olafhartong/sysmon-modular

Issues

• typo event 13 T1562.002 Disable Windows Event Logging

  #209 opened 2 months ago by wildebras
  0

• Suggested addition to ProcessAccess event, for MS Intune

  #208 opened 2 months ago by cyb3rxp
  0

• Config causing 35 second delay opening modern MS Office file formats (.docx & .xlsx etc)

  #199 opened 9 months ago by smogm
  1

• FileDelete Issue, cannot remove C:\Sysmon locked .dlls

  #200 opened 9 months ago by deathrig07
  4

• Error 255 appears, please help me figure it out.

  #198 opened 10 months ago by h3nkbleck
  2

• FileDelete vs. FileDeleteDetected inconsistent

  #117 opened 10 months ago by maederm
  2

• Incorrect rule format?

  #197 opened 10 months ago by 3ch035
  0

• User condition in exclusions for RegistryEvents

  #196 opened a year ago by schwf5
  0

• Exclusion Trend Micro WFBS

  #194 opened a year ago by s3-schneider
  0

• Duplicates

  #193 opened a year ago by PiRomant
  0

• KAV exclusion

  #190 opened a year ago by PiRomant
  0

• XML Issue with sysmonconfig-excludes-only.xml

  #187 opened a year ago by jvossler
  0

• Suggested additions to Microsoft Defender ProcessCreation event

  #185 opened a year ago by cyb3rxp
  0

• Suggested additions to TrendMicro ProcessCreation event exclusion

  #184 opened a year ago by cyb3rxp
  0

• Super verbose config missing from Azure Pipelines

  #178 opened a year ago by Korving-F
  0

• In line 1616 could be a typo

  #172 opened 2 years ago by Andeandes
  1

• TYPO?

  #162 opened 2 years ago by LasseKrache
  1

• Default config - file deletes are being archived

  #166 opened 2 years ago by leepfrog-ger
  4

• Event ID 8 - CreateRemoteThread - Appends to bottom of config

  #173 opened 2 years ago by Cyber74-Brian-McCaleb
  0

• Sysmon 14.14 - Anti-Tamper Controls?

  #167 opened 2 years ago by bobby-mack
  3

• Repo Folder index

  #168 opened 2 years ago by afg-jmck
  0

• Managing multiple customer config example

  #163 opened 2 years ago by oddieHA
  0

• Too many Splunk Forwarder Events in base Sysmon Config

  #153 opened 2 years ago by tbalz2319
  5

• Include Top Level Groups not working?

  #156 opened 2 years ago by defensivedepth
  2

• Does sysmon-modular has the compatibility to be used for the SysmonForLinux?

  #155 opened 2 years ago by jayzheng98
  1

• Merged file include vs exclude ordering

  #152 opened 2 years ago by ag-michael
  0

• sysmonconfig-research.xml configuration block, delete exe file

  #151 opened 2 years ago by webdevbeginner
  0

• Intercepting deleted files

  #149 opened 2 years ago by harryray33
  1

• Own Microsoft Sentinel Workbook is planned? Or recommended Microsoft Sentinel Workbook?

  #150 opened 2 years ago by michalzobec
  0

• ExcludeList not working ?

  #136 opened 3 years ago by mtl0n
  1

• Issue creating a CONFIG XML

  #140 opened 2 years ago by N3anderth0l
  1

• Something wrong in latest commit

  #146 opened 2 years ago by herromega
  4

• HKCU - Additional Files

  #132 opened 2 years ago by kevinelwell
  3

• File create events with include_electron_app_injection.xml module

  #141 opened 2 years ago by ErichSutter
  1

• Excluding __PSScriptPolicyTest_ files

  #137 opened 2 years ago by m3hdx
  1

• contains all with only one value

  #144 opened 2 years ago by frack113
  1

• Rule Group Relation in Network Connect / include_relaying.xml

  #142 opened 2 years ago by ErichSutter
  2

• Double quotes possibly mess up the filtering

  #133 opened 3 years ago by bchris21
  0

• HKCU Registry

  #130 opened 3 years ago by kevinelwell
  2

• Event 10 version 1320

  #98 opened 3 years ago by bonusland
  2

• overlaping rule causing alot of 12/13 events

  #99 opened 3 years ago by PurpleV0id
  1

• Include file format: merge full directories

  #120 opened 3 years ago by hkelley
  1

• Schema Version Upgrade to 4.81

  #131 opened 3 years ago by clairmont32
  1

• Potential typo (Line 1508 in sysmonconfig.xml)

  #122 opened 3 years ago by thamyekh
  0

• error with merging script line 137/char13

  #106 opened 3 years ago by janlinhart-BC
  1

• "Trusted Script Proxy Exectuion" or "Trusted Script Proxy Execution"

  #112 opened 3 years ago by Yuvraj-Takey
  2

• Bug GroupRelation

  #92 opened 3 years ago by V1D1AN
  3

• Events id12 with version 13.10

  #96 opened 3 years ago by janlinhart-BC
  4

• Incompatible configuration with Sysmon 13.21

  #100 opened 4 years ago by sebastiendamaye
  3

• Source file name in XML

  #94 opened 4 years ago by istvanSA
  1