Bug with FileCreate and Box Drive

SwiftOnSecurity / sysmon-config

Sysmon configuration file template with default high-quality event tracing

4.74k stars 1.69k forks source link

Bug with FileCreate and Box Drive #62

Closed mhale1982 closed 5 years ago

mhale1982 commented 6 years ago

There's a catastrophic bug that presents itself when using the FileCreate filter combined with an active installation of BoxDrive. It manifests itself by causing the affected machine to freeze almost completely. The mouse continues to move, but the user is unable to click on anything.

Killing Box.exe immediately after logon prevents the issue from occurring.

I tested and discovered this by removing all other filters one by one until I came to the one that fixed the issue.

mhale1982 commented 6 years ago

I had Microsoft debug the issue, and it looks like installing Box triggers some sort of issue between the immunent.sys driver and Microsoft's mountmgr.sys one.

So three different apps involved here. Just a quick FYI in case anyone else is seeing issues.