard, Nano Server and ARM64 zips) and through the Microsoft Store. Current builds of most tools list Windows 11 and Windows Server 2019 or later as supported, so keep older builds for legacy hosts. Linux ports of Process Monitor and ProcDump are separate projects on GitHub.

Tool	What it shows	Responder question it answers	Command-line form
Process Explorer	Process tree with owning account; lower pane in handle mode (files, keys, other objects) or DLL mode (loaded DLLs and mapped files); find handle or DLL search	What is running, under which account, and what has it loaded or opened?	GUI only (procexp.exe)
Autoruns	Programs and drivers configured to run at boot or logon: Run and RunOnce keys, services, drivers, scheduled tasks, Winlogon, AppInit DLLs, image hijacks, WMI, LSA providers, Winsock providers, codecs	How does it survive a reboot?	autorunsc
Process Monitor	Real-time file system, registry and process or thread activity with full thread stacks, boot-time logging and non-destructive filters	What did this process touch, in what order?	procmon (GUI with switches)
TCPView	All TCP and UDP endpoints, connection state, owning process and service name, with change highlighting	Which process owns this connection?	tcpvcon -a -c -n
Sigcheck	File version, timestamp, signature and certificate chain, hashes, entropy, VirusTotal lookups, certificate store dumps	Is this binary signed by who it claims, and is it known bad?	sigcheck
Strings	ASCII and Unicode strings of at least 3 characters (default) in a file, with optional offsets	Does this sample contain URLs, paths, mutex names or commands?	strings
ProcDump	Process memory dumps on demand or on triggers (CPU, hang, exception, memory commit, termination)	Can I preserve this process's memory before it exits?	procdump

For persistent, event-based telemetry (process creation with hashes, network connections, image loads), Microsoft's Sysmon is the Sysinternals tool to deploy fleet-wide. See the Sysmon Guide; this page does not repeat it.

Defender use cases

Persistence review with Autoruns

Autoruns groups autostart locations into tabs. Turn on Hide Signed Microsoft Entries and enable signature verification in the scan options so that only third-party and unsigned entries remain, then look for unsigned binaries in user-writable paths, entries whose image file is missing, and scheduled tasks or services with encoded command lines. The command-line version suits collection at scale: autorunsc -a * -c -h -s -m -t captures all categories as CSV with hashes, signature status and UTC timestamps, hiding Microsoft entries. Add * as the user argument to include all profiles, and use -z to analyse an offline Windows directory, for example a mounted image.

Process and handle inspection with Process Explorer

The process tree shows parentage, which exposes the classic anomalies: an Office application parenting a shell, a service host with an unusual parent, or a process running from a temporary directory. Handle mode reveals which files, registry keys and named objects a process holds open, and the find handle or DLL search shows every process that has loaded a specific DLL. Process Explorer can also check image signatures and query VirusTotal by hash (from our own knowledge of the tool; the current download page does not describe these options).

Behaviour capture with Process Monitor

Procmon records file, registry and process activity with thread stacks, so you can see exactly which key a suspicious binary reads or which file it drops. Filter on process name, operation or path (filters are non-destructive) and use the process tree view to follow children. Boot-time logging captures activity before logon, which helps with persistence that runs early. On busy hosts, log to a file: captures reach millions of events.

Network ownership with TCPView

TCPView maps every TCP and UDP endpoint to the owning process and service, highlighting new endpoints in green, changed in yellow and closed in red. tcpvcon -a -c -n gives all endpoints as CSV without name resolution, which is safer during an incident because reverse lookups can tip off an attacker who controls the DNS zone. TCPView can close an established connection, which is a containment action: record it and coordinate with the incident lead first.

