Troubleshooting Procmon & Sysmon v3.32
ID: b1461741-4e2f-5556-89d6-e409bf4129a3
STIX ID: report--b1461741-4e2f-5556-89d6-e409bf4129a3
Feed Name: Huntress Blog
During a breach investigation analysts found Procmon v3.32 failed to load its driver on a 64-bit Windows 7 system because Windows refused the driver due to code-integrity (signature chain) validation issues; they extracted the driver from Procmon64.exe, verified the signature with Sigcheck, reproduced the problem in a lab VM, and resolved the issue by installing KB3033929 (updating Trusted Root Certificates / adding SHA-2 support) which restored the certification path and allowed Procmon to run.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.