search

SwiftOnSecurity / sysmon-config

Sysmon configuration file template with default high-quality event tracing
4.68k stars 1.69k forks source link

Sysmon v15.0 & 29 Events #183

Open Achi79 opened 1 year ago

Achi79 commented 1 year ago

This update to Sysmon, an advanced host security monitoring tool, sets the service to run as a protected process, hardening it against tampering, adds a new event, FileExecutableDetected, for when new executable images are saved to files, and fixes a system hang occurring in certain situations due to an interaction between network and file system events.

There are now 29 events. Will this config be updated?

harrisoncattell commented 1 year ago

I would also like to see this config update to include these new events. The default config that ships with sysmon isn't nearly as powerful as this one.

jttrey3 commented 4 months ago

The template has been very helpful, though guidance for the new event IDs would be appreciated.