Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Does sysmon64 lock/remove files?

Open
  • Is something wrong?
#29 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
20/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
azure
Domain
devops, operating-systems

Research direction

Start with the reported Procmon traces and compare the two agents running sysmon64 with the working agent that does not. Investigate whether Sysmon is responsible for the PENDING DELETE access after compilation, and document a confirmed mitigation or whether disabling Sysmon is required.

Written by the indexing model from the issue text.

Description

We've been having a very strange issue with a particular Azure Devops pipeline over the last few months. We have three build agents, and the pipeline would consistently fail on two of them, and consistently work fine on the third. The failures are always the same - one specific project would fail to compile (always the same project) because it could not write the assembly object file (CSC2012: Access denied).

Analysis using Procmon showed that on the problem agents, immediately after the file is written by the compiler, subsequent access to the path would show PENDING DELETE.

We immediately suspected some heuristic rule in AV software (we run Symantec and Cylance) was quarantining the file, but after completely uninstalling both we were still seeing the error.

Then we noticed that sysmon64 was only running on the two problem agents and not on the third. After removing sysmon from one of the problem agents, the build started working fine on that agent.

Is there a way to mitigate this or do we simply have to turn off sysmon on these agents?

Dominant language
Python
Stars
1.4k
Forks
186
No merged PRs in 30d

Getting set up

We have not checked this project's setup files yet. Start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from trustedsec/SysmonCommunityGuide

All issues in trustedsec/SysmonCommunityGuide

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.