Skip to content

Commit 2d0ca29

Browse files
darkoperatordarkoperator
committed
add standalone changelog table
1 parent 41dfcf3 commit 2d0ca29

2 files changed

Lines changed: 15 additions & 133 deletions

File tree

‎sysmon-changelog.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Sysmon Changelog
2+
3+
| Version | Schema | Features | Release |
4+
|---------|--------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------|
5+
| 13.01 | 4.50 | * Fixed regression bug where several event types where not logged. | January 13, 2021 |
6+
| 13.0 | 4.50 | * Added support for Process Tampering Detection. | January 11, 2021 |
7+
| 12.03 | 4.40 | * fixes reporting and a possible crash condition for PipeEvent and RegistryEvent rules. | November 25, 2020 |
8+
| 12.02 | 4.40 | * This update to Sysmon fixes several configuration parsing bugs. | November 4, 2020 |
9+
| 12.01 | 4.40 | * Security and bug fix release, resolves a PipeEvent processing issue and adds extra checks to kernel writes. | October 16, 2020 |
10+
| 12.0 | 4.40 | * Added support to capture text stored in to the clipboard by a process. | September 17, 2020 |
11+
| 11.11 | 4.4 | * Fixes a bug that prevented USB media from being ejected.<br>* Fixes an issue that could stop network event logging and a resulting memory leak.<br>* Fixes logs file delete events for delete-on-close files. | July 15, 2020 |
12+
| 11.1 | 4.31 | * For Event ID 15 “Content field was added to save text streams of less than 1k.<br>* The –a commandline option has been removed. The custom archive directory must be set via configuration file.<br>* Fix Issue where EventID 1 was not logged on Windowds 2016 and Windows 10.<br>* Fix rule parsing issue. | June 24, 2020 |
13+
| 11.0 | 4.30 | * Control Reverse DNS Lookup.<br>* Log file deletions and story copy of the file.<br>* Bug Fixes. | April 28, 2020 |
14+
| 10.42 | 4.23 | * Memory leaks in DNS, Networking and Image load events<br>* Bug fixes including filtering, rule group names, NULL process GUIDS and W3LOGSVC interop issue<br>* Increased rule name field length from 32 to 128 characters<br>* Added “excludes any” and “excludes all” filtering conditions.<br>* Performance improvements for ImageLoad module | December 11, 2019 |

‎the-sysmon-driver.md‎

Lines changed: 1 addition & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -21,138 +21,6 @@ Sysmon sets multiple callbacks on kernel objects in addition to using telemetry
2121

2222
When the tool is downloaded from the Microsoft Sysinternals website <https://docs.microsoft.com/en-us/sysinternals/> it is important to save and identify previous versions since Microsoft does not provide older versions and the release notes do not detail what has been fixed. Microsoft has a fast release cycle, forcing users to test very carefully and to keep track of versions.
2323

