Sysinternals updates

ronjor · Apr 23, 2019

Sysinternals Suite 23 Apr 2019

By Mark Russinovich
Updated: April 23, 2019
Click to expand...

guest · Jun 9, 2019

Sysmon Getting DNS Query Logging with Querying Process Name
June 9, 2019
https://www.bleepingcomputer.com/ne...dns-query-logging-with-querying-process-name/

To the delight of Windows system administrators everywhere, Microsoft has announced that a new version of Sysmon is coming out this week that will include the ability to log DNS queries performed on a monitored computer. Even better, Sysmon will also log the process that performed the query.

In a recent tweet by Mark Russinovich, the CTO of Microsoft Azure and creator of the Sysinternals tools, it was announced that a new version of Sysmon was being released this Tuesday that includes DNS Query Logging.
While DNS query logging is already available on Windows, as mentioned by Sam King is is missing a piece of crucial information - the name of the executable performing the query.
Administrators and security professionals are excited
DNS query logging will be particularly useful for Windows administrators and security professionals who can now use Sysmon to feed DNS query data into the event log. This data can then be consumed by other tools in order to find executables creating suspicious traffic or connecting to malicious domains.
Click to expand...

guest · Jun 11, 2019

Sysmon 10 is Released With a DNS Query Logging Feature
June 11, 2019
https://www.bleepingcomputer.com/ne...is-released-with-a-dns-query-logging-feature/

Microsoft has released Sysmon 10 today and with it comes the eagerly anticipated DNS Query Logging feature. This feature will allow Sysmon users to log DNS queries performed on a monitored computer, which will also include the executable that performed the query.
To download the Sysmon 10, you can go to its Sysinternal's page or download it from https://live.sysinternals.com/sysmon.exe. Once downloaded, you need to run it from an elevated comand prompt, as it needs administrative privileges to run.

In Sysmon 10.0, Microsoft added the ability to monitor DNS queries and the executable that performed the query. This event needs to be enabled through a configuration file with the DNSQuery directive.
An example of a very basic configuration file that enables DNS query logging is shown below. This configuration file can be installed using the sysmon.exe -i config.xml, if sysmon is not installed yet, or sysmon.exe -c config.xml, if running already. [...]
Click to expand...

Sysmon v10.0
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

v10.0 (June 11, 2019)
Monitors and reports key system activity via the Windows event log.
Click to expand...

guest · Jun 12, 2019

Sysmon v10.0, Autoruns v13.95, VMMap v3.26

Mark Russinovich June 12, 2019
Sysmon 10.0
This release of Sysmon adds DNS query logging, reports OriginalFileName in process create and load image events, adds ImageName to named pipe events, logs pico process creates and terminates, and fixes several bugs.
Autoruns 13.95
This Autoruns update adds support for user Shell folders redirections.
VMMap 3.26
This update to VMMap, a tool for looking at the virtual and physical memory usage of a process, fixes a bug in 64-bit CLR heap reporting.
Click to expand...

guest · Jun 13, 2019

Sysinternals Suite
Updated: June 11, 2019
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

anon · Jun 14, 2019

Process Explorer v16.25
https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

anon · Jun 16, 2019

Sysmon v10.1
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

guest · Jun 16, 2019

Handle v4.22, NotMyFault v4.20, Process Explorer v16.25, Sysmon v10.1

Mark Russinovich June 15, 2019
Handle v4.22
This release of Handle fixes a race condition in the driver that could lead to a crash.
Notmyfault v4.20
Notmyfaultc now includes a flag that makes it wait until an event named Notmyfault is signaled before proceeding to crash or leak.
Process Explorer v16.25
This update to Process Explorer fixes a potential buffer overflow when processing abnormally large environment variable blocks.
Sysmon v10.01
This update to Sysmon fixes a memory leak in image load events that v10.0 introduced.
Click to expand...

guest · Jun 29, 2019

Sysinternals Suite
Updated: June 28, 2019
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

June 28, 2019:

Autoruns for Windows v13.96
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
Process Explorer v16.26
https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
Rammap v1.52
https://docs.microsoft.com/en-us/sysinternals/downloads/rammap
Sysmon v10.2
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Click to expand...

