Sysmon For Linux install and build instructions

Overview

Sysmon For Linux install and build instructions

Installation

The packages are available in the official Microsoft Linux repositories and instructions on how to install the packages for the different Linux distributions can be found in the Installation instructions.

Dependencies

For Ubuntu:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
echo "deb https://download.mono-project.com/repo/ubuntu vs-bionic main" | sudo tee /etc/apt/sources.list.d/mono-official-vs.list
sudo apt update
sudo apt install build-essential gcc g++ make cmake libelf-dev llvm clang libxml2 libxml2-dev libzstd1 git libgtest-dev apt-transport-https dirmngr monodevelop googletest google-mock libjson-glib-dev
cd /usr/src/googletest
sudo mkdir build
sudo chown *user*:*group* build
cd build
cmake ..
make
sudo make install

Sysmon For Linux also depends on SysinternalsEBPF being installed: library
libsysinternalsEBPF.so, header libsysinternalsEBPF.h, plus resource files in
/opt/sysinternalsEBPF.  These can be installed from the SysinternalsEBPF
project.

Build

cd
git clone --recurse-submodules https://github.com/Sysinternals/SysmonForLinux.git
cd SysmonForLinux
mkdir build
cd build
cmake ..
make

Test

./sysmonUnitTests

Run

sudo ./sysmon -?

Install

sudo ./sysmon -accepteula
sudo ./sysmon -i CONFIG_FILE

This will install sysmon and associated files into the /opt/sysmon directory. The binary is portable and self-contained - the build process packs the required files into the binary for installation with '-i'. Sysmon will restart on reboot with the same configuration.

Change the configuration with

sudo /opt/sysmon/sysmon -c CONFIG_FILE

Uninstall sysmon with

sudo /opt/sysmon/sysmon -u

Make Packages

Packages can be generated with:

make packages

The directories build/deb and build/rpm will be populated with the required files. If dpkg-deb is available, the build/deb directory will be used to create a deb package. Similarly if rpmbuild is available, the build/rpm directory will be used to create an rpm package.

Autodiscovery of Offsets

Sysmon attempts to automatically discover the offsets of some members of some kernel structs. If this fails, please provide details of the kernel version (and config if possible) plus the error message to:

kevin.sheldrake AT microsoft.com

You can then generate a configuration file to override the autodiscovery by building the getOffsets module in the /opt/sysinternals/getOffsets directory. See the README.md in that directory for more information.

Manual Page

A man page for Sysmon can be found in the package directory, and is installed by both deb and rpm packages.

Use 'find' on the package directory to locate it manually.

Output

sudo tail -f /var/log/syslog

or more human-readable

sudo tail -f /var/log/syslog | /opt/sysmon/sysmonLogView

SysmonLogView has options to filter the output to make it easy to identify specific events or reduce outputted fields for brevity.

SysmonLogView is built when Sysmon is built and is installed into /opt/sysmon when sysmon is installed.

Important: You may wish to modify your Syslogger config to ensure it can handle particularly large events (e.g. >64KB, as defaults are often between 1KB and 8KB), and/or use the FieldSizes configuration entry to limit the length of output for some fields, such as CommandLine, Image, CurrentDirectory, etc.

Example:

Add CommandLine:100,Image:20 under in your configuration file.

Developer Details

See DEVELOP.md

License

Sysmon For Linux is licensed under MIT, with the eBPF programs licensed under GPL2. SysinternalsEBPF (on which Sysmon For Linux depends) is licensed under LGPL2.1, with the eBPF code library licensed under GPL2.

Issues
  • Centos 7 Project make error: cannot execute TextTransform.exe.

    Centos 7 Project make error: cannot execute TextTransform.exe.

    [[email protected] build]# make [ 0%] Built target sysmonEBPFkern5.6- [ 0%] Built target sysmonEBPFkern5.3-5.5 [ 1%] Extracting sysmonmsg.mc.utf16 /usr/lib/monodevelop/AddIns/MonoDevelop.TextTemplating/TextTransform.exe: /usr/lib/monodevelop/AddIns/MonoDevelop.TextTemplating/TextTransform.exe: cannot execute binary file make[2]: *** [sysmonmsg.mc.utf16] Error 126 make[1]: *** [CMakeFiles/sysmonLogView.dir/all] Error 2 make: *** [all] Error 2

    Please help

    opened by MrJeffyw 8
  • New Packages Addressing Segfault

    New Packages Addressing Segfault

    I know that the source is fixed, but when will new packages addressing https://github.com/Sysinternals/SysmonForLinux/issues/9 be available? I feel like this is bug really affects being able have confidence in proper operation and adopt the usage of S4L in a consistent and scalable fashion. Thanks, as always, for the great work! I am really looking forward to being able to have this deployed at scale.

    opened by weslambert 6
  • CentOS 7 package glibc 2.26

    CentOS 7 package glibc 2.26

    Hi, I'm having trouble using the package for CentOS 7. Installation fails with following:

