Skip to content

Commit cbb82ac

Browse files
darkoperatordarkoperator
authored
Update the-sysmon-driver.md
1 parent 646b521 commit cbb82ac

1 file changed

Lines changed: 102 additions & 2 deletions

File tree

‎the-sysmon-driver.md‎

Lines changed: 102 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,107 @@ Sysmon sets multiple callbacks on kernel objects in addition to using telemetry
2121

2222
When the tool is downloaded from the Microsoft Sysinternals website <https://docs.microsoft.com/en-us/sysinternals/> it is important to save and identify previous versions since Microsoft does not provide older versions and the release notes do not detail what has been fixed. Microsoft has a fast release cycle, forcing users to test very carefully and to keep track of versions.
2323

24-
![A screenshot of a social media post Description automatically
25-
generated](./media/image5.png)
24+
25+
<table width="1280">
26+
<tbody>
27+
<tr>
28+
<td width="132">
29+
<p><strong>Version</strong></p>
30+
</td>
31+
<td width="114">
32+
<p><strong>Schema </strong></p>
33+
</td>
34+
<td width="522">
35+
<p><strong>Features</strong></p>
36+
</td>
37+
<td width="380">
38+
<p><strong>Known Issues</strong></p>
39+
</td>
40+
<td width="132">
41+
<p><strong>Release</strong></p>
42+
</td>
43+
</tr>
44+
<tr>
45+
<td width="132">
46+
<p>12.0</p>
47+
</td>
48+
<td width="114">
49+
<p>4.40</p>
50+
</td>
51+
<td width="522">
52+
<p>* Added support to capture text stored in to the clipboard by a process.</p>
53+
</td>
54+
<td width="380">
55+
<p>* Kernel memory write that can lead to code execution.</p>
56+
<p>* Metadata for driver still references.</p>
57+
<p>* Sysmon 11.1 and may affect install scripts.</p>
58+
<p>* Problems matching filters for FileDelete.</p>
59+
<p>* Blue Screen on some Windows 2016 DCs</p>
60+
</td>
61+
<td width="132">
62+
<p>September 17, 2020</p>
63+
</td>
64+
</tr>
65+
<tr>
66+
<td width="132">
67+
<p>11.1</p>
68+
</td>
69+
<td width="114">
70+
<p>4.31</p>
71+
</td>
72+
<td width="522">
73+
<p>* For Event ID 15 &ldquo;Content field was added to save text streams of less than 1k.</p>
74+
<p>* The &ndash;a commandline option has been removed. The custom archive directory must be set via configuration file.</p>
75+
<p>* Fix Issue where EventID 1 was not logged on Windowds 2016 and Windows 10.</p>
76+
<p>* Fix rule parsing issue.</p>
77+
</td>
78+
<td width="380">
79+
<p>* Kernel memory write that can lead to code execution.</p>
80+
<p>* Blue Screen on on Win10 1809&nbsp;</p>
81+
</td>
82+
<td width="132">
83+
<p>June 24, 2020</p>
84+
</td>
85+
</tr>
86+
<tr>
87+
<td width="132">
88+
<p>11.0</p>
89+
</td>
90+
<td width="114">
91+
<p>4.30</p>
92+
</td>
93+
<td width="522">
94+
<p>* Control Reverse DNS Lookup.</p>
95+
<p>* Log file deletions and story copy of the file.</p>
96+
<p>* Bug Fixes.</p>
97+
</td>
98+
<td width="380">
99+
<p>* Does not log Process Creation on Windows 2016.</p>
100+
<p>* Kernel memory write that can lead to code execution.</p>
101+
</td>
102+
<td width="132">
103+
<p>April 28, 2020</p>
104+
</td>
105+
</tr>
106+
<tr>
107+
<td width="132">
108+
<p>10.42</p>
109+
</td>
110+
<td width="114">
111+
<p>4.23</p>
112+
</td>
113+
<td width="522">
114+
<p>* Fixed multiple memory leaks</p>
115+
<p>* Introduces the "Excludes Any" and "Excludes All" filtering conditions</p>
116+
</td>
117+
<td width="380">
118+
<p>* Issues with parsing some rules in configuration files.</p>
119+
</td>
120+
<td width="132">
121+
<p>December 11, 2019</p>
122+
</td>
123+
</tr>
124+
</tbody>
125+
</table>
26126

27127
Another important piece of information is that there is no support from Microsoft on the Sysinternal tools—they are free and provided as is. This means that a testing plan for the environment it is deployed on should be formulated, tested, implemented, and improved upon as new versions of Sysmon are released.

0 commit comments

Comments
 (0)