24-
<table width="1280">
25-
<tbody>
26-
<tr style="height: 46px;">
27-
<td style="height: 46px;" width="132">
28-
<p><strong>Version</strong></p>
29-
</td>
30-
<td style="height: 46px;" width="114">
31-
<p><strong>Schema </strong></p>
32-
</td>
33-
<td style="height: 46px;" width="522">
34-
<p><strong>Features</strong></p>
35-
</td>
36-
<td style="height: 46px;" width="132">
37-
<p><strong>Release</strong></p>
38-
</td>
39-
</tr>
40-
<tr style="height: 46px;">
41-
<td style="height: 46px;" width="132">
42-
<p>13.01</p>
43-
</td>
44-
<td style="height: 46px;" width="114">4.50&nbsp;</td>
45-
<td style="height: 46px;" width="522">&nbsp;* Fixed regression bug where several event types where not logged.&nbsp;</td>
46-
<td style="height: 46px;" width="132">&nbsp;January 13, 2021</td>
47-
</tr>
48-
<tr style="height: 46px;">
49-
<td style="height: 46px;" width="132">
50-
<p>13.0</p>
51-
</td>
52-
<td style="height: 46px;" width="114">&nbsp;4.50</td>
53-
<td style="height: 46px;" width="522">&nbsp;* Added support for Process Tampering Detection.</td>
54-
<td style="height: 46px;" width="132">&nbsp;January 11, 2021</td>
55-
</tr>
56-
<tr style="height: 61px;">
57-
<td style="height: 61px;" width="132">12.03</td>
58-
<td style="height: 61px;" width="114">&nbsp;4.40</td>
59-
<td style="height: 61px;" width="522">&nbsp;* fixes reporting and a possible crash condition for PipeEvent and RegistryEvent rules.</td>
60-
<td style="height: 61px;" width="132">&nbsp;November 25, 2020</td>
61-
</tr>
62-
<tr style="height: 61px;">
63-
<td style="height: 61px;" width="132">12.02</td>
64-
<td style="height: 61px;" width="114">&nbsp;4.40</td>
65-
<td style="height: 61px;" width="522">&nbsp;* This update to Sysmon fixes several configuration parsing bugs.</td>
66-
<td style="height: 61px;" width="132">&nbsp;November 4, 2020</td>
67-
</tr>
68-
<tr style="height: 61px;">
69-
<td style="height: 61px;" width="132">12.01</td>
70-
<td style="height: 61px;" width="114">&nbsp;4.40</td>
71-
<td style="height: 61px;" width="522">&nbsp;* Security and bug fix release, resolves a PipeEvent processing issue and adds extra checks to kernel writes.</td>
72-
<td style="height: 61px;" width="132">&nbsp;October 16, 2020</td>
73-
</tr>
74-
<tr style="height: 192px;">
75-
<td style="height: 192px;" width="132">
76-
<p>12.0</p>
77-
</td>
78-
<td style="height: 192px;" width="114">
79-
<p>4.40</p>
80-
</td>
81-
<td style="height: 192px;" width="522">
82-
<p>* Added support to capture text stored in to the clipboard by a process.</p>
83-
</td>
84-
<td style="height: 192px;" width="132">
85-
<p>September 17, 2020</p>
86-
</td>
87-
</tr>
88-
<tr style="height: 196px;">
89-
<td style="height: 196px;" width="132">
90-
<p>11.11</p>
91-
</td>
92-
<td style="height: 196px;" width="114">
93-
<p>4.4</p>
94-
</td>
95-
<td style="height: 196px;" width="522">
96-
<p>* Fixes a bug that prevented USB media from being ejected.</p>
97-
<p>* Fixes an issue that could stop network event logging and a resulting memory leak.</p>
98-
<p>* Fixes logs file delete events for delete-on-close files.</p>
99-
</td>
100-
<td style="height: 196px;" width="132">
101-
<p>July 15, 2020</p>
102-
</td>
103-
</tr>
104-
<tr style="height: 196px;">
105-
<td style="height: 196px;" width="132">
106-
<p>11.1</p>
107-
</td>
108-
<td style="height: 196px;" width="114">
109-
<p>4.31</p>
110-
</td>
111-
<td style="height: 196px;" width="522">
112-
<p>* For Event ID 15 &ldquo;Content field was added to save text streams of less than 1k.</p>
113-
<p>* The &ndash;a commandline option has been removed. The custom archive directory must be set via configuration file.</p>
114-
<p>* Fix Issue where EventID 1 was not logged on Windowds 2016 and Windows 10.</p>
115-
<p>* Fix rule parsing issue.</p>
116-
</td>
117-
<td style="height: 196px;" width="132">
118-
<p>June 24, 2020</p>
119-
</td>
120-
</tr>
121-
<tr style="height: 110px;">
122-
<td style="height: 110px;" width="132">
123-
<p>11.0</p>
124-
</td>
125-
<td style="height: 110px;" width="114">
126-
<p>4.30</p>
127-
</td>
128-
<td style="height: 110px;" width="522">
129-
<p>* Control Reverse DNS Lookup.</p>
130-
<p>* Log file deletions and story copy of the file.</p>
131-
<p>* Bug Fixes.</p>
132-
</td>
133-
<td style="height: 110px;" width="132">
134-
<p>April 28, 2020</p>
135-
</td>
136-
</tr>
137-
<tr style="height: 78px;">
138-
<td style="height: 78px;" width="132">
139-
<p>10.42</p>
140-
</td>
141-
<td style="height: 78px;" width="114">
142-
<p>4.23</p>
143-
</td>
144-
<td style="height: 78px;" width="522">
145-
<div>* Memory&nbsp;leaks&nbsp;in&nbsp;DNS,&nbsp;Networking&nbsp;and&nbsp;Image&nbsp;load&nbsp;events</div>
146-
<div>* Bug&nbsp;fixes&nbsp;including&nbsp;filtering,&nbsp;rule&nbsp;group&nbsp;names,&nbsp;NULL&nbsp;process&nbsp;GUIDS&nbsp;and&nbsp;W3LOGSVC&nbsp;interop&nbsp;issue</div>
147-
<div>* Increased&nbsp;rule&nbsp;name&nbsp;field&nbsp;length&nbsp;from&nbsp;32&nbsp;to&nbsp;128&nbsp;characters</div>
148-
<div>* Added&nbsp;&ldquo;excludes&nbsp;any&rdquo;&nbsp;and&nbsp;&ldquo;excludes&nbsp;all&rdquo;&nbsp;filtering&nbsp;conditions.</div>
149-
<div>* Performance&nbsp;improvements&nbsp;for&nbsp;ImageLoad&nbsp;module</div>
150-
</td>
151-
<td style="height: 78px;" width="132">
152-
<p>December 11, 2019</p>
153-
</td>
154-
</tr>
155-
</tbody>
156-
</table>
24+
You can take a look at recent changes across versions in the community guide [Sysmon Changelog](https://link)
15725

15826
Another important piece of information is that there is no support from Microsoft on the Sysinternal tools—they are free and provided as is. This means that a testing plan for the environment it is deployed on should be formulated, tested, implemented, and improved upon as new versions of Sysmon are released.

0 commit comments

Comments
 (0)