search

Sysinternals / SysmonForLinux

MIT License
1.71k stars 181 forks source link

Fix: Missing ProcessCreate m_AuthenticationId CO-RE compilation flag #120

Closed eeriedusk closed 1 year ago

eeriedusk commented 1 year ago

The lack of m_AuthenticationId CO-RE compilation flag in ebpfKern/sysmonProcCreate.c#L156 leads to missing ProcessCreate events user field.