### Install Sysmon with a configuration file Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon Installs Sysmon using a specified XML configuration file. ```Windows Command Prompt sysmon -accepteula -i c:\windows\config.xml ``` -------------------------------- ### Install Sysmon with default settings Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon Installs Sysmon using default settings, which includes SHA1 hashing for process images and no network monitoring. ```Windows Command Prompt sysmon -accepteula -i ``` -------------------------------- ### Configure PsPing Server Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psping Command syntax to start the PsPing server for listening. ```Windows Command Prompt psping [[-6]|[-4]] [-f] <-s source:sourceport> ``` -------------------------------- ### Install Agent Skills via Command Line Source: https://learn.microsoft.com/en-us/sysinternals/downloads/debugview Commands to install agent-specific skills into the current workspace or globally for various AI coding assistants. ```batch REM Install skills for GitHub Copilot in the current workspace dbgviewcli --install-skills copilot REM Install skills globally for Claude (available in all projects) dbgviewcli --install-skills claude --global REM Install skills for Cursor (local only) dbgviewcli --install-skills cursor REM Install skills for Codex globally dbgviewcli --install-skills codex --global ``` -------------------------------- ### Coreinfo Output Example Source: https://learn.microsoft.com/en-us/sysinternals/downloads/coreinfo A sample output showing CPU identification, microcode signatures, and supported processor features. ```text Coreinfo v4.0 - Dump information on system CPU and memory topology Copyright © 2008-2025 Mark Russinovich Sysinternals - www.sysinternals.com Intel(R) Core(TM) Ultra 7 165U Intel64 Family 6 Model 170 Stepping 4, GenuineIntel Microcode signature: 0000001E Processor signature: 000A06A4 Maximum implemented CPUID leaves: 00000023 (Basic), 80000008 (Extended). Maximum implemented address width: 48 bits (virtual), 46 bits (physical). HTT * Hyperthreading enabled CET * Supports Control Flow Enforcement Technology Kernel CET - Kernel-mode CET Enabled User CET * User-mode CET Allowed X64 * Supports 64-bit mode SMX - Supports Intel trusted execution SKINIT - Supports AMD SKINIT SGX - Supports Intel SGX NX * Supports no-execute page protection SMEP * Supports Supervisor Mode Execution Prevention SMAP * Supports Supervisor Mode Access Prevention PAGE1GB * Supports 1 GB large pages PAE * Supports > 32-bit physical addresses PAT * Supports Page Attribute Table PSE * Supports 4 MB pages PSE36 * Supports > 32-bit address 4 MB pages PGE * Supports global bit in page tables SS * Supports bus snooping for cache operations VME * Supports Virtual-8086 mode RDWRFSGSBASE * Supports direct GS/FS base access FPU * Implements i387 floating point instructions MMX * Supports MMX instruction set MMXEXT - Implements AMD MMX extensions 3DNOW - Supports 3DNow! instructions 3DNOWEXT - Supports 3DNow! extension instructions SSE * Supports Streaming SIMD Extensions SSE2 * Supports Streaming SIMD Extensions 2 SSE3 * Supports Streaming SIMD Extensions 3 SSSE3 * Supports Supplemental SIMD Extensions 3 SSE4a - Supports Streaming SIMDR Extensions 4a SSE4.1 * Supports Streaming SIMD Extensions 4.1 SSE4.2 * Supports Streaming SIMD Extensions 4.2 AES * Supports AES extensions AVX * Supports AVX instruction extensions AVX2 * Supports AVX2 instruction extensions AVX-512-F - Supports AVX-512 Foundation instructions AVX-512-DQ - Supports AVX-512 double and quadword instructions AVX-512-IFAMA - Supports AVX-512 integer Fused multiply-add instructions AVX-512-PF - Supports AVX-512 prefetch instructions AVX-512-ER - Supports AVX-512 exponential and reciprocal instructions AVX-512-CD - Supports AVX-512 conflict detection instructions AVX-512-BW - Supports AVX-512 byte and word instructions AVX-512-VL - Supports AVX-512 vector length instructions FMA * Supports FMA extensions using YMM state MSR * Implements RDMSR/WRMSR instructions MTRR * Supports Memory Type Range Registers XSAVE * Supports XSAVE/XRSTOR instructions OSXSAVE * Supports XSETBV/XGETBV instructions RDRAND * Supports RDRAND instruction RDSEED * Supports RDSEED instruction CMOV * Supports CMOVcc instruction CLFSH * Supports CLFLUSH