    [[email protected] ~]$ sudo yum install sysmonforlinux
    Loaded plugins: fastestmirror
    Loading mirror speeds from cached hostfile
     * base: merlin.fit.vutbr.cz
     * extras: merlin.fit.vutbr.cz
     * updates: merlin.fit.vutbr.cz
    Resolving Dependencies
    --> Running transaction check
    ---> Package sysmonforlinux.x86_64 0:1.0.0-1 will be installed
    --> Processing Dependency: libstdc++.so.6(CXXABI_1.3.9)(64bit) for package: sysmonforlinux-1.0.0-1.x86_64
    --> Processing Dependency: libsysinternalsEBPF.so()(64bit) for package: sysmonforlinux-1.0.0-1.x86_64
    --> Running transaction check
    ---> Package sysinternalsebpf.x86_64 0:1.0.0-1 will be installed
    --> Processing Dependency: libc.so.6(GLIBC_2.26)(64bit) for package: sysinternalsebpf-1.0.0-1.x86_64
    --> Processing Dependency: libjson-glib-1.0.so.0()(64bit) for package: sysinternalsebpf-1.0.0-1.x86_64
    ---> Package sysmonforlinux.x86_64 0:1.0.0-1 will be installed
    --> Processing Dependency: libstdc++.so.6(CXXABI_1.3.9)(64bit) for package: sysmonforlinux-1.0.0-1.x86_64
    --> Running transaction check
    ---> Package json-glib.x86_64 0:1.4.2-2.el7 will be installed
    ---> Package sysinternalsebpf.x86_64 0:1.0.0-1 will be installed
    --> Processing Dependency: libc.so.6(GLIBC_2.26)(64bit) for package: sysinternalsebpf-1.0.0-1.x86_64
    ---> Package sysmonforlinux.x86_64 0:1.0.0-1 will be installed
    --> Processing Dependency: libstdc++.so.6(CXXABI_1.3.9)(64bit) for package: sysmonforlinux-1.0.0-1.x86_64
    --> Finished Dependency Resolution
    Error: Package: sysinternalsebpf-1.0.0-1.x86_64 (packages-microsoft-com-prod)
               Requires: libc.so.6(GLIBC_2.26)(64bit)
    Error: Package: sysmonforlinux-1.0.0-1.x86_64 (packages-microsoft-com-prod)
               Requires: libstdc++.so.6(CXXABI_1.3.9)(64bit)
     You could try using --skip-broken to work around the problem
     You could try running: rpm -Va --nofiles --nodigest
    

    This was a clean and updated CentOS 7 VM (minimal). I'm not 100% sure, but I don't think glibc 2.26 is in the official CentOS 7 repos.

    opened by j91321 6
  • "syslog" file not located

    Following this site instructions, I installed sysmonForLinux on openSUSE Tumbleweed. I ran sysmon and it's working. However, log file "/var/log/syslog" doesn't appear and even sysmonLogView doesn't show nothing. Where is located that file in my system?

    Thank you

    opened by RafaelLinux 4
  • Missing config.xml file

    Missing config.xml file

    opened by gizamichal 4
  • Segfault after 5 minutes of no events

    Segfault after 5 minutes of no events

    Running on a low activity test debian 10 system, with a filter for just process creates, and sysmon crashed after 5 minutes of not receiving any events.

    Oct 14 20:39:16 lsys sysmon[1641]: Event timeout occurred (no event for 300 seconds). Reloading eBPF...
    Oct 14 20:39:17 lsys sysmon[1641]: sedsid() failed.
    Oct 14 20:39:17 lsys sysmon[1641]: Could not automatically discover kernel offsets.
    Oct 14 20:39:17 lsys sysmon[1641]: Build and run the get_offsets module to generate the offsets config file:
    Oct 14 20:39:17 lsys sysmon[1641]: /opt/sysinternalsEBPF/sysinternalsEBPF_offsets.conf
    Oct 14 20:39:17 lsys sysmon[1641]: Reloaded eBPF due to event timeout
    Oct 14 20:39:17 lsys kernel: [ 3109.759945] sysmon[1672]: segfault at 40 ip 00007fe5c2f867f3 sp 00007ffd73847fc0 error 4 in libsysinternalsEBPF.so[7fe5c2f64000+40000] 
    Oct 14 20:39:17 lsys systemd[1]: sysmon.service: Main process exited, code=killed, status=11/SEGV
    Oct 14 20:39:17 lsys systemd[1]: sysmon.service: Failed with result 'signal'.
    

    Here's my sysmon config for reference

    <Sysmon schemaversion="4.70">
            <EventFiltering>
                    <RuleGroup name="" groupRelation="or">
                            <ProcessCreate onmatch="exclude"/>
                    </RuleGroup>
            </EventFiltering>
    </Sysmon>
    
    opened by nighttardis 4
  • amd cpu support

    amd cpu support

    I could not install this in AMD cpu server it say;

    [[email protected]]# yum install -y sysmonforlinux DigitalOcean Droplet Agent 36 kB/s | 3.3 kB 00:00
    Package sysmonforlinux-1.0.0-1.x86_64 is already installed. Dependencies resolved. Nothing to do. Complete!

