From 41dfcf379c7c093d11ce77594542cae31b0c556a Mon Sep 17 00:00:00 2001 From: Carlos Perez Date: Wed, 13 Jan 2021 15:17:37 -0400 Subject: [PATCH] update table with changes --- the-sysmon-driver.md | 129 +++++++++++++++++++++++++++---------------- 1 file changed, 80 insertions(+), 49 deletions(-) diff --git a/the-sysmon-driver.md b/the-sysmon-driver.md index b3ff3e9..99739f6 100644 --- a/the-sysmon-driver.md +++ b/the-sysmon-driver.md @@ -21,103 +21,134 @@ Sysmon sets multiple callbacks on kernel objects in addition to using telemetry When the tool is downloaded from the Microsoft Sysinternals website it is important to save and identify previous versions since Microsoft does not provide older versions and the release notes do not detail what has been fixed. Microsoft has a fast release cycle, forcing users to test very carefully and to keep track of versions. - - - + - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - + + + + + + + - - - - - - + - - - - - - + - - - -
+

Version

 +

Schema

+

Features

 -

Known Issues

-		 +

Release
+
+

13.01

+		4.50  * Fixed regression bug where several event types where not logged.  January 13, 2021
+

13.0

+		 4.50 * Added support for Process Tampering Detection. January 11, 2021
12.03 4.40 * fixes reporting and a possible crash condition for PipeEvent and RegistryEvent rules. November 25, 2020
12.02 4.40 * This update to Sysmon fixes several configuration parsing bugs. November 4, 2020
12.01 4.40 * Security and bug fix release, resolves a PipeEvent processing issue and adds extra checks to kernel writes. October 16, 2020

12.0

 +

4.40

 +

* Added support to capture text stored in to the clipboard by a process.

 -

* Kernel memory write that can lead to code execution.

-

* Metadata for driver still references.

-

* Sysmon 11.1 and may affect install scripts.

-

* Problems matching filters for FileDelete.

-

* Blue Screen on some Windows 2016 DCs

-		 +

September 17, 2020
+
+

11.11

+		 +

4.4

+		 +

* Fixes a bug that prevented USB media from being ejected.

+

* Fixes an issue that could stop network event logging and a resulting memory leak.

+

* Fixes logs file delete events for delete-on-close files.

+		 +

July 15, 2020

+

11.1

 +

4.31

 +

* For Event ID 15 “Content field was added to save text streams of less than 1k.

* The –a commandline option has been removed. The custom archive directory must be set via configuration file.

* Fix Issue where EventID 1 was not logged on Windowds 2016 and Windows 10.

* Fix rule parsing issue.

 -

* Kernel memory write that can lead to code execution.

-

* Blue Screen on on Win10 1809 

-		 +

June 24, 2020
+

11.0

 +

4.30

 +

* Control Reverse DNS Lookup.

* Log file deletions and story copy of the file.

* Bug Fixes.

 -

* Does not log Process Creation on Windows 2016.

-

* Kernel memory write that can lead to code execution.

-		 +

April 28, 2020
+

10.42

 +

4.23

 -

* Fixed multiple memory leaks

-

* Introduces the "Excludes Any" and "Excludes All" filtering conditions

-		 -

* Issues with parsing some rules in configuration files.

+		 +
* Memory leaks in DNS, Networking and Image load events
+
* Bug fixes including filtering, rule group names, NULL process GUIDS and W3LOGSVC interop issue
+
* Increased rule name field length from 32 to 128 characters
+
* Added “excludes any” and “excludes all” filtering conditions.
+
* Performance improvements for ImageLoad module
 +

December 11, 2019