Open lindonzoo opened 4 years ago
Known Bug in Sysmon, wait for Update from Mark.
I first saw this reported on 05 May here:
https://twitter.com/S0xbad1dea/status/1257699725786177536?s=19
Hi, can anyone help by telling me how this issue was solved? I am facing the same issue currently, as I have downloaded sysmon on multiple devices, and event ID 1 is working on some of them and not working on the rest. Please advise.
Hi all,
Using Sysmon v11 on a fresh install of Windows Server 2016.
Installed Sysmon via elevated PS:
.\Sysmon64.exe -i ..\..\Desktop\sysmon.xml
Output from command:
I can see events for process termination, DNS etc but not process creation.
I am not sure if the following points to any clues on the issue:
I have also tried Sysmon.exe (as opposed to Sysmon64.exe) with no luck.
Anyone else seen this?