sysinternals
Bridge for driving Mark Russinovich's Sysinternals Suite on a remote Windows box over SSH. Microsoft-signed (often the only thing that works under strict EDR), broader system access than NirSoft, all CLI-friendly with CSV output.
Defaults (override via env vars)
SYSINTERNALS_HOST="${SYSINTERNALS_HOST:-${NIRCMD_HOST:-steamy-wsl}}" # ssh alias
SYSINTERNALS_DIR="${SYSINTERNALS_DIR:-/mnt/c/tools/sysinternals}" # POSIX path from WSL
For persistence across sessions, set in ~/.claude/settings.json under env.
Universal invocation pattern
ssh "$SYSINTERNALS_HOST" "$SYSINTERNALS_DIR/<tool>.exe <args> /accepteula" [-nobanner]
Always include /accepteula on the first run of any tool — Sysinternals tools block on an EULA prompt otherwise (it sets a registry key after first accept; subsequent runs are silent). Most tools accept -nobanner to suppress the credit line.
Install (one-shot)
# On the Windows host
Invoke-WebRequest 'https://download.sysinternals.com/files/SysinternalsSuite.zip' -OutFile $env:TEMP\sys.zip
Expand-Archive $env:TEMP\sys.zip -DestinationPath C:\tools\sysinternals -Force
~100 binaries, ~50MB. No installer, fully portable.
Most-used tools
Process inspection / control
| Tool |
Useful flags |
Example |
pslist.exe |
-t (tree), -x (memory + threads), <name> to filter |
pslist.exe -t chrome |
pskill.exe |
<pid> or <name>, -t (kill tree) |
pskill.exe -t chrome.exe — ask first |
psloggedon.exe |
-l (local only), -x (no welcome) |
psloggedon.exe -x |
handle.exe |
-p <pid>, -a (all types), -c <handle> (close — risky), <substring> (search) |
handle.exe -a stuck-file.txt |
listdlls.exe |
<process-name>, -r (relocated), -u (unsigned) |
listdlls.exe -u |
procdump.exe |
-ma <pid> <out.dmp> (full mem dump), -mp <pid> (mini) |
ask first — large files |
Network
| Tool |
Useful flags |
Example |
tcpvcon.exe |
-a (all + CSV), -c (CSV no header), -n (no DNS) |
tcpvcon.exe -anc |
psping.exe |
-t <target> (TCP), -l <size> |
psping.exe 8.8.8.8:443 |
Autoruns / persistence
| Tool |
Useful flags |
Example |
autorunsc.exe |
-a * (all categories), -c (CSV), -h (hashes), -s (signed status), -v (VirusTotal) |
autorunsc.exe -a * -c -h -nobanner /accepteula > out.csv |
-a categories: b boot, d AppInit DLLs, e explorer addons, g sidebar gadgets, h image hijacks, i IE addons, k known DLLs, l logon, m WMI, n Winsock, o codecs, p printer monitors, r LSA providers, s services, t scheduled tasks, w Winlogon. * = all.
Files / signatures / streams
| Tool |
Useful flags |
Example |
sigcheck.exe |
-h (hashes), -c (CSV), -v r (VirusTotal — sends hashes), -u (unsigned only), -e (executables only) |
sigcheck.exe -e -u -h -c C:\Users\<user>\Downloads |
streams.exe |
-s (recurse), -d (delete — ask first) |
streams.exe -s C:\Downloads |
du.exe |
-c (CSV), -l <levels>, -n (no header) |
du.exe -c -l 2 C:\Users |
accesschk.exe |
-u (no errors), -w (write access only), -s (recurse), -q (quiet) |
accesschk.exe -uw "Authenticated Users" C:\Program Files |
Remote / elevation — ask first tier
| Tool |
Notes |
psexec.exe -s -i <cmd> |
Run as SYSTEM interactively. Audited by EDR as suspicious. |
psexec.exe \\host -u user -p pass <cmd> |
Run on another machine. Same audit profile. |
Safety boundaries
| Tier |
Tools |
| Auto-allowed (read-only) |
pslist, psloggedon, handle (no -c), listdlls, tcpvcon, psping, autorunsc (read), sigcheck (without -v), streams (read), du, accesschk |
| Ask first |
pskill, handle -c (close handle), procdump, streams -d, sigcheck -v (sends hashes to VirusTotal — may leak filenames in metadata), autorunsc -m |
| Refuse without extremely explicit instruction |
psexec to other hosts, anything -accepteula is being used to bulk-deploy under another user |
Round-trip output pattern
Same as the NirSoft companions — write CSV on Windows, cat back over SSH:
WIN_OUT='C:\Users\<user>\AppData\Local\Temp\handles.csv'
POSIX_OUT='/mnt/c/Users/<user>/AppData/Local/Temp/handles.csv'
ssh "$SYSINTERNALS_HOST" "$SYSINTERNALS_DIR/handle.exe -a -nobanner /accepteula > '$WIN_OUT'"
ssh "$SYSINTERNALS_HOST" "cat '$POSIX_OUT'" | grep -i stuck-file
Some tools emit CSV directly to stdout (tcpvcon -anc, autorunsc -c, sigcheck -c) — you can skip the temp file and pipe straight to local awk/jq.