Signature and hash checks with Sigcheck

Task	Sigcheck switches	Notes
Find unsigned executables in a folder tree	`-u -e -s`	Microsoft's own example is `sigcheck -u -e c:\windows\system32`; investigate any unsigned result
Hash files for IOC matching	`-h -c`	CSV with hashes for your SIEM or threat intelligence platform
Show catalog and signing chain	`-i`	Catalog-signed system files show no embedded signature without this
Spot packed or encrypted files	`-a`	Extended version information including entropy in bits per byte
Look up hashes on VirusTotal	`-v`, `-vt`	`-vs` uploads unseen files: avoid it for sensitive or targeted samples
Offline host lookups	`-o`	Uses a CSV previously captured with `-h`
Find rogue root certificates	`-tv`, `-tuv`	Lists machine or user store certificates not rooted to Microsoft's trusted root list

Strings and memory dumps

Strings extracts readable text from a suspicious binary or a dump, for example strings -n 8 -o sample.bin for strings of 8 characters or more with offsets. See the YARA Rules Guide for turning findings into rules. ProcDump preserves a suspicious process's memory: procdump -ma <PID> writes a full dump including all memory, while -mp (MiniPlus) is as detailed but 10% to 75% of the size. Use -r to dump from a clone and reduce the time the process is suspended. Dumps go to a memory forensics workflow, see the Memory Forensics Guide.

Deployment and safe use

Obtaining and verifying the tools

Sources: Download from download.sysinternals.com (individual zips or the Suite), install from the Microsoft Store, or run directly from Sysinternals Live at https://live.sysinternals.com/ or \\live.sysinternals.com\tools\<toolname>. Never take copies from file shares, forums or a compromised host.
Verify: Check the Authenticode signature (Microsoft Corporation) with sigcheck -i on a trusted workstation, record SHA-256 hashes and store the verified set in your IR toolkit.
Live versus local: Sysinternals Live needs outbound access from the suspect host; a verified toolkit on read-only media is more predictable.

Licence terms

The Sysinternals licence lets you install and use any number of copies on your devices. It prohibits reverse engineering (except where law allows), publishing the software for others to copy, renting or lending it, transferring it to third parties and using it for commercial software hosting services. Practically, that means you should not rehost the binaries in a public repository or bundle them into a product you distribute; internal toolkits for your own devices are the normal pattern. The licence states the tools do not collect data, but warns that files they save may contain usernames, passwords and file and registry paths.

Evidence handling

Capture volatile data first: follow your order of volatility. Take a memory image before heavy interactive work, because every tool you run changes memory.
Run from external media: avoid writing tools to the suspect disk; write output (CSV, PML, DMP) to a separate evidence location.
Log every command: note tool, version, hash, time (UTC) and operator; your own runs leave traces analysts must tell apart from an attacker's.
Use -accepteula knowingly: it suppresses the interactive prompt in scripted collection, but it is also a common attacker flag, so document your use.
Treat dumps as sensitive: process dumps and Procmon logs can hold credentials, tokens and personal data. Encrypt them, restrict access and set retention.
Containment actions need sign-off: killing processes, deleting Autoruns entries and closing TCPView connections alter evidence and may alert the attacker. Disable Autoruns entries rather than delete them.

For broader collection at scale, see the KAPE and Triage Collection Guide and the Velociraptor Guide.

Detection and hardening value

Microsoft's PsExec page notes that some antivirus scanners flag the PsTools as remote administration malware and that viruses have used them. Attackers favour signed administrative tools because they blend in: PsExec for remote execution and ProcDump for dumping LSASS memory are the common cases. Detect their use in context: renamed copies keep the same signature.

Abuse pattern	ATT&CK technique	What to monitor	Hardening
PsExec remote execution over admin shares	T1569.002 Service Execution, T1021.002 SMB/Windows Admin Shares	New service installs (System event 7045, Security 4697), service names such as PSEXESVC or a custom name set with `-r`, network logons to ADMIN$ from unusual sources	ASR rule "Block process creations originating from PSExec and WMI commands" (GUID d1e49aac-8f56-4280-b9ba-993a6d77406c), restrict SMB between workstations, tiered admin accounts
ProcDump or similar against LSASS	T1003.001 LSASS Memory	Process access to lsass.exe, new .dmp files, procdump command lines naming lsass	LSA protection and Credential Guard; ASR rule "Block credential stealing from the Windows local security authority subsystem" where LSA protection is not enabled
Signed tool brought in by the attacker	T1588.002 Tool	First-seen Sysinternals binaries outside approved paths, EulaAccepted registry values under HKCU\Software\Sysinternals for unexpected users	Application control allow-listing by path and publisher for approved admin groups only
Run keys, services, tasks, Winlogon and IFEO persistence	T1547.001, T1543.003, T1053.005, T1547.004, T1546.012	Scheduled autorunsc baselines diffed against gold images	Remove local admin rights, restrict who can create services and tasks
Abused or stolen code signing	T1553.002 Code Signing	Sigcheck signer and chain review, rogue roots via `-tv`	Certificate store governance; see the Code Signing Security Guide

Before turning on the PsExec ASR rule, note Microsoft's warning not to enable it on devices managed by Configuration Manager, because the ConfigMgr client relies on WMI. Run it in audit mode first and review the AsrPsexecWmiChildProcessAudited events. See the Living off the Land Guide, Credential Dumping Guide and Windows Event Log Guide.

