Skip to content

Neo23x0/sysmon-version-history

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 

Outdated: I didn't find enough time to update this repo - sorry

Sysmon-Version-History

An Inofficial Sysmon Changelog

This changelog was composed with the help of the technet blog articles, the Internet wayback machine and Google.

v11.10

Release date: 24.06.2020

Config schema version: 4.32

Reference:

New Features:

  • File Delete

Fixed Bugs:

  • fixes bugs ???

Known Issues:

  • None

Missed Version

... some missed versions

v10.4

Release date: 06.09.2019

Config schema version: 4.22

Reference:

New Features:

  • None

Fixed Bugs:

  • fixes bugs ???

Known Issues:

  • None

v10.2

Release date: ?

Config schema version: 4.21

Reference:

  • None

New Features:

  • None

Fixed Bugs:

  • fixes bugs ???

Known Issues:

  • None

v10.1

Release date: 14.06.2019

Config schema version: 4.21

Reference:

  • None

New Features:

  • None

Fixed Bugs:

  • fixes bugs ???

Known Issues:

  • None

v10.0

Release date: 12.06.2019

Config schema version: 4.21

Reference:

New Features:

  • DNS Query logging (Event ID 22)
  • reports OriginalFileName in process create and load image events
  • adds ImageName to named pipe events
  • logs pico process creates and terminates

Fixed Bugs:

  • fixes several bugs

Known Issues:

  • None

v10.0

Release date: 11.06.2019

Config schema version: 4.21

Reference:

New Features:

  • DNS Query logging (Event ID 22)
  • reports OriginalFileName in process create and load image events
  • adds ImageName to named pipe events
  • logs pico process creates and terminates

Fixed Bugs:

  • fixes several bugs

Known Issues:

  • None

v9.01

Release date: 18.03.2019

Config schema version: 4.2

Reference:

New Features:

  • None

Fixed Bugs:

  • Regression fix for exclusions due to the introduction of rule groups

Known Issues:

  • None

v9.0

Release date: 18.02.2019

Config schema version: 4.2

Reference:

  • None

New Features:

  • new "rule groups" that support AND or OR matching across rules

Fixed Bugs:

  • None

Known Issues:

  • None

v8.04

Release date: 18.12.2018

Config schema version: 4.1

Reference:

New Features:

  • None

Fixed Bugs:

  • fixes an error with some configurations that caused severe blind spots

Known Issues:

  • None

v8.02

Release date: 11.12.2018

Config schema version: 4.1

Reference: https://blogs.technet.microsoft.com/sysinternals/2018/12/09/autoruns-v13-93-handle-v4-21-process-explorer-v16-22-sdelete-v2-02-sigcheck-v2-71-sysmon-v8-02-and-vmmap-v3-25/

New Features:

  • None

Fixed Bugs:

  • fixes several filtering bugs
  • resolves a handle leak and high CPU usage for certain filters when on Windows 7 and Windows Server 2008
  • fixes a bug that could cause the service process to crash

Known Issues:

v8.0

Release date: 06.07.2018

Config schema version: 4.1

Reference: https://twitter.com/markrussinovich/status/1015017015768113152

New Features:

  • Rule tagging

Fixed Bugs:

  • command-line truncation report

Known Issues:

  • None

v7.03

Release date: 14.05.2018

Config schema version: 4.0

Reference: https://blogs.technet.microsoft.com/sysinternals/2018/05/14/sysmon-v7-03/

New Features:

  • does not hash files larger than 2GB to avoid causing performance issues with SQL Server's large alternate data streams it places on database files

Fixed Bugs:

  • fixes a service executable crash that could result from long file names
  • Process tracking callbacks

Known Issues:

  • performance issues with SQL Server's large alternate data streams

v7.02

Release date: 30.04.2018

Config schema version: 4.0

Reference: https://blogs.technet.microsoft.com/sysinternals/2018/04/30/sysmon-v7-02/

New Features:

  • None

Fixed Bugs:

  • Memory leaks
  • Process tracking callbacks

Known Issues:

  • performance issues with SQL Server's large alternate data streams

v7.01

Release date: 30.04.2018

Config schema version: 4.0

Reference: https://blogs.technet.microsoft.com/sysinternals/2018/04/30/sysmon-v7-02/

New Features:

  • None

Fixed Bugs:

  • bug in v7.01 that could cause the sysmon config change event to be corrupt
  • bug that prevented registry keys from being reported with abbreviated root key names (e.g. HKLM)

Known Issues:

  • performance issues with SQL Server's large alternate data streams

v7.0

Release date: 02.01.2018

Config schema version: 4.0

Reference: https://twitter.com/markrussinovich/status/948294964378660864

New Features:

  • File version information
  • Dump old configuration schema versions

Fixed Bugs:

  • None

Known Issues:

v6.2

Release date: 22.11.2017

Config schema version: 3.4

Reference: https://www.darkoperator.com/blog/2017/11/24/operational-look-at-sysinternals-sysmon-620-update

New Features:

  • Enhancements in WMI Logging
  • Ability to change driver name
  • Ability to change service name and service executable name

Fixed Bugs:

  • ?

Known Issues:

  • None

v6.1

Release date: 11.09.2017

Config schema version: 3.4

Reference: https://blogs.technet.microsoft.com/sysinternals/2017/09/12/sysinternals-update-sysmon-v6-1-process-monitor-v3-4-autoruns-v13-8-accesschk-v6-11/

New Features:

  • monitoring of WMI filters and consumers (ID 19, ID 20, ID 21)

Fixed Bugs:

  • fixes a bug in image load filtering

Known Issues:

v6.03

Release date: 17.06.2017

Config schema version: 3.3

Reference: https://blogs.technet.microsoft.com/sysinternals/2017/06/17/sysinternals-update-sysmon-v6-03/

New Features:

  • None

Fixed Bugs:

  • bug that prevented imageload include filters from working in some configurations

Known Issues:

  • ?

v6.02

Release date: 22.05.2017

Config schema version: 3.3

Reference: https://web.archive.org/web/20170817004219/https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

New Features:

  • ?

