Windows Sysinternals: advanced system utilities and technical information
1–10 of 26 posts
Re: Windows Sysinternals: advanced system utilities and technical information
#2The creator of these tools used to give those really cool "The case of the unexplained" presentations where he used the tools to diagnose and fix real-life Windows problems.
https://docs.microsoft.com/en-us/sysinternals/resources/webc...
Re: Windows Sysinternals: advanced system utilities and technical information
#3Is there any recent book worth a read, which covers Windows internals for latest versions?
Re: Windows Sysinternals: advanced system utilities and technical information
#4dont forget to exclude your sysinternals/nirsoft-tools-dir from av
Re: Windows Sysinternals: advanced system utilities and technical information
#5I‘m on Mac and Linux since 10 years now, but Sysinternals is the one thing that kept me on Windows for the 10 years before as a hacker. It was the first thing that landed on any new machine and let me learn and debug so many things about my computer.
Microsoft did the right thing to assimilate them, the guy behind was top notch and I remember them fondly.
Don‘t know how they evolved the last decade though.
Re: Windows Sysinternals: advanced system utilities and technical information
#6dont forget to exclude your sysinternals/nirsoft-tools-dir from av
On the contrary: adding psexec.exe to our EDR's blocklist has had tangible positive impacts.
Legitimate remote execution in 2021 can be achieved using a range of supported options, and when I see this alert trigger in a monitored environment there's nearly always something malicious going on. The catch of course, is that you explain this to everyone and get them on board, as opposed to just doing it.
Re: Windows Sysinternals: advanced system utilities and technical information
#7Ah, good old days of using these to disable auto-run programs (with some of them viruses) on Windows XP and 7.
And procexp! It's just the better task manager.
Re: Windows Sysinternals: advanced system utilities and technical information
#8A proper Sysinternals equivalent set of tools is sorely missed on macOS. Trying to do DFIR on them mostly sucks compared to whats available on Windows. (Open to hearing anyone who has particular favorites or recommendations)
Re: Windows Sysinternals: advanced system utilities and technical information
#9Is there any recent book worth a read, which covers Windows internals for latest versions?
Yes. Windows Internals 7th edition https://www.amazon.com/Windows-Internals-Part-Developer-Refe...
Re: Windows Sysinternals: advanced system utilities and technical information
#10Ah, good old days of using these to disable auto-run programs (with some of them viruses) on Windows XP and 7. And procexp! It's just the better task manager.
ProcessHacker (https://processhacker.sourceforge.io/) is also a worthy competitor to the Process Explorer.