Where identity fits

PsExec runs as the caller or as the account given with -u, and -s runs as SYSTEM. Use a dedicated, time-limited IR account, avoid interactive logons to compromised machines, and rotate the account afterwards. Service accounts found in Autoruns entries and scheduled tasks are part of the scope of compromise: see the Service Account Security Guide.

Metrics

Toolkit integrity: percentage of IR toolkit binaries with a verified signature and recorded hash at last review (target 100%).
Time to persistence list: minutes from host access to an Autoruns CSV in the case file.
Unapproved tool executions: count of Sysinternals binaries run outside approved admin groups or paths per month, each triaged.
LSASS access alerts: number closed with a known cause versus escalated.

Alternatives

Need	Sysinternals option	Alternative approach	Choose the alternative when
Live triage on one host	Process Explorer, Autoruns, TCPView	EDR live response console	EDR is deployed and you need audit trails and remote access without touching the desktop
Collection across many hosts	autorunsc, sigcheck in scripts	Velociraptor, osquery, KAPE	More than a handful of hosts, or you need repeatable artefact collection
Continuous telemetry	Sysmon	EDR sensor	You need prevention and vendor detection content as well as logs
Memory analysis	ProcDump (per process)	Full memory acquisition and Volatility-style analysis	You need kernel structures, hidden processes or all processes at one point in time
Built-in only	None	tasklist, netstat -ano, Get-Process, Get-NetTCPConnection, schtasks	Policy forbids bringing binaries onto the host

Small organisations without EDR can rely on Sysinternals plus Sysmon for Windows triage; large ones keep Sysinternals for deep dives alongside EDR. See the Digital Forensics (DFIR) Guide and EDR Guide.

Common failure patterns

Running tools from the suspect disk mixes responder and attacker artefacts.
Uploading samples with -vs can tip off a targeted attacker.
Deleting persistence before scoping loses evidence and lets the attacker switch to a backup mechanism you have not yet found.
Trusting a signature alone: signed tools such as PsExec and ProcDump are abused precisely because they are signed; context matters more than the signer.
Blocking PsExec everywhere without audit breaks administration and ConfigMgr, so the block is reverted and nothing is monitored.

Practitioner checklist

Build an IR toolkit from download.sysinternals.com, verify signatures with Sigcheck, record SHA-256 hashes and store it on read-only media.
Capture memory before interactive triage and write all output to a separate evidence location.
Run autorunsc -a * -c -h -s -m -t * on suspect hosts and diff against gold image baselines.
Use Sigcheck -u -e -s and -tv to find unsigned binaries and rogue root certificates.
Use hash lookups only; do not upload samples to VirusTotal without incident lead approval.
Deploy Sysmon fleet-wide and alert on service installs (7045, 4697), LSASS access and unexpected Sysinternals EULA registry keys.
Pilot the PsExec and LSASS ASR rules in audit mode, excluding ConfigMgr-managed devices from the PsExec rule.
Use a dedicated, time-limited IR account and rotate it after the incident.
Encrypt and set retention on dumps and logs, and check the licence before distributing tools outside your organisation.

Framework fit: NIST SP 800-53 IR-4 Incident Handling, SI-4 System Monitoring, AU-6 Audit Record Review and SI-7 Software Integrity; NIST CSF 2.0 RS.AN-03 (root cause analysis), DE.AE-02 and DE.CM-09; application control of admin tools supports CM-7 Least Functionality. See the Incident Response Guide.

Standards and references

Related NHI Mgmt Group resources: Sysmon Guide · Incident Response Guide · Memory Forensics Guide · Living off the Land Guide · Credential Dumping Guide

Sysinternals for Incident Responders Guide: Process, Autoruns and Sysmon Essentials