    [[email protected]]# sysmon -acceptuela -i sysmonconfig.xml

    Sysmon v1.0.0 - Monitors system events Sysinternals - www.sysinternals.com By Mark Russinovich, Thomas Garnier and Kevin Sheldrake Copyright (C) 2014-2021 Microsoft Corporation Using libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved.

    Usage: Install: sysmon -i [] Update configuration: sysmon -c [] Print schema: sysmon -s Uninstall: sysmon -u [force] -c Update configuration of an installed Sysmon driver or dump the current configuration if no other argument is provided. Optionally take a configuration file. -i Install service and driver. Optionally take a configuration file. -s Print configuration schema definition of the specified version. Specify 'all' to dump all schema versions (default is latest)). -u Uninstall service and driver. Adding force causes uninstall to proceed even when some components are not installed.

    The service logs events immediately and the driver installs as a boot-start driver to capture activity from early in the boot that the service will write to the event log when it starts.

    On Linux, events are stored in the Syslog, often found at /var/log/syslog.

    Use the '-? config' command for configuration file documentation. More examples are available on the Sysinternals website.

    **Specify -accepteula to automatically accept the EULA on installation.

    Neither install nor uninstall requires a reboot.**

    [[email protected]]# cat /etc/os-release NAME="CentOS Linux" VERSION="8" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="8" PLATFORM_ID="platform:el8" PRETTY_NAME="CentOS Linux 8" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:8" HOME_URL="https://centos.org/" BUG_REPORT_URL="https://bugs.centos.org/" CENTOS_MANTISBT_PROJECT="CentOS-8" CENTOS_MANTISBT_PROJECT_VERSION="8" [[email protected]]# cat /etc/redhat-release CentOS Linux release 8.3.2011

    opened by mengualp 2
  • Won't compile on Ubuntu 20.04

    Won't compile on Ubuntu 20.04

    I'm trying to compile it on Ubuntu 20.04, 5.4.0-88-generic

    Scanning dependencies of target sysmonLogView
    [ 10%] Building CXX object CMakeFiles/sysmonLogView.dir/sysmonLogView/sysmonLogView.cpp.o
    [ 11%] Building C object CMakeFiles/sysmonLogView.dir/sysmonLogView/sysmonGetEventName.c.o
    [ 12%] Building C object CMakeFiles/sysmonLogView.dir/sysmonmsgop.c.o
    [ 13%] Linking CXX executable sysmonLogView
    [ 13%] Built target sysmonLogView
    [ 13%] Built target sysmonEBPFkern5.3-5.5
    [ 15%] Building C object CMakeFiles/checkEBPFsizes.dir/checkEBPFsizes/checkEBPFsizes.c.o
    [ 16%] Linking C executable checkEBPFsizes
    [ 16%] Built target checkEBPFsizes
    [ 17%] Building C object CMakeFiles/mysleep.dir/test/mysleep.c.o
    [ 18%] Linking C executable mysleep
    [ 18%] Built target mysleep
    [ 19%] Packing manifest.xml into manifest.xml.o
    make[2]: *** No rule to make target '/opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_helpers.c', needed by 'sysmonEBPFkern4.15.o'.  Stop.
    make[1]: *** [CMakeFiles/Makefile2:232: CMakeFiles/sysmon.dir/all] Error 2
    make: *** [Makefile:84: all] Error 2
    
    opened by CaledoniaProject 2
  • Command correction in SysmonForLinux/Readme

    Command correction in SysmonForLinux/Readme

    Correction on readme page regarding CLI command for viewing syslog logs via SysmonLogView is required.

    The provided code mentions:

    sudo tail -f /var/log/syslog | /opt/sysmon/sysmonLogView

    But the output will be provided as per sudo tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView

    Hope this helps!

    opened by ashishsecdev 2
  • error when installing mono

    error when installing mono

    [email protected]:~/app/SysmonForLinux/build$ sudo apt-get install monodevelop Reading package lists... Done Building dependency tree
    Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation:

