https://cybertoolchain.io/tools/microsoft-sysinternals New releases and features in Microsoft Sysinternals, tracked by The Cyber Toolchain. en Fri, 16 Oct 2026 16:56:51 GMT https://techcommunity.microsoft.com/t5/sysinternals-blog/procexp-zoomit-bginfo-listdlls-procdump-procmon-pskill-sigcheck/ba-p/4564991 https://techcommunity.microsoft.com/t5/sysinternals-blog/procexp-zoomit-bginfo-listdlls-procdump-procmon-pskill-sigcheck/ba-p/4564991 Fri, 16 Oct 2026 16:56:51 GMT Process Explorer 17.2 adds efficiency mode, live kernel dumps, memory map explorer, NPU monitoring, and persistent activity history; Sigcheck 2.93 adds UTF-8 output encoding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `UTF-8` encoding option for file output in Sigcheck v2.93.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds live kernel memory dump creation to Process Explorer v17.2. • Adds a Devices page to the System Information view in Process Explorer v17.2. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/linux-procdump-procmon-sysmon-pipelist-procexp-procmon-pstools/ba-p/4555438 https://techcommunity.microsoft.com/t5/sysinternals-blog/linux-procdump-procmon-sysmon-pipelist-procexp-procmon-pstools/ba-p/4555438 Thu, 10 Sep 2026 19:23:55 GMT Sysinternals adds Amazon Linux 2023 support and aarch64 architecture coverage for Linux tools, with ProcDump rewritten in Rust.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Amazon Linux 2023 support across ProcDump for Linux, Procmon for Linux, Sysinternals EBPF, and Sysmon for Linux.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Rewrites ProcDump for Linux 3.5.3 in Rust. • Adds support for long pipe names in PipeList v1.03. • Adds smooth zooming to ZoomIt v12.22. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/process-monitor-v4-1-zoomit-12-3-for-macos-rdcman-v3-21-and/ba-p/4548264 https://techcommunity.microsoft.com/t5/sysinternals-blog/process-monitor-v4-1-zoomit-12-3-for-macos-rdcman-v3-21-and/ba-p/4548264 Wed, 19 Aug 2026 23:20:02 GMT Process Monitor gains IPC event class; ZoomIt macOS adds DemoMirror; RDCMan re-enables RD gateway support • Adds the IPC event class to Process Monitor v4.1, enabling real-time observation of named pipe and mailslot activity alongside existing file system, Registry, and process/thread events. • Introduces DemoMirror in ZoomIt 12.3 for macOS, allowing the screen, a screen region, or a window to be mirrored onto a second monitor. • Re-enables Remote Desktop gateway support in RDCMan v3.21. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/notmyfault-rdcman-zoomit-coreinfo-process-explorer-process/ba-p/4546406 https://techcommunity.microsoft.com/t5/sysinternals-blog/notmyfault-rdcman-zoomit-coreinfo-process-explorer-process/ba-p/4546406 Wed, 12 Aug 2026 18:19:35 GMT Sysinternals drops DemoMirror in ZoomIt, AVD/Dev Box support in RDCMan, and Process Tree PID filtering in Process Monitor. • Process Monitor adds Process Tree PID filtering to match events based on any ancestor process ID in the process tree — useful for tracing all activity spawned by a parent process. • RDCMan v3.20 adds Azure Virtual Desktop workspace feed support and Microsoft Dev Box support. • ZoomIt v12.2 introduces DemoMirror for mirroring the screen, a screen region, or a window onto a second monitor. • Process Explorer v17.13 adds core type information for Intel CPUs. • CoreInfo v4.02 adds Intel LP-E cores support and improves CPU vendor name detection. • NotMyFault v4.6 is rewritten in Rust and ships with a modern UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/livekd-v5-65-procdump-v12-01-and-zoomit-v12-11/ba-p/4535408 https://techcommunity.microsoft.com/t5/sysinternals-blog/livekd-v5-65-procdump-v12-01-and-zoomit-v12-11/ba-p/4535408 Thu, 09 Jul 2026 16:59:28 GMT LiveKd 5.65 restricts dump file access to admins; ZoomIt 11.11 adds JPEG and WEBP snip format support. • LiveKd now protects generated kernel dump files from being read by non-admin users. • ZoomIt adds JPEG and WEBP format support for snip captures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-zoomit-coreinfo-debugview-livekd-procdump-for-linux/ba-p/4528947 https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-zoomit-coreinfo-debugview-livekd-procdump-for-linux/ba-p/4528947 Fri, 19 Jun 2026 15:33:22 GMT Autoruns aligns CLI with GUI; ZoomIt gains webcam/mic features; ProcDump Linux gets .NET counters; LiveKd adds agent skills. • Adds packaged apps support to the `autorunsc` command-line utility • Adds image backgrounds, webcam background blur and microphone noise cancellation support in ZoomIt v12.1 • Adds Ctrl-Shift-A for selecting all output in DebugView • Adds agent skills support for the LiveKd CLI utility • Adds .NET counters and a custom core dumper to ProcDump for Linux Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-procdump-zoomit-debugview-notmyfault-procexp-procmon/ba-p/4517553 https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-procdump-zoomit-debugview-notmyfault-procexp-procmon/ba-p/4517553 Thu, 07 May 2026 19:11:06 GMT Sysinternals May 2026 release adds packaged app support to Autoruns, process tree dumps in ProcDump, and Linux distro updates. • Autoruns `v14.2` adds monitoring for Windows packaged apps • ProcDump `v12.0` adds `-pt` flag to capture memory dumps for entire process trees • ZoomIt `v12.0` enables webcam overlay in video captures and clip appending in the trim editor • DebugView `v5.01` reinstates Windows 10 support, enables PID-based highlighting, and adds Ctrl+PgUp/PgDn for 10-page scrolling in Process Monitor Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/listent-for-macos-zoomit-sysmon-debugview-notmyfault-procmon-for/ba-p/4506035 https://techcommunity.microsoft.com/t5/sysinternals-blog/listent-for-macos-zoomit-sysmon-debugview-notmyfault-procmon-for/ba-p/4506035 Thu, 26 Mar 2026 21:02:20 GMT listent 1.0 for macOS adds code signing entitlement discovery; ZoomIt v11.0 gains scrolling screenshots and text extraction • `ZoomIt v11.0` adds the ability to capture panorama / scrolling screenshots and extract text during snip. • `ZoomIt v11.0` enables the trimming clip editor for existing .mp4 files. • `ZoomIt v11.0` adds improved break timer functionality. • `DebugView v5.0` introduces a new dark theme UI option. • `NotMyFault v4.4` adds secure kernel and hypervisor crash triggers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v10-0-sysmon-1-5-for-linux-sigcheck-v2-91-rammap-v1-62/ba-p/4492342 https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v10-0-sysmon-1-5-for-linux-sigcheck-v2-91-rammap-v1-62/ba-p/4492342 Fri, 06 Feb 2026 16:35:59 GMT ZoomIt v10 adds video clip editor and system sound recording; Sysmon for Linux adds eBPF monitoring. • Adds a video clip editor in ZoomIt to trim recordings before saving them • Enables recording system sounds in ZoomIt video clips Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/coreinfo-v4-0-notmyfault-v4-30-and-process-explorer-v17-09/ba-p/4478567 https://techcommunity.microsoft.com/t5/sysinternals-blog/coreinfo-v4-0-notmyfault-v4-30-and-process-explorer-v17-09/ba-p/4478567 Wed, 17 Dec 2025 00:52:52 GMT Coreinfo gains a GUI; NotMyFault adds Arm64 support; Process Explorer enables the Assemblies tab for .NET processes. • Adds a GUI version of Coreinfo alongside the existing CLI tool • Adds `HalTimerWatchdogTriggerSystemReset` as a new crash type in NotMyFault Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v9-20-process-explorer-v17-07-and-rdcman-v3-11/ba-p/4469055 https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v9-20-process-explorer-v17-07-and-rdcman-v3-11/ba-p/4469055 Tue, 11 Nov 2025 20:48:11 GMT ZoomIt v9.20 adds MP4/GIF recording; PE v17.07 adds Arm64 strings; RDCMan v3.11 enables Entra ID logins • ZoomIt v9.20 now saves screen recordings as MP4 or GIF. • Process Explorer v17.07 adds string extraction for Arm64 binaries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals https://techcommunity.microsoft.com/t5/sysinternals-blog/jcd-1-0-for-linux-and-mac-and-zoomit-v9-01/ba-p/4454875 https://techcommunity.microsoft.com/t5/sysinternals-blog/jcd-1-0-for-linux-and-mac-and-zoomit-v9-01/ba-p/4454875 Wed, 17 Sep 2025 20:04:20 GMT jcd 1.0 release for Linux and Mac adds smart directory navigation to Sysinternals CLI tooling. • `jcd` v1.0 is released for Linux and macOS, providing quick directory navigation with substring matching and smart selection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sysinternals