Note:
Preparing for the deprecation of SHA-1 signatures

In support of our promise to provide best-in-class security to our customers, Microsoft are planning to discontinue support for SHA1 code signing certificates
More Information
Currently Sysinternals binaries are dual signed using for SHA-1 and SHA-2. As of July 31, 2019, these will be signed using only SHA-2 signatures.

Prior to this date customers running our tools on legacy OS versions will need to install SHA-2 code signing support in order to run the SHA-2 signed versions. Although this support will typically be delivered via Windows Update, standalone security updates are also available for download. Refer to 2019 SHA-2 Code Signing Support requirement for Windows and WSUS for details on these updates
Click to expand...

guest · Sep 5, 2019

Sysinternals Suite
Updated: September 5, 2019
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

September 5, 2019:

Sigcheck v2.73
https://docs.microsoft.com/en-us/sysinternals/downloads/sigcheck
Sysmon v10.4
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Process Explorer v16.30
https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
Click to expand...

guest · Sep 16, 2019

Sysinternals Suite
Updated: September 16, 2019
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

What's New (September 16, 2019)

Sysmon v10.41
Resolves a config parsing issue with 10.4.

Click to expand...

ronjor · Sep 23, 2019

Sysinternals Suite 20 sep 2019

By Mark Russinovich
Updated: September 20, 2019
Click to expand...

guest · Dec 11, 2019

Sysinternals Suite
Updated: December 11, 2019
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

What's New (December 11, 2019)

Sysmon v10.42
This update to Sysmon addresses a number of memory leaks, introduces the "Excludes Any" and "Excludes All" filtering conditions and resolves a number of bugs.

Zoomit v4.52
This update to Zoomit resolves a number of dual-monitor related issues.

Whois v1.21
This refresh of Whois contains various bug fixes.

Click to expand...

guest · Dec 19, 2019

Sysinternals Suite
Updated: December 18, 2019
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

December 18, 2019:

Process Explorer v16.31
https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
Click to expand...

Minimalist · Dec 19, 2019

Process Monitor v3.53
https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

Special · Dec 19, 2019

Gotta love the lack of patch notes with these guys.

guest · Apr 28, 2020

Sysinternals Suite
Updated: April 28, 2020
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

What's New (April 28, 2020)

Sysmon v11.0
This major update to Sysmon includes file delete monitoring and archive to help responders capture attacker tools, adds an option to disable reverse DNS lookup, replaces empty fields with ‘-‘ to work around a WEF bug, fixes an issue that caused some ProcessAccess events to drop, and doesn’t hash main data streams that are marked as being stored in the cloud.

Sysinternals April 27 Update Video
Mark Russinovich covers what’s new in this update, with a demo of Sysmon’s new file delete monitoring and capture capability.

Click to expand...

Sysinternals April 27 Update Video: https://www.youtube.com/watch?v=_MUP4tgdM7s

April 28, 2020:

Coreinfo v3.5
https://docs.microsoft.com/en-us/sysinternals/downloads/coreinfo
LiveKd v5.63
https://docs.microsoft.com/en-us/sysinternals/downloads/livekd
Process Explorer v16.32
https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
Click to expand...

Sampei Nihira · Apr 29, 2020

With Process Explorer i have verified that the Integrity Level is set to Untrusted in both Chrome and Edge/Chromium.
Even with version 16.30 the result does not change.

guest · Apr 29, 2020

mood said: ↑

Sysinternals Suite
Updated: April 28, 2020
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
Click to expand...

Microsoft releases Sysmon 11 with auto-backup of deleted files
April 29, 2020
https://www.bleepingcomputer.com/ne...-sysmon-11-with-auto-backup-of-deleted-files/

Microsoft has released Sysmon 11, and it now comes with an important feature that allows you to monitor for and automatically archive deleted files on a monitored system.
Why monitoring file deletions is important
With the release of version 11, Sysmon can now monitor for file deletions and automatically archive files when they are deleted.

