Still supported to deploy latest Sysmon 10.x version?

[Daniel_K]

Hi Olaf,

Looking into to use "Sysmon deploy and maintain" to deploy latest Sysmon 10.x version.
Should this work flawless or are any issues to be expected?

Best Regards,
Daniel

[mhessel]

This does work with the latest version of sysmon (10.42 at the moment).

I did have to make a few changes to enable this:

• download the latest version of sysmon, extract all the files into TA-sysmon-deploy\bin ( should be sysmon.exe, sysmon64.exe, and eula)
• edit the deploy.bat file, replace all of the instances of "System Monitor v8.00" with "System Monitor v10.42"
• generate an updated config.xml file for this version, you can pull the latest updates from the git repo "https://github.com/olafhartong/sysmon-modular"

I did get some errors at times in the script where it would report a failure on upgrading the sysmon executable, but when I manually verified, the installation was successful and it was a false negative.

you will probably need to restart the splunkforwarder service after each sysmon upgrade, as the forwarder doesn't pick up the new event log entries without a restart.

[cpaul8]

Sysmon deploy and maintain works with version 10. it does nothing but pushing the binary and config file you upload into it provided the update.bat is updated with correct "system monitor vXX" string.

however, what I noticed recently is that TA for verison 10 has some field mapping issue with verison 10 and is not compliant with Endpoint DM in Enterprise Security. Please let me know if I am wrong.

[ivanreis]

Per what is being described on the app documentation, the current Sysmon deploy and maintain is developed to support Sysmon 8.00.
Release Notes
Version 1.16
July 25, 2018
Updated sysmon config generated from my modular repository.
This config is updated to the latest iteration of the MITRE ATT&CK framework
Built for Sysmon 8.00

I suggest to deploy this app to a Splunk sandbox environment and run your tests to check about the Sysmon behavior on verson 10.x. I never worked with this app before.