instruction CX8 * Supports compare and exchange 8-byte instructions CX16 * Supports CMPXCHG16B instruction BMI1 * Supports bit manipulation extensions 1 BMI2 * Supports bit manipulation extensions 2 ADX * Supports ADCX/ADOX instructions DCA - Supports prefetch from memory-mapped device F16C * Supports half-precision instruction FXSR * Supports FXSAVE/FXSTOR instructions ``` -------------------------------- ### Daemon Configuration File Format Source: https://learn.microsoft.com/en-us/sysinternals/downloads/listent Example TOML configuration for the listent daemon. ```toml [daemon] polling_interval = 1.0 auto_start = true [monitoring] path_filters = [] entitlement_filters = ["com.apple.security.*", "*network*"] [logging] level = "info" subsystem = "com.microsoft.sysinternals.listent" category = "daemon" ``` -------------------------------- ### Manage Background Daemon Service Source: https://learn.microsoft.com/en-us/sysinternals/downloads/listent Install, monitor, and manage the persistent listent background service using launchd. ```bash # Install and start daemon sudo listent daemon install # Check daemon status listent daemon status # View daemon logs listent daemon logs listent daemon logs --since 1h listent daemon logs --since 30m listent daemon logs --since "2025-01-15 10:00" listent daemon logs --format json listent daemon logs -f # Follow logs in real-time # Stop daemon process listent daemon stop # Uninstall service sudo listent daemon uninstall ``` -------------------------------- ### Install ProcDump Source: https://learn.microsoft.com/en-us/sysinternals/downloads/procdump Registers ProcDump as the post-mortem debugger for Windows. ```Windows Command Prompt procdump.exe -i [Dump_Folder] [-mm] [-ma] [-mt] [-mp] [-mc ] [-md ] [-mk] [-r] [-at ] [-k] [-wer] ``` -------------------------------- ### Manage Listent Daemon Source: https://learn.microsoft.com/en-us/sysinternals/downloads/listent Commands to install, monitor, and control the background daemon process. ```bash # Install daemon with default monitoring (requires sudo) sudo listent daemon install # Install with custom configuration file sudo listent daemon install --config /path/to/config.toml # View recent daemon activity listent daemon logs --since 1h # Check if daemon is running listent daemon status # Stop and remove daemon listent daemon stop sudo listent daemon uninstall ``` -------------------------------- ### Azure Load Balance Configuration Source: https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman Example string for configuring load balance settings in the Connection Settings tab. ```text Cookie: mstshash=MyServiceWebRole#MyServiceWebRole_IN_0#Microsoft.WindowsAzure.Plugins.RemoteAccess.Rdp ``` -------------------------------- ### Monitor and Launch Processes Source: https://learn.microsoft.com/en-us/sysinternals/downloads/procdump Commands to wait for a process to start or launch a new process for monitoring. ```Windows Command Prompt C:\>procdump -e -w notepad ``` ```Windows Command Prompt C:\>procdump -e -x c:\dumps notepad ``` ```Windows Command Prompt C:\>procdump -e -x c:\dumps Microsoft.BingMaps_8wekyb3d8bbwe!AppexMaps ``` ```Windows Command Prompt C:\>procdump -e -x c:\dumps Microsoft.BingMaps_1.2.0.136_x64__8wekyb3d8bbwe ``` -------------------------------- ### Display LoggedOn utility output Source: https://learn.microsoft.com/en-us/sysinternals/resources/archive/v01n03 Example output showing interactive and resource-based user sessions on a remote system. ```text C:\>loggedon main LoggedOn v1.0 - Logon Session Displayer Copyright (C) 1999 Mark Russinovich Systems Internals - http://www.sysinternals.com Users logged on locally: MAIN\Administrator Users logged on via resource shares: MAINDOM\MARK ``` -------------------------------- ### Run Internet Explorer with limited privileges Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec Starts Internet Explorer with restricted user permissions. ```bash psexec -l -d "c:\program files\internet explorer\iexplore.exe" ``` -------------------------------- ### Check for Unsigned Files Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck Example command to identify unsigned executable files within the Windows System32 directory. ```text sigcheck -u -e c:\windows\system32 ``` -------------------------------- ### Drive Letter Specification Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete Example of how to specify a drive letter when using SDelete. ```text D: ``` -------------------------------- ### Configure PsPing Server Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psping Sets up a server instance to listen for latency and bandwidth tests on a specific address and port. ```batch psping -s 192.168.2.2:5000 ``` -------------------------------- ### Display PsPing usage help Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psping Displays the available command-line options for different test types. ```text psping -? [i|t|l|b] ``` -------------------------------- ### RawAccessRead event XML schema Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon Example of the XML schema definition for the RawAccessRead event type. ```xml ``` -------------------------------- ### Define Entitlement Patterns Source: https://learn.microsoft.com/en-us/sysinternals/downloads/listent Examples of using the -e flag with exact matches and glob patterns. ```bash # Exact match -e "com.apple.security.network.client" # Wildcard patterns -e "com.apple.security.*" # All Apple security entitlements -e "*network*" # Any entitlement containing "network" -e "*.debug.*" # Debug-related entitlements # Multiple patterns (OR logic) -e "com.apple.private.*" -e "*.debug.*" ``` -------------------------------- ### Configure PsPing Client Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psping Command syntax to initiate a PsPing client test. ```Windows Command Prompt psping [-b] [[-6]|[-4]] [-f] [-u] [-h [buckets | ,,...]] [-r] <-l requestsize>[k|m]] <-n count> [-i ] [-w ] ``` -------------------------------- ### Bulk Add Server Patterns Source: https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman Patterns for adding multiple servers using iteration and range syntax. ```text server1{a,b,c} ``` ```text server[001-15] ``` ```text {dca,dcb}rack[1-5]sql[1-2] ``` -------------------------------- ### Display ProcDump help and exception options Source: https://learn.microsoft.com/en-us/sysinternals/downloads/procdump Use this command to view the help menu and exception monitoring options for ProcDump. ```batch C:\>procdump -? -e ``` -------------------------------- ### Import Server Text File Format Source: https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman Format for importing servers from a text file, requiring one server name per line. ```text Server1 SecondServer YANS ``` -------------------------------- ### View PnP Manager Debug Output Source: https://learn.microsoft.com/en-us/sysinternals/resources/archive/v03n01 Example of the debug log output generated by the PnP Manager when PnpEnumDebugLevel is set to 2. ```text . IopCallDriverAddDevice: Processing devnode 0xfe503208 IopCallDriverAddDevice: DevNode flags going in = 0x000019 IopCallDriverAddDevice: Will load driver IopCallDriverAddDevice: Opening registry key Root\SYSTEM\0000 IopCallDriverAddDevice: Class GUID is {4D36E97D-E325-11CE-BFC1-08002BE10318} IopCallDriverAddDevice: Unable to open GUID\Properties key {4D36E97D-E325-11CE-BFC1-08002BE10318} - 0xc0000034 IopCallDriverAddDevice: Value Service [Type 1, Len 14] @ 0xe14ee82c IopCallDriverAddDevice: Service Name swenum IopCallDriverAddDevice: DriverName is \Driver\swenum IopCallDriverAddDevice: Driver Reference 0xff3a8af0 IopCallDriverAddDevice: Adding Services (type 0) IopCallDriverAddDevice: Adding Services (type 1) IopCallDriverAddDevice: Adding Services (type 2) IopCallDriverAddDevice: Adding driver 0xff3a8af0 IopCallDriverAddDevice: Routine returned 00000000 . ``` -------------------------------- ### Coreinfo Command-Line Usage Source: https://learn.microsoft.com/en-us/sysinternals/downloads/coreinfo The basic syntax for executing Coreinfo with optional flags to filter the output. ```text coreinfo [-c][-f][-g][-l][-n][-s][-m][-v] ``` -------------------------------- ### Show Sysmon configuration schema Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon Displays the XML schema used for Sysmon configuration files. ```Windows Command Prompt sysmon -s ``` -------------------------------- ### Launch an interactive command prompt on a remote system Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec Starts an interactive command prompt session on the specified remote computer. ```bash psexec -i \\marklap cmd ```