Announcing a new book, Troubleshooting with the Windows Sysinternals Tools

Announcing a new book, Troubleshooting with the Windows Sysinternals Tools Become a Windows troubleshooting master and get the most out of the Sysinternals tools. Completely updated and expanded, this book by Sysinternals co-creator Mark Russinovich and Windows expert Aaaron Margosis covers all the tools, with full chapters on the major tools like Process Explorer, Process…


Sysmon v5, Process Explorer v16.20, Procdump v8.2, LiveKd v5.6

Sysmon v5 This major update to Sysmon, a background monitor that records activity to the event log for use in security incident detection and forensics, introduces file create and registry modification logging. These event types make it possible to configure filters that capture updates to critical system configuration as well as changes to autostart entry…


Update: Sysmon v4.12, Autologon v3.1, Sigcheck v2.54, Process Monitor v3.31

Sysmon v4.12 This release of Sysmon, an advanced background monitor that records process-related activity to the event log for use in intrusion detection and forensics, introduces more powerful filtering capabilities, now reports the status of CRL checking and fixes a bug where certain configuration files could cause the driver to blue screen. Sigcheck v2.54 This…


Update: Sysmon v4, Procdump v8, Sigcheck v2.51

Sysmon v4.0 This release of Sysmon, an advanced background monitor that records process-related activity to the event log for use in intrusion detection and forensics, introduces more powerful filtering capabilities, allowing for both include and exclude rules to be specified for specific events types, as well as complex matching on different event fields. Procdump v8.0…


Update: Sigcheck v2.5, Process Explorer v16.11, Whois v1.13, RAMMap v1.5

Sigcheck v2.5This update to Sigcheck, a command-line utility that reports detailed information about images, including their signatures and VirusTotal status, as well as certificate stores, now reports all the signatures of images that have multiple signers. Sysmon v3.21This update fixes a paged pool leak of token objects when image logging is enabled.  Process Explorer v16.11This…


Update: Sigcheck v2.4, Sysmon v3.2, Process Explorer v16.1, Autoruns v13.51, AccessChk v6.01

Sigcheck v2.4This update to Sigcheck, a powerful command-line utility that reports image file and signing information, as well as information on certificates, now has an option that will report any certificates installed on the system that do not chain to one of the certificates in the Microsoft certificate trust list (CTL). It also adds the…


Update: Autoruns v13.5, Sigcheck v2.3, RAMMap v1.4, BgInfo v4.21, Sysmon v3.11, ADInsight v1.2

Autoruns v13.5This update to Autoruns, the most comprehensive autostart viewer and manager available for Windows, now shows 32-bit Office addins and font drivers, and enables resubmission of known images to Virus Total for a new scan. Sigcheck v2.30Sigcheck, a command-line utility for displaying detailed file version information, image signing status, catalog and certificate store contents,…


Update: Sysmon v3.1, LogonSessions v1.3, VMMap v3.21

Sysmon v3.1This update to Sysmon, a background service that logs security-relevant process and network activity to the Windows event log, adds information about the thread initialization function for CreateRemoteThread events, including the DLL and function name and address. It also changes the format of timestamps to allow for simple string sorting and fixes several bugs….


Update: AccessChk v6.0, Autoruns v13.4, Process Monitor v3.2, VMMap v3.2

AccessChk v6.0This update to AccessChk, a command-line utility that shows effective and actual permissions for registry keys, files, services, kernel objects, and more, can now show the permissions and security descriptors assigned to event logs, and incorporates owner-rights accesses in its permissions evaluations. Autoruns v13.4Autoruns, the most comprehensive utility available for showing what executables, DLLs,…


Update: Sysmon v3.0, Autornus v13.3, Regjump v1.1, Process Monitor v3.11

Sysmon v3.0This release of Sysmon, an advanced background monitor that records process-related activity to the event log for use in intrusion detection and forensics, adds the process name to process terminate events, reports remote thread creation events, and improves the simplicity and flexibility of filter settings. Autoruns v13.3Autoruns, a utility that shows what processes, DLLs,…