Sysmon v13.00, Process Monitor v3.61 and PsExec v2.21
Published Jan 11 2021 03:12 AM 10.5K Views

Sysmon v13.00

This update to Sysmon adds a process image tampering event that reports when the mapped image of a process doesn’t match the on-disk image file, or the image file is locked for exclusive access. These indicators are triggered by process hollowing and process herpaderping. This release also includes several bug fixes, including fixes for minor memory leaks.

Process Monitor v3.61

This update to Process Monitor adds monitoring for RegSaveKey, RegLoadKey and RegRestoreKey APIs, as well as fixes a bug in the details output for some types of directory queries.

PsExec v2.21

This update to PsExec, a command line utility for remotely launching processes on Windows computers, removes some MAX_PATH related limits and now mandates the -i flag for interactive sessions.
Version history
Last update:
‎Jan 11 2021 03:12 AM
Updated by: