The November 2016 update for Sysintenals receives Major Improvements bringing Sysmon registry enhancements and improvements to Procexp, Procdump and LiveKd. Listed below are the major improvements:

  • Sysmon v5
    This major update to Sysmon, a background monitor that records activity to the event log for use in security incident detection and forensics, introduces file create and registry modification logging. These event types make it possible to configure filters that capture updates to critical system configuration as well as changes to autostart entry points used by malware.
  • ┬áProcess Explorer v16.20
    This release of Process Explorer, a powerful process management and diagnostic utility, adds reporting of process Control Flow Guard (CFG) status and dynamically updates to reflect changes to process Data Execution Prevention (DEP) configuration.
  • Procdump v8.2
    Procdump, a command-line utility that generates process dumps on demand or based on triggers that include memory, CPU, exception and performance counter thresholds, adds a -kill option that terminates a process after its dump completes rather than allowing an exception to pass to Windows Error Reporting (WER), and a -wer switch to copy dumps to the WER queue.
  • LiveKd v5.6
    LiveKd, a tool that enables interactive kernel debugger analysis of a live system or virtual machine, includes a batch-mode option designed for scripted analysis that omits the prompt to re-execute LiveKD after a debugger session terminates.

You can view the entire Sysinternals Live tools directory in a browser at https://live.sysinternals.com.

About The Author

Akshay Waghray

Akshay Waghray, who holds a degree in Computer Science, was a former technology news reporter for Windows Latest and his area of expertise include Windows. Articles contributed by Akshay have been referred by big publications such as TechRadar, XDA Developers, Future Inc, Purge, and others over the years. At Windows Latest, Akshay has written and edited thousands of articles using his decades long experience with Windows Server and Windows Update for Business.