When to pick this vs nircmd/NirSoft
| Need |
Tool |
| Push to clipboard / lock / TTS / window control |
nircmd |
| What ran on this box / browser history / Wi-Fi APs |
NirSoft (LastActivityView, BrowsingHistoryView, WirelessNetView) |
| Kernel handles, autoruns, signed-binary process control |
Sysinternals (handle, autorunsc, pskill) |
| Open TCP ports |
Either (cports is friendlier UI, tcpvcon -anc is signed) |
| File signatures / permissions audit |
Sysinternals (sigcheck, accesschk) |
References
references/tool-catalog.md — full categorized list with all documented flags
1---2name: sysinternals3description: Drive Microsoft Sysinternals CLI tools on a remote Windows machine over SSH — list/kill processes (pslist, pskill), inspect open handles (handle), audit autoruns (autorunsc), check TCP/UDP connections (tcpvcon), verify file signatures + VirusTotal (sigcheck), audit permissions (accesschk), find alt data streams (streams), measure disk usage (du), check who's logged in (psloggedon), and run remotely (psexec). Use whenever the user wants kernel-level handle inspection, signed-binary process control under EDR, autorun forensics, file signature verification, security/permission audits, or anything from Mark Russinovich's suite. Sibling to the nircmd / NirSoft skill — prefer Sysinternals when the answer needs Microsoft-signed tooling (works under stricter AV, deeper system access) or covers kernel handles, autoruns, or signature/permission audits. Defaults to `ssh steamy-wsl` and `C:\tools\sysinternals\`; override via `SYSINTERNALS_HOST` and `SYSINTERNALS_DIR` env vars.4---56# sysinternals78Bridge for driving Mark Russinovich's Sysinternals Suite on a remote Windows box over SSH. Microsoft-signed (often the *only* thing that works under strict EDR), broader system access than NirSoft, all CLI-friendly with CSV output.910## Defaults (override via env vars)1112```bash13SYSINTERNALS_HOST="${SYSINTERNALS_HOST:-${NIRCMD_HOST:-steamy-wsl}}" # ssh alias14SYSINTERNALS_DIR="${SYSINTERNALS_DIR:-/mnt/c/tools/sysinternals}" # POSIX path from WSL15```1617For persistence across sessions, set in `~/.claude/settings.json` under `env`.1819## Universal invocation pattern2021```bash22ssh "$SYSINTERNALS_HOST" "$SYSINTERNALS_DIR/<tool>.exe <args> /accepteula" [-nobanner]23```2425**Always include `/accepteula`** on the first run of any tool — Sysinternals tools block on an EULA prompt otherwise (it sets a registry key after first accept; subsequent runs are silent). Most tools accept `-nobanner` to suppress the credit line.2627## Install (one-shot)2829```powershell30# On the Windows host31Invoke-WebRequest 'https://download.sysinternals.com/files/SysinternalsSuite.zip' -OutFile $env:TEMP\sys.zip32Expand-Archive $env:TEMP\sys.zip -DestinationPath C:\tools\sysinternals -Force33```3435~100 binaries, ~50MB. No installer, fully portable.3637## Most-used tools3839### Process inspection / control4041| Tool | Useful flags | Example |42|---|---|---|43| `pslist.exe` | `-t` (tree), `-x` (memory + threads), `<name>` to filter | `pslist.exe -t chrome` |44| `pskill.exe` | `<pid>` or `<name>`, `-t` (kill tree) | `pskill.exe -t chrome.exe` — **ask first** |45| `psloggedon.exe` | `-l` (local only), `-x` (no welcome) | `psloggedon.exe -x` |46| `handle.exe` | `-p <pid>`, `-a` (all types), `-c <handle>` (close — risky), `<substring>` (search) | `handle.exe -a stuck-file.txt` |47| `listdlls.exe` | `<process-name>`, `-r` (relocated), `-u` (unsigned) | `listdlls.exe -u` |48| `procdump.exe` | `-ma <pid> <out.dmp>` (full