All issues

Search results

Three silent config issues: begin with with ; lists (3 detections inert), PipeEvent catch-all shadows named rules, contains Identities over-matches

Status: Open.

#223 In olafhartong/sysmon-modular;

· chefm4tt opened on Jul 29, 2026

WMI Event Subscription events (EID 19/20/21) tagged T1047 instead of T1546.003

Status: Open.

#220 In olafhartong/sysmon-modular;

· jeremiah-onyema opened on Jun 21, 2026

c:\sysmon filling up

Status: Open.

#218 In olafhartong/sysmon-modular;

· krandill opened on Jan 6, 2026

svchost exclusion

Status: Open.

#215 In olafhartong/sysmon-modular;

· krandill opened on Nov 13, 2025

Alternate data streams removal issue

Status: Open.

#212 In olafhartong/sysmon-modular;

· ivodelver opened on Feb 25, 2025

typo event 13 T1562.002 Disable Windows Event Logging

Status: Open.

#209 In olafhartong/sysmon-modular;

· wildebras opened on Oct 8, 2024

Suggested addition to ProcessAccess event, for MS Intune

Status: Open.

#208 In olafhartong/sysmon-modular;

· cyb3rxp opened on Oct 7, 2024

FileDelete Issue, cannot remove C:\Sysmon locked .dlls

Status: Open.

#200 In olafhartong/sysmon-modular;

· deathrig07 opened on Mar 19, 2024

Config causing 35 second delay opening modern MS Office file formats (.docx & .xlsx etc)

Status: Open.

#199 In olafhartong/sysmon-modular;

· smogm opened on Mar 8, 2024

Error 255 appears, please help me figure it out.

Status: Open.

#198 In olafhartong/sysmon-modular;

· h3nkbleck opened on Mar 1, 2024

Incorrect rule format?

Status: Open.

#197 In olafhartong/sysmon-modular;

· 3ch035 opened on Feb 26, 2024

User condition in exclusions for RegistryEvents

Status: Open.

#196 In olafhartong/sysmon-modular;

· schwf5 opened on Feb 7, 2024