    The following packages have unmet dependencies: monodevelop : Depends: mono-runtime-sgen but it is not going to be installed Depends: fsharp but it is not going to be installed Depends: mono-runtime (>= 3.0~) but it is not going to be installed Depends: libc6 (>= 2.27) but 2.23-0ubuntu11.3 is to be installed or libc6.1 (>= 2.27) but it is not installable or libc0.1 (>= 2.27) but it is not installable Depends: libfontconfig1 (>= 2.12) but 2.11.94-0ubuntu1.1 is to be installed Depends: libfsharp-core4.5-cil (>= 4.5) but it is not going to be installed Depends: libglade2.0-cil (>= 2.12.45) but it is not going to be installed Depends: libglib2.0-0 (>= 2.56.4) but 2.48.2-0ubuntu4.8 is to be installed Depends: libglib2.0-cil (>= 2.12.45) but it is not going to be installed Depends: libgtk2.0-cil (>= 2.12.45) but it is not going to be installed Depends: libmono-cairo4.0-cil (>= 3.2.1) but it is not going to be installed Depends: libmono-corlib4.5-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-microsoft-csharp4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-microsoft-web-infrastructure1.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-posix4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-system-componentmodel-composition4.0-cil (>= 3.0.6) but it is not going to be installed Depends: libmono-system-componentmodel-dataannotations4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-system-configuration4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-system-core4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-system-data-entity4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-data-linq4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-data4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-system-design4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-drawing4.0-cil (>= 3.0.6) but it is not going to be installed Depends: libmono-system-identitymodel4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-system-io-compression4.0-cil (>= 3.2.1) but it is not going to be installed Depends: libmono-system-net-http4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-numerics4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-runtime-caching4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-system-runtime-serialization4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-system-runtime4.0-cil (>= 2.10.1) but it is not going to be installed Depends: libmono-system-security4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-servicemodel4.0a-cil (>= 3.2.3) but it is not going to be installed Depends: libmono-system-web-extensions4.0-cil (>= 2.10.3) but it is not going to be installed Depends: libmono-system-web-services4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-web4.0-cil (>= 2.10.3) but it is not going to be installed Depends: libmono-system-windows-forms4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-xaml4.0-cil (>= 1.0) but it is not going to be installed Depends: libmono-system-xml-linq4.0-cil (>= 3.0.6) but it is not going to be installed Depends: libmono-system-xml4.0-cil (>= 3.12.0) but it is not going to be installed Depends: libmono-system4.0-cil (>= 4.0.0~alpha1) but it is not going to be installed Depends: libmono-windowsbase4.0-cil (>= 3.0.6) but it is not going to be installed Depends: libpango-1.0-0 (>= 1.40.14) but 1.38.1-1 is to be installed Depends: libpangocairo-1.0-0 (>= 1.40.14) but 1.38.1-1 is to be installed Depends: monodoc-base (>= 3.2.1) but it is not going to be installed Depends: msbuild but it is not going to be installed Recommends: libgtk2.0-cil-dev but it is not going to be installed Recommends: mono-devel but it is not going to be installed Recommends: xamarin-gtk-theme but it is not going to be installed E: Unable to correct problems, you have held broken packages. [email protected]:~/app/SysmonForLinux/build$

    hello developer,I have no idea why i can't install monodevelop,maybe beacause i installed wine and sourceInsight before... i try this method but it still doesn't work: sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
    echo "deb http://download.mono-project.com/repo/debian wheezy main" | sudo tee /etc/apt/sources.list.d/mono-xamarin.list
    sudo apt-get update

    opened by maru7777 2
  • Compilation fails in Ubuntu 21.10 Impish on a Raspberry Pi 4

    Compilation fails in Ubuntu 21.10 Impish on a Raspberry Pi 4

    The following is happening in Ubuntu 21.10 Impish on a Raspberry Pi 4, I have completed the previous steps and everything works find for the previous library that must be compiled, it is with Sysmon that this breaks with the following message:

