oz9un/sysmonforlinux-manual

This repo contains specific configuration files for better understanding of sysmon configuration on Linux systems.

visit my website

sysmonforlinux-manual's Issues

I find sysmon can not log FileCreate events, bug other type can be logged, do you have met this problem?

sysmon -c /opt/sysmon/config.xml

Sysmon v1.0.2 - Monitors system events
Sysinternals - www.sysinternals.com
By Mark Russinovich, Thomas Garnier and Kevin Sheldrake
Copyright (C) 2014-2021 Microsoft Corporation
Using libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved.

Loading configuration file with schema version 4.70
Sysmon schema version: 4.81
Configuration file validated.

Event SYSMONEVENT_PROCESS_TERMINATE
RuleName: -
UtcTime: 2022-09-26 08:05:14.789
ProcessGuid: {00000000-0000-0000-0000-000000000000}
ProcessId: 4285
Image:
User: root
Event SYSMONEVENT_PROCESS_TERMINATE
RuleName: -
UtcTime: 2022-09-26 08:05:14.790
ProcessGuid: {00000000-0000-0000-0000-000000000000}
ProcessId: 4286
Image:
User: root
Event SYSMONEVENT_CREATE_PROCESS
RuleName: -
UtcTime: 2022-09-26 08:05:15.341
ProcessGuid: {20220824-5d3b-6331-31a8-5e90fb550000}
ProcessId: 4287
Image: /usr/bin/sysmon
FileVersion: -
Description: -
Product: -
Company: -
OriginalFileName: -
CommandLine: sysmon -c /opt/sysmon/config.xml
CurrentDirectory: /root
User: root
LogonGuid: {20220824-4111-6331-0000-000004000000}
LogonId: 0
TerminalSessionId: 22
IntegrityLevel: no level
Hashes: -
ParentProcessGuid: {00000000-0000-0000-0000-000000000000}
ParentProcessId: 3184
ParentImage: -
ParentCommandLine: -
ParentUser: -
Event SYSMONEVENT_SERVICE_CONFIGURATION_CHANGE
UtcTime: 2022-09-26 08:05:15.348
Configuration: /opt/sysmon/config.xml
ConfigurationFileHash: -