Sysinternals Suite

What it is

A bundle of about 70 small Windows utilities written by Mark Russinovich, including Process Explorer, Process Monitor, Autoruns, TCPView, the PsTools set, and Sysmon. The suite is one download that holds the individual tools and their help files.

What it helps with

- Seeing which processes, DLLs, and handles are active on a host
- Finding programs set to launch at startup or logon
- Logging process creation and network connections to the Windows event log with Sysmon
- Capturing memory dumps of a misbehaving process

Who it's for

Blue team analysts, incident responders, and Windows administrators investigating hosts they manage.

Worth knowing

Sysmon writes its events to the Windows event log and is tuned with an XML configuration file, so it is often paired with a SIEM. The suite is also offered through the Microsoft Store.

Is there a version for ARM devices?
Yes, Microsoft publishes a separate ARM64 build of the suite.

Does the suite include every Sysinternals tool?
No, it bundles the troubleshooting utilities and leaves out extras such as the BSOD screen saver.