This tool extremely useful for incident responders when performing digital forensics or mitigation of security breaches.
After gaining full access to a network and harvesting it of any valuable data, attackers will then commonly deploy malware, such as ransomware, on to the victim's network to encrypt all of the devices.

By having these files, researchers will learn more about the tactics, techniques, and procedures (TTP) of an attacker that allow better defenses to be created.
Click to expand...

Using Sysmon's new file deletion monitoring
To use the new Sysmon 11 file deletion and archiving feature, we need to add the new ArchiveDirectory and FileDelete configuration options to our Sysmon configuration file. [...]
Click to expand...

1PW · Jun 24, 2020

Sysinternals Suite
Updated: June 24, 2020
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

Autoruns for Windows v13.98
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

Sysmon v11.10
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

Sigcheck v2.80
https://docs.microsoft.com/en-us/sysinternals/downloads/sigcheck
Click to expand...

Mark Russinovich's June YouTube Video: https://youtu.be/HCZlJDKUqn0

anon · Jul 15, 2020

Sysinternals Suite
Updated: July 15, 2020
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

Willy2 · Aug 11, 2020

- RAMMAP (v1.52) still contains a (non-fatal) bug that needs to be fixed. (No, no details)

guest · Sep 18, 2020

Sysinternals Suite
Updated: September 17, 2020
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

What's New (September 17, 2020)
• Sysmon v12.0
In addition to several bug fixes, this major update to Sysmon adds support for capturing clipboard operations to help incident responders retrieve attacker RDP file and command drops, including originating remote machine IP addresses.
• Process Monitor v3.60
This update to Process Monitor, a utility that logs process file, network and registry activity, adds support for multiple filter item selection, as well as decoding for new file system control operations and error status codes.
• Procdump v10.0
This release of Procdump, a flexible tool for manual and trigger-based process dump generation, adds support for dump cancellation and CoreCLR processes.
• ARM64 ports
In addition, several tools have been newly ported to and are now available for ARM64.
Click to expand...

guest · Sep 19, 2020

Microsoft Sysmon now logs data copied to the Windows Clipboard
September 19, 2020
https://www.bleepingcomputer.com/ne...ow-logs-data-copied-to-the-windows-clipboard/

Microsoft has released Sysmon 12, and it comes with a useful feature that logs and captures any data added to the Windows Clipboard.

This feature can help system administrators and incident responders track the activities of malicious actors who compromised a system.
Sysmon 12 adds clipboard capturing
With the release of Sysmon 12, users can now configure the utility to generate an event every time data is copied to the Clipboard. The Clipboard data is also saved to files that are only accessible to an administrator for later examination.
As most attackers will utilize the Clipboard when copying and pasting long commands, monitoring the data stored in the Clipboard can provide useful insight into how an attack was conducted.

For a very basic setup that will enable Clipboard logging and capturing, you can use the configuration file below: [...]
Click to expand...

guest · Oct 15, 2020

Sysinternals Suite
Updated: October 15, 2020
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

What's New (October 15, 2020)

VMMap v3.30 This update to VMMap, a utility that reports the virtual memory layout of a process, identifies .NET Core 3.0 managed heaps.

RAMMap v1.60 This release to RAMMap, a utility that analyzes and displays physical memory usage, adds customizable map colors and a new command line option, -e, to empty the different types of system working sets.

Click to expand...

Log in or Sign up

Sysinternals updates

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

anon Registered Member

anon Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Minimalist Registered Member

Special Registered Member

guest Guest

Sampei Nihira Registered Member

guest Guest

1PW Registered Member

anon Registered Member

Willy2 Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

Sysinternals updates

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

anon Registered Member

anon Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Minimalist Registered Member

Special Registered Member

guest Guest

Sampei Nihira Registered Member

guest Guest

1PW Registered Member

anon Registered Member

Willy2 Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches