https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
This update to Sysmon adds a process image tampering event that reports when the mapped image of a process doesn’t match the on-disk...
Updated Jan 11, 2021
Version 1.0
Blog Post
lukekim Was the wrong version of PsExec released today?
On https://docs.microsoft.com/en-us/sysinternals/downloads/psexec it says 2.21
When I download it and execute PsExec.exe it says 2.30 https://download.sysinternals.com/files/PSTools.zip)
On https://docs.microsoft.com/en-us/sysinternals/#whats-new-january-11-2021 there is no mention to PsExec 2.21 (yes Sysmon and Process Monitor)
We are having some issues since today on our CI pipeline out of nothing.... we tracked down to a build that ran well and used 2.20 and the first build that failed we saw used 2.30.
C:\Users\....> PsExec.exe -accepteula -i 1 -w . cmd /s /c "echo Hello World" PsExec v2.30 - Execute processes remotely Copyright (C) 2001-2021 Mark Russinovich Sysinternals - www.sysinternals.com The handle is invalid. Connecting to local system... Starting PSEXESVC service on local system... Copying authentication key to HOSTNAME... Connecting with PsExec service on HOSTNAME... Error communicating with PsExec service on HOSTNAME:
(See that there is no reason at the end. The exit code was 6)
Could you confirm it?
Thanks in advance