Windows sysinternals

[PerranOak]

Do people use sysinternals?

Is it (are they?) safe to use ... I mean from a security point of view rather than a "dangerous tool in the hands of a numpty" point of view?

Cheers.

[Perkele]

>Do people use sysinternals?
Yes.

>Is it (are they?) safe to use ... I mean from a security point of view rather than a "dangerous tool in the hands of a numpty" point of view?
How much do you trust Microsoft code which is not a part of any of their "main" projects?
What's your actual concern - someone crashing one of those tools and running some shellcode while you're executing it with admin privileges, or someone else just running it on your computer?

[coromonadalix]

 

[radiolistener]

Are you kidding? 

Sysinternals tools are developed by Microsoft itself — by the same people who build and maintain Windows internals. If you download them from the official Microsoft Sysinternals website, they're probably more trustworthy than half the third-party software running on your system...

Its even more trustworthy than Windows itself 

[coromonadalix]

Microsoft bought sysinternal  you should say

story
https://windowsreport.com/sysinternals-suite-comes-to-the-microsoft-store/

[DimitriP]

I run the "originals" whenever I can , unless they no longer "work".
I'm not glad they were taken under the microsoft wing , so to speak,
but
I am glad Mark got the recognition and hopefully lotsa $ he deserves.

If it were me, I'd want to get paid extra for having "Azure" in my title.

[IanB]

Do people use sysinternals?

Is it (are they?) safe to use ... I mean from a security point of view rather than a "dangerous tool in the hands of a numpty" point of view?

Cheers.

They are vital tools in the toolkit of anyone who does anything technical with Windows. Yes, you can trust them, as long as you download them from a trusted source like the Microsoft download site.

As far as I know, all of the SysInternals tools use openly available Windows API calls, even if some of them are very low level. You could write any of the tools yourself if you had sufficient detailed knowledge of how Windows works. None of the tools bypass any of the security or protection features of the OS.

The tools exist because Microsoft would have had no interest in developing such highly specialized and low level tools for the mass market of normal Windows users. They are technical tools for technical users like software developers, sysadmins, network admins, and the like.

[Ranayna]

The most dangerous tool of the Sysinternals Suite is likely PsExec.

But more due to the fact that to properly use it as it was originally envisioned, you need to tear down some security measures that were added to Windows over the years.
And it can also relatively easily be used to aquire SYSTEM permissions, which is a step *above* what an administrator can usually do on Windows.

[Berni]

Antiviruses sometimes panic when seeing low level system tools.

But that's not because the tools are a virus. The code they contain for doing these low level things just happens to be similar to what viruses use to do sneaky things. But the antivirus doesn't know the difference, it just knows that parts of the programs code are a high statistical match to some fragments of known viruses.

That being said since these tools are released by Microsoft themselves you can trust it. If Microsoft wanted to plant malware on your computer then they can just push it to you trough a windows update. Tho on Win 11 the amount of things they wreck with updates, it might as well be malware.

[coromonadalix]

never had any problems with all of them,  yep some AV don't like them,  but downloaded from official sources

saved my@ss a few times

[PerranOak]

Thank you very much all. IanB: long time no see!

They were good points, Perkele, so I thought about it. My “fear” was amorphous because I’d never heard of this suite of tools so I got, generally, paranoid.

Far be it from me to question whether Microsoft is our trustworthy friend and partner in our navigation of the Internet but I came across sysinternals in a series of videos including how some guy had all his files uploaded to the cloud via OneDrive which then deleted them from his PC without him knowing ... so he said.

This is why I wanted to ask the friendly folk here about it all and thank you to all you friendly people.

I guess the “official” site is:

https://learn.microsoft.com/en-us/sysinternals/

I get paranoid about this too after ThioJoe’s YouTube video regarding bods who use non-standard characters in a web address to fake real ones: like a Greek “E” which is really an epsilon not a capital e.

Maybe I’m too paranoid to use the web(!)

[madires]

Do people use sysinternals?

Many Windows sys admins do. Standard tools you put on your USB flash drive or network drive.

[madires]

I get paranoid about this too after ThioJoe’s YouTube video regarding bods who use non-standard characters in a web address to fake real ones: like a Greek “E” which is really an epsilon not a capital e.

There are browser plugins for displaying the punycode (encoding of unicode in ASCII, used by DNS) to help detecting such deceptions.