Author: piesecureSubject: Sysmon Filter Driver Deployment Bug
Posted: 03 June 2016 at 12:07am
Hello all,
I wanted to rehash an issue/bug presented in this post:
http://forum.sysinternals.com/sysmon-v2-issue_topic31133.html
I encountered the exact same issue with Sysmon v3.21and Sysmon v4. I found a way to easily reproduce the symptoms.
After the reboot following the installation of Sysmon. Sysmon rewrites Error 255 as follows.
Error report:
UtcTime: 2016-06-02 22:47:24.387
ID: DriverCommunication
Description: Failed to access the driver (Last error: Thehandle is invalid.).
On a x86 installation of Windows 7, Sysmon will fail tocreate c:\windows\sysmondrv.sys if the installing Sysmon.exe installer is in anyfolder under C:\Windows\. This includes a deployment folder such asC:\windows\ccmsetup\
Failure to create the driver leads to the followingerror trying to reconfigure Sysmon
C:\Windows\system32>sysmon -c -n
Sysinternals Sysmon v3.21 - System activity monitor
Copyright (C) 2014-2016 Mark Russinovich and Thomas Garnier
Sysinternals - www.sysinternals.com
Error: Sysmon is not installed.
Configuration updated.
Yet, it is really installed.
C:\Windows\system32>sysmon -c
Sysinternals Sysmon v3.21 - System activity monitor
Copyright (C) 2014-2016 Mark Russinovich and Thomas Garnier
Sysinternals - www.sysinternals.com
Current configuration:
- Service name: Sysmon
- Driver name: SysmonDrv
-HashingAlgorithms: SHA1
- Networkconnection: enabled
- Image loading: disabled
As described in the previous post, from that point on, only Sysmon/3 event records for System-levelprocesses (svchost.exe, and the process with PID = 4).
On x64 systems thisbehavior can be replicated if the installing sysmon.exe is already present in C:\Windows\where as x86 systesm will have this issue occur if the installer is anywhere under C:\Windows\. x86. Infact, x86 systems will register the Sysmon service and driver inplace, so in the deployment folder scenario, the sysmon service will have an image path of c:\windows\ccmsetup\XX\sysmon.exe.
As a related issue, if youattempt to uninstall then reinstall sysmon.exe using the deployed copy in c:\windows\you will introduce the bug after a reboot in either Win 7 architecture.
Hope this description helps.
Edited by piesecure - 14 hours 9 minutes ago at 12:12am