trustedsec-SysmonCommunityGuide/the-sysmon-driver.md

The Sysmon Driver

All of the monitoring is performed thanks to a driver that Sysmon installs called SysmonDrv. The driver will hook into Windows APIs and leverage Event Tracing for Windows (ETW) to capture the information on the actions it wants to monitor.

This Sysmon Driver has a unique altitude number of 385201 that determines the order of loading of the driver in comparison to other drivers on the system. Some blog posts recommend changing this number in the registry for obfuscation, but this may cause a conflict with another driver and prevent Sysmon from working or cause other errors on the system.

The driver is loaded by a service at system startup and a secondary service then queries the cached information.

For all file system operations, the driver registers as a Minifilter driver that is attached to volumes allowing it to see all actions taken by APIs before they are processed by the file system.

Sysmon sets multiple callbacks on kernel objects in addition to using telemetry APIs and ETW.

When the tool is downloaded from the Microsoft Sysinternals website https://docs.microsoft.com/en-us/sysinternals/ it is important to save and identify previous versions since Microsoft does not provide older versions and the release notes do not detail what has been fixed. Microsoft has a fast release cycle, forcing users to test very carefully and to keep track of versions.

Version	Schema	Features	Release
13.01	4.50	* Fixed regression bug where several event types where not logged.	January 13, 2021
13.0	4.50	* Added support for Process Tampering Detection.	January 11, 2021
12.03	4.40	* fixes reporting and a possible crash condition for PipeEvent and RegistryEvent rules.	November 25, 2020
12.02	4.40	* This update to Sysmon fixes several configuration parsing bugs.	November 4, 2020
12.01	4.40	* Security and bug fix release, resolves a PipeEvent processing issue and adds extra checks to kernel writes.	October 16, 2020
12.0	4.40	* Added support to capture text stored in to the clipboard by a process.	September 17, 2020
11.11	4.4	* Fixes a bug that prevented USB media from being ejected. * Fixes an issue that could stop network event logging and a resulting memory leak. * Fixes logs file delete events for delete-on-close files.	July 15, 2020
11.1	4.31	* For Event ID 15 “Content field was added to save text streams of less than 1k. * The –a commandline option has been removed. The custom archive directory must be set via configuration file. * Fix Issue where EventID 1 was not logged on Windowds 2016 and Windows 10. * Fix rule parsing issue.	June 24, 2020
11.0	4.30	* Control Reverse DNS Lookup. * Log file deletions and story copy of the file. * Bug Fixes.	April 28, 2020
10.42	4.23	* Memory leaks in DNS, Networking and Image load events * Bug fixes including filtering, rule group names, NULL process GUIDS and W3LOGSVC interop issue * Increased rule name field length from 32 to 128 characters * Added “excludes any” and “excludes all” filtering conditions. * Performance improvements for ImageLoad module	December 11, 2019

Another important piece of information is that there is no support from Microsoft on the Sysinternal tools—they are free and provided as is. This means that a testing plan for the environment it is deployed on should be formulated, tested, implemented, and improved upon as new versions of Sysmon are released.