Fixed Bugs:

  • ?

Known Issues:

  • ?

v6.01

Release date: ?

Config schema version: 3.3

Reference: https://www.reddit.com/r/AskNetsec/comments/7u3koo/sysmon_blue_screen_of_death/

New Features:

  • ?

Fixed Bugs:

  • ?

Known Issues:

v6.0

Release date: 17.02.2017

Config schema version: 3.3

Reference: https://blogs.technet.microsoft.com/sysinternals/2017/02/17/update-sysmon-v6-autoruns-v13-7-accesschk-v6-1-process-monitor-v3-32-process-explorer-v16-2-livekd-v5-61-and-bginfo-v4-21/

New Features:

  • Named pipe events (ID 17 "Pipe Created" and ID 18 "Pipe Connected")
  • Configuration changes logged as separate event
  • Dump Sysmons configuration scheme (-s)
  • interprets and displays registry paths in their common format

Fixed Bugs:

  • ?

Known Issues:

v5.0

Release date: 18.11.2016 (?)

Config schema version: 3.2

Reference: https://twitter.com/danielhbohannon/status/799604709137010688

New Features:

  • File creation events (ID 11)
  • Registry add/delete/rename/value set events (ID 12)

Fixed Bugs:

  • ?

Known Issues:

v4.12

Release date: 29.08.2016

Config schema version: 3.1

Reference: https://blogs.technet.microsoft.com/sysinternals/2016/08/29/update-sysmon-v4-12-autologon-v3-1-sigcheck-v2-54-process-monitor-v3-31/

New Features:

  • reports the status of CRL checking
  • fixes a bug where certain configuration files could cause the driver to blue screen

Fixed Bugs:

  • ?

Known Issues:

  • ?

v4.0

Release date: 28.04.2016

Config schema version: 3.0

Reference: https://web.archive.org/web/20160315070513/https://technet.microsoft.com/en-us/sysinternals/dn798348

New Features:

  • more powerful filtering capabilities, allowing for both include and exclude rules to be specified for specific events types
  • complex matching on different event fields

Fixed Bugs:

  • None

Known Issues:

  • ?

v3.21

Release date: 04.02.2015

Config schema version: 2.0

Reference: https://web.archive.org/web/20160315070513/https://technet.microsoft.com/en-us/sysinternals/dn798348

New Features:

  • None

Fixed Bugs:

  • fixes a paged pool leak of token objects when image logging is enabled

Known Issues:

  • ?

Support:

  • Last version with support of Windows 2008 or Windows Server 2003

v3.2

Release date: 04.01.2016

Config schema version: 2.0

Reference: https://blogs.technet.microsoft.com/sysinternals/2016/01/05/update-sigcheck-v2-4-sysmon-v3-2-process-explorer-v16-1-autoruns-v13-51-accesschk-v6-01/

New Features:

  • option of logging raw disk and volume accesses

Fixed Bugs:

  • ?

Known Issues:

  • ?

Support:

  • Last version to officially support Windows 2008 R2 or Windows Server 2003

v3.11

Release date: 26.10.2015

Config schema version: 2.0

Reference: https://blogs.technet.microsoft.com/sysinternals/2015/10/26/update-autoruns-v13-5-sigcheck-v2-3-rammap-v1-4-bginfo-v4-21-sysmon-v3-11-adinsight-v1-2/

New Features:

  • None

Fixed Bugs:

  • fixes a memory leak for DLL image load event monitoring
  • removes a misleading warning when processing configuration files

Known Issues:

  • ?

v3.1

Release date: 20.06.2015

Config schema version: 2.0

Reference: https://blogs.technet.microsoft.com/sysinternals/2015/07/22/update-sysmon-v3-1-logonsessions-v1-3-vmmap-v3-21/

New Features:

  • adds information about the thread initialization function for CreateRemoteThread events, including the DLL and function name and address
  • changes the format of timestamps to allow for simple string sorting

Fixed Bugs:

  • fixes several bugs

Known Issues:

  • ?

v3.0

Release date: 20.04.2015

Config schema version: 2.0

Reference: https://blogs.technet.microsoft.com/sysinternals/2015/04/20/update-sysmon-v3-0-autornus-v13-3-regjump-v1-1-process-monitor-v3-11/

New Features:

  • adds the process name to process terminate events
  • reports remote thread creation events (ID 8)
  • improves the simplicity and flexibility of filter settings

Fixed Bugs:

  • None

Known Issues:

  • ?

v2.0

Release date: 19.01.2015

Reference: https://blogs.technet.microsoft.com/sysinternals/2015/01/19/updates-sysmon-v2-0-accesschk-v5-21-ru-v1-1/

New Features:

Fixed Bugs:

  • None

Known Issues:

  • ?

v1.01

Release date: 18.08.2014

Reference: https://blogs.technet.microsoft.com/sysinternals/2014/08/19/updates-autoruns-v12-02-coreinfo-v3-31-sysmon-v1-01-whois-v1-12/

New Features:

  • includes unique UDP connections within 15-minute intervals

Fixed Bugs:

  • fixes the manifest registration so that Sysmon event logs can be interpreted without installing Sysmon

Known Issues:

  • ?

v1

Release date: 08.08.2014

Reference: https://blogs.technet.microsoft.com/sysinternals/2014/08/08/new-sysmon-v1-0-updates-autoruns-v12-01-coreinfo-v3-3-procexp-v16-03/

About

An Inofficial Sysmon Version History (Change Log)

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published