TCPView v4.0, PsExec v2.33, WinObj v3.02 and Sysmon v13.02

[lukekim]

TCPView v4.0

This major update to TCPView adds flexible filtering, support for searching, and now shows the Windows service that owns an endpoint. It is also the second Sysinternals tool to feature the new theme engine with dark mode.

PsExec v2.33

This update to PsExec mitigates named pipe squatting attacks that can be leveraged by an attacker to intercept credentials or elevate to System privilege. the -i command line switch is now necessary for running processes interactively, for example with redirected IO.

WinObj v3.02

This WinObj release fixes a bug that could cause it to crash.

Sysmon v13.02

This Sysmon update fixes a crash that could be caused by file deletion events, fixes the "is any" rule predicate, and adds several configuration parsing performance improvements.

[Luigi Bruno]

Great improvement for a very useful tool. Thank you.

[bughit]

tcpview suggestions:

• "show unconnected" toggle from 3.x
• column to show incoming vs outgoing tcp connection
• highlighting (background color) of established tcp connections
  
  • different colors for incoming and outgoing
• column reordering
• minimize to tray

thanks

[Christoph_Schneegans]

It seems the latest download from https://download.sysinternals.com/files/SysinternalsSuite.zip (published "March 23, 2021") contains two files named "Tcpview.exe" and "tcpview.exe". "tcpview.exe" appears to be the current version 4.0, while "Tcpview.exe" is the older version 3.5, which was built in 2011 according to its file properties.

[JohnMoosenl]

Bug:

TCPview 4.0 crashes when you only have TCP v4 selected and switch that off.

It does that too with TCP v6, only after some time.

Thanks

[alex335678]

Any way to optimize ImageLoad events?  This really kills performance but it is a best practice recommendation from most security team guidance.  For example, https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml configuration has this enabled but decreases any server performance between 15-40% at any given time. 

Is there any hope to see an open source version that the community can hope to optimize?

Thanks!

[NijazVista]

Can you please fix Process Explorer? Status bar displays "paused" when we press pause sometimes twice, sometimes in place of physical RAM or other value, sometimes not at all, so difficult to know if that task manager is paused. Also can you add feature so that it automatically pauses when in background or minimized, so it uses less CPU? So I want you to fix status bar, where various values disappear, or appear or get corrupted, and ability for auto pause, hope you understand.

[Melchior150]

Mark thanks for the update to TCPView