Sysinternals Live is a service that enables you to execute Sysinternals tools directly from the Web without hunting for and manually downloading them. Simply enter a tool's Sysinternals Live path into Windows Explorer or a command prompt as https://live.sysinternals.com/<toolname> or \\live.sysinternals.com\tools\<toolname>.
You can view the entire Sysinternals Live tools directory in a browser at
What's New (January 29, 2015)
This major update to Autoruns, an autostart execution point (ASEP) manager, now has integration with Virustotal.com to show the status of entries with respect to scans by over four dozen antimalware engines. It also includes a revamped scanning architecture that supports dynamic filters, including a free-form text filter, a greatly improved compare feature that highlights not just new items but deleted ones as well, and file saving and loading that preserves all the information of a scan.
What's New (January 19, 2015)
This major update to Sysmon, a service that records process activity to the Windows event log for use by incident detection and forensic analysis, includes driver load and image load events with signature information, configurable hashing algorithm reporting, flexible filters for including and excluding events, and support for supplying configuration via a configuration file instead of the command line.
What's New (September 11, 2014)
Handle is a command-line utility that can show which processes have a handle to a file or other resource open, or show all open handles. Version 4 now works with standard-user rights, allowing standard users to identify the handles open by their processes.
What's New (August 7, 2014)
We’re excited to announce Sysmon, a new Sysinternals utility that monitors and reports key system activity via the Windows event log, including detailed information about process creation, network connections and file creation timestamp changes. With Sysmon installed on your systems, you can collect and analyze these events to identify the presence of attackers, and correlate events across your network to track them as they traverse your network.
Coreinfo is a command-line utility that reports comprehensive information about a system’s processors, including their cache sizes and topology, memory latency, and processor features, now reports virtual memory address width as well as support for many additional instructions, including PT, SHA, MPX, CFLUSHOPT, and AVX variants.
What's New (May 27, 2014)
Mark’s Latest Novel: Rogue Code
The third book in Mark’s Jeff Aiken technothriller series was published on May 20. In Rogue Code, Jeff is hired to penetration test the New York Stock Exchange. When he reaches the heart of the trading engine he discovers malware that’s manipulating trades to skim money while blending in with high-frequency trading (HFT) algorithms. He’s accused of hacking and goes on the run in a race against the clock to clear his name and prevent a multi-billion dollar heist that could cause the collapse of the US financial system. As with his previous novels, Mark doesn’t compromise technical accuracy while building a thrilling story. Rogue Code is available in Audible, ebook, and hard cover versions.
Mark’s TechEd US Presentations On-Demand
Mark delivered five top-rated and top-attended presentations at TechEd US this year. They included: his latest edition of the ever-popular “Case of the Unexplained” on Windows troubleshooting; a new “Malware Hunting with the Sysinternals Tools” that highlights the latest malware trends; a presentation with Nathan Ide on pass-the-hash mitigations introduced in Windows 8.1; a talk on Azure’s security architecture and its design for hostile multitenancy; and a wide-ranging conversation with IT Pro luminary Mark Minasi on cloud computing trends and considerations. If you missed being there in person, you can watch them now on demand at the TechEd webcast site.