Start here
Get the suite
Download the whole set once, or run any single tool straight from Microsoft's web share. All are Microsoft-signed. First launch pops an EULA — -accepteula (or /accepteula) skips it for scripting.
\\live.sysinternals.com\toolsRun any tool live over the web — e.g. \\live.sysinternals.com\tools\procexp.exe — without installing. Also browse it at live.sysinternals.com.Microsoft StoreThe suite as a Store app that auto-updates. install page.-accepteulaAccept the licence non-interactively (per tool, or set it once in the registry). Essential when running these from a script or remotely.
Full docs & per-tool downloadsEvery tool's own page, with the version and a direct download, lives under the Microsoft Learn hub. learn.microsoft.com/sysinternals.
DFIR core
Process & host triage
The tools you reach for first on a live box. Pair them with the Core Processes and DLLs sheets.
Process Explorer (procexp)Task Manager on steroids — full process tree, parent, path, signature, loaded DLLs, handles, and a one-click VirusTotal lookup. The single most useful tool here. download ↓Process Monitor (procmon)Real-time file, registry, process, and network-ish activity with full detail — the way to watch what a sample actually does. Filter hard or it drowns you. download ↓AutorunsEvery autostart location on the box — Run keys, services, scheduled tasks, drivers, Winlogon, more — with signature check and VT. The persistence sweep. Pairs with the Registry sheet. download ↓HandleWhich process holds a given file, folder, or object open — find what's locking a file or what a process is touching. download ↓ListDLLsDLLs loaded in each process, with path and signature — spot an unsigned or out-of-place module (side-loading). download ↓ProcDumpDump a process's memory (triggered on CPU, exceptions, hangs). Legit for crash capture — but procdump -ma lsass.exe is a known credential-dumping move, so it's also high-signal in logs. download ↓VMMapA process's virtual-memory breakdown — committed, private, images — useful for spotting injected regions. download ↓RAMMapSystem-wide physical-memory usage by type — a quick read on what's resident. download ↓PsListCommand-line process + thread lister with CPU and memory, local or remote. download ↓
Telemetry
Sysmon & logging
The one you deploy, not just run — it's the backbone of host detection in a SOC.
SysmonA driver + service that logs rich events to the Windows event log: process creation with hashes and command line (1), network connections (3), image loads (7), LSASS access (10), registry (12-14), and more. Drive it with a config (SwiftOnSecurity / Olaf Hartong). The IDs are on the Event IDs sheet. download ↓sysmon -i config.xmlInstall with a config; sysmon -c config.xml updates the rules live; sysmon -u uninstalls. Events land in Microsoft-Windows-Sysmon/Operational.
DebugViewCapture OutputDebugString / kernel DbgPrint output, local or remote — malware and drivers sometimes chatter here. download ↓PsLogListDump or clear event logs from the command line, local or remote — pull Security/System logs for a quick off-host look. download ↓
Network
Connections & shares
TCPViewLive view of every TCP/UDP endpoint with the owning process — the GUI way to catch a beacon or an odd listener. download ↓PsPingPing, TCP-port, latency, and bandwidth test — check whether a host/port is reachable without telnet. download ↓WhoisCommand-line WHOIS for a domain or IP — fast registration/owner lookup during enrichment. download ↓PsFileFiles opened remotely over the network on this host, and the ability to close them. download ↓ShareEnumEnumerate shares across the network and who can reach them — find over-shared data and exfil staging. download ↓
Security
Access, signatures & secure delete
SigcheckVerify a file's signature, version, and VirusTotal reputation; sigcheck -u -e C:\Windows\System32 lists unsigned executables — a fast "what shouldn't be here" sweep. download ↓AccessChkEffective permissions on files, keys, services, and processes — find the weak ACL behind a privilege-escalation path (writable service binaries, etc.). download ↓AccessEnumGUI view of who can read/write a directory or registry tree — spot over-permissive access. download ↓StreamsList (and delete) NTFS alternate data streams — a classic place to hide a payload or the Mark-of-the-Web. download ↓LogonSessionsActive logon sessions and the processes in each — map tokens to activity. download ↓SDeleteSecurely wipe files/free space to DoD spec. Legit for sanitising disks — and an anti-forensics / evidence-destruction tool in the wrong hands. download ↓ShellRunasRight-click "run as a different user" shell extension — handy for controlled privilege use. download ↓
Disk2vhdImage a live physical disk to a VHD — capture a running system for offline analysis in a VM. download ↓DuDisk-usage by directory, recursively — find what's eating a volume (or a staging dir full of exfil). download ↓DiskViewGraphical map of where files sit on the disk. download ↓ContigDefragment (or deliberately fragment) a single file; also reports a file's fragmentation. download ↓JunctionCreate and inspect NTFS junction points / reparse points — spot redirection tricks. download ↓FindLinksList all hard links to a file — a file can hide under several names. download ↓PendMoves / MoveFileShow files queued for rename/delete at next boot (PendingFileRenameOperations) and queue your own — malware uses this to swap files on reboot. download ↓NTFSInfoMFT, volume, and NTFS metadata details. download ↓SyncFlush cached file data to disk on demand — before pulling a drive. download ↓EFSDumpShow which accounts can decrypt an EFS-encrypted file. download ↓
RegJumpJump regedit straight to any key path you paste — stop clicking through the tree. Great with the Registry sheet's paths. download ↓RU (Registry Usage)Report the size and value count of a registry key subtree. download ↓RegDelNullFind and delete registry keys with embedded nulls — a trick used to hide keys from normal tools. download ↓AdExplorerBrowse, search, and snapshot Active Directory — objects, attributes, permissions. Powerful recon tool, so its use by non-admins is worth noting. download ↓AdInsightReal-time LDAP activity monitor — see exactly what AD queries an app (or an attacker's tool) is making. download ↓
Everything else
System info & utilities
StringsPull printable ASCII/Unicode strings out of a binary — fast first look at a sample for URLs, IPs, and commands. download ↓CoreinfoMap logical processors to sockets, NUMA nodes, and cache; shows CPU features (incl. virtualization). download ↓WinObjBrowse the NT Object Manager namespace — devices, mutexes, sections. Malware mutexes show up here. download ↓BgInfoStamp host info (name, IP, build) onto the desktop wallpaper — standard on managed servers. download ↓ZoomItScreen zoom, draw, and timer for presentations and demos. download ↓DesktopsUp to four virtual desktops via a tray switcher. download ↓AutologonConfigure (encrypted) automatic logon for a lab or kiosk host. download ↓Hex2decConvert between hex and decimal at the command line — handy for PIDs, offsets, and error codes. download ↓ClockResReport the system timer resolution. download ↓LiveKdRun the kernel debugger against a live system (or a dump) without a reboot. download ↓Ctrl2CapKernel-mode remap of Caps Lock to Ctrl — a Russinovich classic. download ↓BlueScreenA screensaver that fakes a BSOD — the office prank in the suite. download ↓
Not the whole list. The suite ships 70+ tools; these are the ones that earn a place in SOC/IR work. For the complete A-Z — and the current version and direct link for any single tool — use the Microsoft Learn downloads index.