Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sysmon Simulator doesn't seem to be working anymore #13

Open
KnightChaser opened this issue Feb 27, 2024 · 0 comments
Open

Sysmon Simulator doesn't seem to be working anymore #13

KnightChaser opened this issue Feb 27, 2024 · 0 comments

Comments

@KnightChaser
Copy link

A few days ago, I found that this SysmonSimulator doesn't work anymore because the System Monitor doesn't log the simulator's artificial behavior that was supposed to generate a specific ID of the log.

For example, I wanted to create an EID 8 log, so I hit the command

"C:\Users\3NR1QUE\Desktop\DivePortal\Sysmon\SysmonSimulator.exe" -eid 8

And I received the log that occurred by that command

Process Create:
RuleName: -
UtcTime: 2024-02-27 08:43:23.928
ProcessGuid: {0b7407af-a0ab-65dd-0b23-00000000c301}
ProcessId: 35296
Image: C:\Users\3NR1QUE\Desktop\DivePortal\Sysmon\SysmonSimulator.exe
FileVersion: -
Description: -
Product: -
Company: -
OriginalFileName: -
CommandLine: "C:\Users\3NR1QUE\Desktop\DivePortal\Sysmon\SysmonSimulator.exe" -eid 8
CurrentDirectory: C:\Users\3NR1QUE\Desktop\DivePortal\Sysmon\
User: KLOJURE\LUEX
LogonGuid: {0b7407af-71bb-65dd-9385-060000000000}
LogonId: 0x68593
TerminalSessionId: 1
IntegrityLevel: Medium
Hashes: SHA256=BF7A223831887EF706140007CCF00D6C6069DEDE7335E84040EC114C09DEC343
ParentProcessGuid: {0b7407af-8a87-65dd-f21f-00000000c301}
ParentProcessId: 46488
ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ParentCommandLine: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
ParentUser: KLOJURE\LUEX

It means Sysmon logged SysmonSimulator.exe's EID 8 event generation process as a process creation of SysmonSimulator.exe -eid 8, instead of the real event whose EID is 8(and that was what SysmonSimulator has expected.).

The other tries with different EID values resulted in the same log(Process creation/termination of SysmonSimulator.exe.). It seems that the internal logic of Sysmon has changed.

I found that this repository hasn't been maintained for around 2 years now. I wonder if this unavailability issue will be taken care of in the future(Or, just make my version of SysmonSimulator instead?).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant