Sysinternals Suite¶

What Sysinternals Suite does¶

Using this tool

Sysinternals Suite supports Windows system inspection. In this guide, you will use it to choose one focused utility to observe a process, persistence, file, or network question. Follow the steps below and keep the output with your notes.

Tool guide at a glance¶

Investigation task

Choose one focused utility to observe a process, persistence, file, or network question.

Starting material

An isolated Windows lab VM with a recorded baseline and approved observation question.

What to record

A focused live system observation whose tool, filters, time, output, and system effect are recorded.

Evidence and safety

Use observation features first. Avoid terminating processes or changing persistence until evidence is recorded. Record the input identifier, tool version, relevant commands or settings, time and time zone, output location, and any errors or limitations as you work.

Choose your journey¶

01Understand the evidenceLearn the Windows system inspection concepts and limitations.Complete when you can explain what the evidence can and cannot show.Beginner · No tool required 02Follow the Sysinternals Suite guideFollow the steps and screenshots below.Complete when the documented workflow produces its expected output.Guided · SUSA workstation · Time varies 03Interactive labPractise the tool workflow in a safe browser simulation.Complete when the guided result is supported by the case evidence.Beginner · Browser only 04Full LabUse your own training data, keep the output and explain what you found.Complete when another analyst can reproduce and verify the outcome.Intermediate · Isolated lab

How the labs complement this guide

The Interactive Lab uses example records to practise investigation decisions. It does not run the installed tool or establish how that version behaves. The Full Lab uses your own training environment and evidence. Obtain or create the required input before starting; a case name in an exercise is not a download.

Download Sysinternals Suite and extract it to C:\Tools\SysinternalsSuite directory:

Add Sysinternals Suite to the PATH environment variable¶

Open Environment Variables (Start → Environment Variables → Edit the system environment variables → Environment Variables).

Under User variables, select path and click Edit.

Click New and add:

C:\Tools\SysinternalsSuite

Click OK (then OK on other windows to save changes).

Sigcheck¶

Sigcheck is a command line utility that shows file version number, timestamp information, and digital signature details, including certificate chains. It also includes an option to check a file’s status on VirusTotal.

Testing Sigcheck¶

Open a command prompt and verify you can run tools from Sysinternals Suite from any location. For example we will run sigcheck to check the digital signature and metadata of cmd.exe:

sigcheck C:\windows\system32\cmd.exe

When prompted for a license agreement, click Agree.

Autoruns¶

Autoruns lists programs and drivers configured to start through the Windows locations it supports. Review the entry, file path, publisher and signature before deciding whether an item needs further investigation.