    [  1%] Extracting sysmonmsg.mc.utf16
    [  2%] Extracting sysmonmsgop.man.utf16
    [  3%] Converting sysmonmsgop.man.utf16 to UTF8
    [  4%] Extracting sysmonmsgop.c from sysmonmsgop.man
    [  5%] Extracting sysmonevents.h.utf16
    Warning skip check of User due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Archived due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Archived due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Archived due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of CommandLine due to misalignment
    Warning skip check of CurrentDirectory due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of LogonGuid due to misalignment
    Warning skip check of LogonId due to misalignment
    Warning skip check of TerminalSessionId due to misalignment
    Warning skip check of IntegrityLevel due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of ParentProcessGuid due to misalignment
    Warning skip check of ParentProcessId due to misalignment
    Warning skip check of ParentImage due to misalignment
    Warning skip check of ParentCommandLine due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Signed due to misalignment
    Warning skip check of Signature due to misalignment
    Warning skip check of SignatureStatus due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of PipeName due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of PipeName due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Archived due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of CommandLine due to misalignment
    Warning skip check of CurrentDirectory due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of LogonGuid due to misalignment
    Warning skip check of LogonId due to misalignment
    Warning skip check of TerminalSessionId due to misalignment
    Warning skip check of IntegrityLevel due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of ParentProcessGuid due to misalignment
    Warning skip check of ParentProcessId due to misalignment
    Warning skip check of ParentImage due to misalignment
    Warning skip check of ParentCommandLine due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Signed due to misalignment
    Warning skip check of Signature due to misalignment
    Warning skip check of SignatureStatus due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of PipeName due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of PipeName due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Archived due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of FileVersion due to misalignment
    Warning skip check of Description due to misalignment
    Warning skip check of Product due to misalignment
    Warning skip check of Company due to misalignment
    Warning skip check of CommandLine due to misalignment
    Warning skip check of CurrentDirectory due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of LogonGuid due to misalignment
    Warning skip check of LogonId due to misalignment
    Warning skip check of TerminalSessionId due to misalignment
    Warning skip check of IntegrityLevel due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of ParentProcessGuid due to misalignment
    Warning skip check of ParentProcessId due to misalignment
    Warning skip check of ParentImage due to misalignment
    Warning skip check of ParentCommandLine due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of CreationUtcTime due to misalignment
    Warning skip check of PreviousCreationUtcTime due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of Protocol due to misalignment
    Warning skip check of Initiated due to misalignment
    Warning skip check of SourceIsIpv6 due to misalignment
    Warning skip check of SourceIp due to misalignment
    Warning skip check of SourceHostname due to misalignment
    Warning skip check of SourcePort due to misalignment
    Warning skip check of SourcePortName due to misalignment
    Warning skip check of DestinationIsIpv6 due to misalignment
    Warning skip check of DestinationIp due to misalignment
    Warning skip check of DestinationHostname due to misalignment
    Warning skip check of DestinationPort due to misalignment
    Warning skip check of DestinationPortName due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ImageLoaded due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Signed due to misalignment
    Warning skip check of Signature due to misalignment
    Warning skip check of SignatureStatus due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of ImageLoaded due to misalignment
    Warning skip check of FileVersion due to misalignment
    Warning skip check of Description due to misalignment
    Warning skip check of Product due to misalignment
    Warning skip check of Company due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Signed due to misalignment
    Warning skip check of Signature due to misalignment
    Warning skip check of SignatureStatus due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of SourceProcessGuid due to misalignment
    Warning skip check of SourceProcessId due to misalignment
    Warning skip check of SourceImage due to misalignment
    Warning skip check of TargetProcessGuid due to misalignment
    Warning skip check of TargetProcessId due to misalignment
    Warning skip check of TargetImage due to misalignment
    Warning skip check of NewThreadId due to misalignment
    Warning skip check of StartAddress due to misalignment
    Warning skip check of StartModule due to misalignment
    Warning skip check of StartFunction due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of Device due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of SourceProcessGUID due to misalignment
    Warning skip check of SourceProcessId due to misalignment
    Warning skip check of SourceThreadId due to misalignment
    Warning skip check of SourceImage due to misalignment
    Warning skip check of TargetProcessGUID due to misalignment
    Warning skip check of TargetProcessId due to misalignment
    Warning skip check of TargetImage due to misalignment
    Warning skip check of GrantedAccess due to misalignment
    Warning skip check of CallTrace due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of CreationUtcTime due to misalignment
    Warning skip check of EventType due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetObject due to misalignment
    Warning skip check of EventType due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetObject due to misalignment
    Warning skip check of Details due to misalignment
    Warning skip check of EventType due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetObject due to misalignment
    Warning skip check of NewName due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of CreationUtcTime due to misalignment
    Warning skip check of Hash due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of PipeName due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of PipeName due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of EventType due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of Operation due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of EventNamespace due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Query due to misalignment
    Warning skip check of EventType due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of Operation due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of Name due to misalignment
    Warning skip check of Type due to misalignment
    Warning skip check of Destination due to misalignment
    Warning skip check of EventType due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of Operation due to misalignment
    Warning skip check of User due to misalignment
    Warning skip check of Consumer due to misalignment
    Warning skip check of Filter due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of TargetFilename due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Archived due to misalignment
    Warning skip check of UtcTime due to misalignment
    Warning skip check of ProcessGuid due to misalignment
    Warning skip check of ProcessId due to misalignment
    Warning skip check of Image due to misalignment
    Warning skip check of Session due to misalignment
    Warning skip check of ClientInfo due to misalignment
    Warning skip check of Hashes due to misalignment
    Warning skip check of Path due to misalignment
    Warning skip check of Archived due to misalignment
    [  6%] Converting sysmonevents.h.utf16 to UTF8
    [  7%] Converting sysmonmsg.mc.utf16 to UTF8
    [  8%] Extracting sysmonmsg.h from sysmonmsg.mc
    [  9%] Extracting sysmonmsgop.h from sysmonmsgop.man
    Scanning dependencies of target sysmonLogView
    [ 10%] Building CXX object CMakeFiles/sysmonLogView.dir/sysmonLogView/sysmonLogView.cpp.o
    [ 11%] Building C object CMakeFiles/sysmonLogView.dir/sysmonLogView/sysmonGetEventName.c.o
    [ 12%] Building C object CMakeFiles/sysmonLogView.dir/sysmonmsgop.c.o
    [ 13%] Linking CXX executable sysmonLogView
    [ 13%] Built target sysmonLogView
    [ 13%] Built target sysmonEBPFkern5.3-5.5
    [ 15%] Building C object CMakeFiles/checkEBPFsizes.dir/checkEBPFsizes/checkEBPFsizes.c.o
    [ 16%] Linking C executable checkEBPFsizes
    [ 16%] Built target checkEBPFsizes
    [ 17%] Building C object CMakeFiles/mysleep.dir/test/mysleep.c.o
    [ 18%] Linking C executable mysleep
    [ 18%] Built target mysleep
    [ 19%] Packing manifest.xml into manifest.xml.o
    [ 20%] Building EBPF object sysmonEBPFkern4.15.o
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPFkern4.15.c:36:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonGenericEntry_tp.c:35:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPF_common.h:34:
    In file included from /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_common.h:34:
    /usr/include/stdint.h:26:10: fatal error: 'bits/libc-header-start.h' file not found
    #include <bits/libc-header-start.h>
             ^~~~~~~~~~~~~~~~~~~~~~~~~~
    1 error generated.
    [ 21%] Packing sysmonEBPFkern4.15.o into sysmonEBPFkern4.15.o.o
    [ 22%] Building EBPF object sysmonEBPFkern4.16.o
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPFkern4.16.c:36:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonGenericEntry_tp.c:35:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPF_common.h:34:
    In file included from /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_common.h:34:
    /usr/include/stdint.h:26:10: fatal error: 'bits/libc-header-start.h' file not found
    #include <bits/libc-header-start.h>
             ^~~~~~~~~~~~~~~~~~~~~~~~~~
    1 error generated.
    [ 23%] Packing sysmonEBPFkern4.16.o into sysmonEBPFkern4.16.o.o
    [ 24%] Building EBPF object sysmonEBPFkern4.17-5.1.o
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPFkern4.17-5.1.c:36:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonGenericEntry_rawtp.c:31:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPF_common.h:34:
    In file included from /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_common.h:34:
    /usr/include/stdint.h:26:10: fatal error: 'bits/libc-header-start.h' file not found
    #include <bits/libc-header-start.h>
             ^~~~~~~~~~~~~~~~~~~~~~~~~~
    1 error generated.
    [ 25%] Packing sysmonEBPFkern4.17-5.1.o into sysmonEBPFkern4.17-5.1.o.o
    [ 26%] Building EBPF object sysmonEBPFkern5.2.o
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPFkern5.2.c:35:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonGenericEntry_rawtp.c:31:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPF_common.h:34:
    In file included from /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_common.h:34:
    /usr/include/stdint.h:26:10: fatal error: 'bits/libc-header-start.h' file not found
    #include <bits/libc-header-start.h>
             ^~~~~~~~~~~~~~~~~~~~~~~~~~
    1 error generated.
    [ 27%] Packing sysmonEBPFkern5.2.o into sysmonEBPFkern5.2.o.o
    [ 29%] Building EBPF object sysmonEBPFkern5.3-5.5.o
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPFkern5.3-5.5.c:33:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonGenericEntry_rawtp.c:31:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPF_common.h:34:
    In file included from /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_common.h:34:
    /usr/include/stdint.h:26:10: fatal error: 'bits/libc-header-start.h' file not found
    #include <bits/libc-header-start.h>
             ^~~~~~~~~~~~~~~~~~~~~~~~~~
    1 error generated.
    [ 30%] Packing sysmonEBPFkern5.3-5.5.o into sysmonEBPFkern5.3-5.5.o.o
    [ 31%] Building EBPF object sysmonEBPFkern5.6-.o
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPFkern5.6-.c:33:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonGenericEntry_rawtp.c:31:
    In file included from /root/SysmonForLinux/ebpfKern/sysmonEBPF_common.h:34:
    In file included from /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_common.h:34:
    /usr/include/stdint.h:26:10: fatal error: 'bits/libc-header-start.h' file not found
    #include <bits/libc-header-start.h>
             ^~~~~~~~~~~~~~~~~~~~~~~~~~
    1 error generated.
    [ 32%] Packing sysmonEBPFkern5.6-.o into sysmonEBPFkern5.6-.o.o
    [ 33%] Packing sysmonLogView into sysmonLogView.o
    [ 34%] Copying sysmon.d
    [ 35%] Packing sysmon.d into sysmon.d.o
    [ 36%] Copying sysmon.service
    [ 37%] Packing sysmon.service into sysmon.service.o
    [ 38%] Checking sysmonEBPFkern4.15.o
    
    eBPF Program Sizes: (max 4096)
    
    
    [ 39%] Checking sysmonEBPFkern4.16.o
    
    eBPF Program Sizes: (max 4096)
    
    
    [ 40%] Checking sysmonEBPFkern4.17-5.1.o
    
    eBPF Program Sizes: (max 4096)
    
    
    [ 41%] Checking sysmonEBPFkern5.2.o
    
    eBPF Program Sizes: (max 32768)
    
    
    [ 43%] Checking sysmonEBPFkern5.3-5.5.o
    
    eBPF Program Sizes: (max 32768)
    
    
    [ 44%] Checking sysmonEBPFkern5.6-.o
    
    eBPF Program Sizes: (max 32768)
    
    
    Scanning dependencies of target sysmon
    [ 45%] Building C object CMakeFiles/sysmon.dir/sysmonforlinux.c.o
    /root/SysmonForLinux/sysmonforlinux.c:100:6: error: ‘__NR_creat’ undeclared here (not in a function)
      100 |     {__NR_creat, "sysmon/FileCreate/exit"},
          |      ^~~~~~~~~~
    /root/SysmonForLinux/sysmonforlinux.c:101:6: error: ‘__NR_open’ undeclared here (not in a function)
      101 |     {__NR_open, "sysmon/FileOpen/exit"},
          |      ^~~~~~~~~
    /root/SysmonForLinux/sysmonforlinux.c:103:6: error: ‘__NR_unlink’ undeclared here (not in a function)
      103 |     {__NR_unlink, "sysmon/FileDelete/exit"},
          |      ^~~~~~~~~~~
    make[2]: *** [CMakeFiles/sysmon.dir/build.make:520: CMakeFiles/sysmon.dir/sysmonforlinux.c.o] Error 1
    make[1]: *** [CMakeFiles/Makefile2:252: CMakeFiles/sysmon.dir/all] Error 2
    make: *** [Makefile:103: all] Error 2
    
    opened by vicosurge 1
  • Problems logging rules

    Problems logging rules

    Borrowing from examples posted in https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/main.xml, I've found rule names such as: <Rule name="TechniqueID=T1070.006,TechniqueName=Indicator Removal on Host: Timestomp"... > <Image condition="end with">touch</Image> </Rule>