mem dump), `-mp <pid>` (mini) | **ask first** — large files |4950### Network5152| Tool | Useful flags | Example |53|---|---|---|54| `tcpvcon.exe` | `-a` (all + CSV), `-c` (CSV no header), `-n` (no DNS) | `tcpvcon.exe -anc` |55| `psping.exe` | `-t <target>` (TCP), `-l <size>` | `psping.exe 8.8.8.8:443` |5657### Autoruns / persistence5859| Tool | Useful flags | Example |60|---|---|---|61| `autorunsc.exe` | `-a *` (all categories), `-c` (CSV), `-h` (hashes), `-s` (signed status), `-v` (VirusTotal) | `autorunsc.exe -a * -c -h -nobanner /accepteula > out.csv` |6263`-a` categories: `b` boot, `d` AppInit DLLs, `e` explorer addons, `g` sidebar gadgets, `h` image hijacks, `i` IE addons, `k` known DLLs, `l` logon, `m` WMI, `n` Winsock, `o` codecs, `p` printer monitors, `r` LSA providers, `s` services, `t` scheduled tasks, `w` Winlogon. `*` = all.6465### Files / signatures / streams6667| Tool | Useful flags | Example |68|---|---|---|69| `sigcheck.exe` | `-h` (hashes), `-c` (CSV), `-v r` (VirusTotal — sends hashes), `-u` (unsigned only), `-e` (executables only) | `sigcheck.exe -e -u -h -c C:\Users\<user>\Downloads` |70| `streams.exe` | `-s` (recurse), `-d` (delete — **ask first**) | `streams.exe -s C:\Downloads` |71| `du.exe` | `-c` (CSV), `-l <levels>`, `-n` (no header) | `du.exe -c -l 2 C:\Users` |72| `accesschk.exe` | `-u` (no errors), `-w` (write access only), `-s` (recurse), `-q` (quiet) | `accesschk.exe -uw "Authenticated Users" C:\Program Files` |7374### Remote / elevation — **ask first tier**7576| Tool | Notes |77|---|---|78| `psexec.exe -s -i <cmd>` | Run as SYSTEM interactively. Audited by EDR as suspicious. |79| `psexec.exe \\host -u user -p pass <cmd>` | Run on another machine. Same audit profile. |8081## Safety boundaries8283| Tier | Tools |84|---|---|85| **Auto-allowed** (read-only) | `pslist`, `psloggedon`, `handle` (no `-c`), `listdlls`, `tcpvcon`, `psping`, `autorunsc` (read), `sigcheck` (without `-v`), `streams` (read), `du`, `accesschk` |86| **Ask first** | `pskill`, `handle -c` (close handle), `procdump`, `streams -d`, `sigcheck -v` (sends hashes to VirusTotal — may leak filenames in metadata), `autorunsc -m` |87| **Refuse without extremely explicit instruction** | `psexec` to other hosts, anything `-accepteula` is being used to bulk-deploy under another user |8889## Round-trip output pattern9091Same as the NirSoft companions — write CSV on Windows, `cat` back over SSH:9293```bash94WIN_OUT='C:\Users\<user>\AppData\Local\Temp\handles.csv'95POSIX_OUT='/mnt/c/Users/<user>/AppData/Local/Temp/handles.csv'96ssh "$SYSINTERNALS_HOST" "$SYSINTERNALS_DIR/handle.exe -a -nobanner /accepteula > '$WIN_OUT'"97ssh "$SYSINTERNALS_HOST" "cat '$POSIX_OUT'" | grep -i stuck-file98```99100Some tools emit CSV directly to stdout (`tcpvcon -anc`, `autorunsc -c`, `sigcheck -c`) — you can skip the temp file and pipe straight to local awk/jq.101102## When to pick this vs nircmd/NirSoft103104| Need | Tool |105|---|---|106| Push to clipboard / lock / TTS / window control | **nircmd** |107| What ran on this box / browser history / Wi-Fi APs | **NirSoft** (LastActivityView, BrowsingHistoryView, WirelessNetView) |108| Kernel handles, autoruns, signed-binary process control | **Sysinternals** (handle, autorunsc, pskill) |109| Open TCP ports | Either (`cports` is friendlier UI, `tcpvcon -anc` is signed) |110| File signatures / permissions audit | **Sysinternals** (sigcheck, accesschk) |111112## References113114- `references/tool-catalog.md` — full categorized list with all documented flags
jmagar