    This gets truncated in syslog at to: <Data Name="RuleName">TechniqueID=T1070.006,TechniqueName=Indi

    To shorten the message I tried: <Rule name="T1070.006, Timestomp" groupRelation="or">

    This gets ignored entirely. When included in the ProcessCreate section, processes associated with 'touch' are not logged at all.

    Trial and error show that including or omitting "TechniqueID=" and "TechniqueName=" affect how much the field is truncated, and omitting both field names appears to prevent logging entirely.

    Is there any specific guidance on how Rule Names are parsed, limitations on length of the string, and formatting?

    bug 
    opened by rblader 2
  • sysmon.service won't start because of libbpf issue

    sysmon.service won't start because of libbpf issue

    OS and Sysmon version Info

    CentOS 8.2.2004 Kernel Version 4.18.0-193.19.1.el8_2.x86_64 sysmonforlinux-1.0.2-1.x86_64 packages-microsoft-prod-1.0.1.noarch

    Error printed

    When using sysmon -accepteula -i

    • Job for sysmon.service failed because the control process exited with error code
    • Details in service status:
    sysmon_service_details

    The issue seems to come from sysinternalsEPBF. The package was downloaded from the yum repository.

    Note

    sysmonforlinux works well on CentOS 8.1.1911 (Core) with kernel 4.18.0-147.5.1.el8_1.x86_64 EDIT: I tried to restart the sysmon service on the server it was working, and now it won't restart:

       1. first the error I had was about  libsysinternalsEBPF.so that was not found, I had to recompile it to solve this issue
       2. Once the library was recompiled and found, now sysmon can't find sysinternalsEBPFrawSock.o program
       sysinternalsEBPFrawSock.o program is well located in  /opt/sysinternalsEBPF/ but sysmon can't find it:
       
       Apr 12 16:18:32 server01 sysmon[222692]: Using EBPF object: .//sysmonEBPFkern4.17-5.1.o
       Apr 12 16:18:34 server01 sysmon[222692]: ERROR: failed to locate program: /opt/sysinternalsEBPF/sysinternalsEBPFrawSock.o 'Invalid argument'
       Apr 12 16:18:34 server01 sysmon[222692]: ERROR: failed to enable raw socket capture
       Apr 12 16:18:34 server01 sysmon[222692]: Telemetry failed to start: Raw socket program could not be attached
    
    bug 
    opened by luffynextgen 10
  • Failed to load prog: 'Permission denied'

    Failed to load prog: 'Permission denied'

    I have installed the new package (sysmonforlinux-1.0.2-1.x86_64.rpm/sysinternalsebpf-1.0.2-1.x86_64.rpm) on RHEL 8.5 get the following error messages on startup:

    Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=40 stack=0 before 2121: (0f) r7 += r6 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=40 stack=0 before 2120: (79) r7 = *(u64 *)(r10 -128) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R0_w=inv(id=0) R6_rw=invP(id=43,smin_value=-4095,smax_value=4096) R7=inv(id=0,umax_value=4096,var_off=(0x0; 0xffffffff)) R8_rw=map_value(id=0,off=4096,ks=4,vs=8192,imm=0) R9=map_valu> Apr 01 10:41:53 localhost.localdomain sysmon[10491]: parent already had regs=40 stack=0 marks Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2131: (b7) r5 = 0 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2132: (67) r7 <<= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2133: (77) r7 >>= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2134: (25) if r7 > 0x1000 goto pc-1129 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R0_w=inv(id=0,smin_value=-4095,smax_value=4095) R5_w=inv0 R6=inv(id=43,smin_value=-4095,smax_value=4096) R7_w=inv(id=0,umax_value=4096,var_off=(0x0; 0xffffffff)) R8=map_value(id=0,of> Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2135: (07) r6 += -1 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2136: (67) r6 <<= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2137: (77) r6 >>= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2138: (25) if r6 > 0xffe goto pc-1133 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R0=inv(id=0,smin_value=-4095,smax_value=4095) R5=inv0 R6=inv(id=0,umax_value=4094,var_off=(0x0; 0xffffffff)) R7=inv(id=0,umax_value=4096,var_off=(0x0; 0xffffffff)) R8=map_value(id=0,> Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2139: (bf) r1 = r0 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2140: (67) r1 <<= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2141: (c7) r1 s>>= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2142: (b7) r2 = 1 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2143: (6d) if r2 s> r1 goto pc-1138 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R0=inv(id=45,smin_value=-4095,smax_value=4095) R1_w=inv(id=0,umin_value=1,umax_value=4095,var_off=(0x0; 0xfff)) R2_w=inv1 R5=inv0 R6=inv(id=0,umax_value=4094,var_off=(0x0; 0xffffffff> Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2144: (79) r1 = *(u64 *)(r10 -128) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2145: (15) if r1 == 0x0 goto pc+5 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R0=inv(id=45,smin_value=-4095,smax_value=4095) R1_w=inv(id=0,umax_value=4095,var_off=(0x0; 0xfff)) R2_w=inv1 R5=inv0 R6=inv(id=0,umax_value=4094,var_off=(0x0; 0xffffffff)) R7=inv(id=> Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2146: (79) r1 = *(u64 *)(r10 -96) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2147: (79) r2 = *(u64 *)(r10 -128) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2148: (1f) r1 -= r2 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: last_idx 2148 first_idx 2138 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=4 stack=0 before 2147: (79) r2 = *(u64 *)(r10 -128) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2146: (79) r1 = *(u64 *)(r10 -96) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2145: (15) if r1 == 0x0 goto pc+5 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2144: (79) r1 = *(u64 *)(r10 -128) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2143: (6d) if r2 s> r1 goto pc-1138 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2142: (b7) r2 = 1 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2141: (c7) r1 s>>= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2140: (67) r1 <<= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2139: (bf) r1 = r0 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2138: (25) if r6 > 0xffe goto pc-1133 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R0_rw=inv(id=0,smin_value=-4095,smax_value=4095) R5_w=inv0 R6_rw=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R7_w=inv(id=0,umax_value=4096,var_off=(0x0; 0xffffffff)) R8> Apr 01 10:41:53 localhost.localdomain sysmon[10491]: parent didn't have regs=0 stack=8000 marks Apr 01 10:41:53 localhost.localdomain sysmon[10491]: last_idx 2137 first_idx 2120 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2137: (77) r6 >>= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2136: (67) r6 <<= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2135: (07) r6 += -1 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2134: (25) if r7 > 0x1000 goto pc-1129 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2133: (77) r7 >>= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2132: (67) r7 <<= 32 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2131: (b7) r5 = 0 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2130: (85) call bpf_probe_read_str#45 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2129: (bf) r3 = r8 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2128: (57) r2 &= 4095 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2127: (bf) r2 = r6 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2126: (0f) r1 += r2 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2125: (79) r1 = *(u64 *)(r10 -96) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2124: (57) r2 &= 4095 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2123: (87) r2 = -r2 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2122: (bf) r2 = r7 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2121: (0f) r7 += r6 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: regs=0 stack=8000 before 2120: (79) r7 = *(u64 *)(r10 -128) Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R0_w=inv(id=0) R6_rw=invP(id=43,smin_value=-4095,smax_value=4096) R7=inv(id=0,umax_value=4096,var_off=(0x0; 0xffffffff)) R8_rw=map_value(id=0,off=4096,ks=4,vs=8192,imm=0) R9=map_valu> Apr 01 10:41:53 localhost.localdomain sysmon[10491]: parent already had regs=0 stack=8000 marks Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2149: (b7) r2 = 47 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: 2150: (73) *(u8 *)(r1 +4095) = r2 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R0=inv(id=45,smin_value=-4095,smax_value=4095) R1_w=map_value(id=0,off=0,ks=4,vs=8192,smin_value=-4095,smax_value=0) R2_w=inv47 R5=inv0 R6=inv(id=0,umax_value=4094,var_off=(0x0; 0xff> Apr 01 10:41:53 localhost.localdomain sysmon[10491]: R1 unbounded memory access, make sure to bounds check any such access Apr 01 10:41:53 localhost.localdomain sysmon[10491]: processed 1320 insns (limit 1000000) max_states_per_insn 2 total_states 109 peak_states 109 mark_read 84 Apr 01 10:41:53 localhost.localdomain sysmon[10491]: libbpf: -- END LOG -- Apr 01 10:41:53 localhost.localdomain sysmon[10491]: libbpf: failed to load program 'sysmon/ProcCreate/rawExit' Apr 01 10:41:53 localhost.localdomain sysmon[10491]: libbpf: failed to load object './/sysmonEBPFkern4.17-5.1.o' Apr 01 10:41:53 localhost.localdomain sysmon[10491]: ERROR: failed to load prog: 'Permission denied' Apr 01 10:41:53 localhost.localdomain sysmon[10452]: Telemetry failed to start: eBPF object could not be loaded

    Since I am not so deep in this topic, I post it here :-)

    bug 
    opened by zCukB 5
  • Build failures on Fedora

    Build failures on Fedora

    Hi!

    Thanks for making this available.

    I'm trying to build this for Fedora but I'm hitting some roadblocks with the TextTransform aspects of the make process.

    Build result from current master c3ba9694fe352a1253c4d3dfe1fa6e07ea181b94:

    STEP 24/24: RUN make
    [  1%] Building C object CMakeFiles/checkEBPFsizes.dir/checkEBPFsizes/checkEBPFsizes.c.o
    [  2%] Linking C executable checkEBPFsizes
    [  2%] Built target checkEBPFsizes
    [  3%] Extracting sysmonmsgop.man.utf16
    Parameter has too many values: !!version!internal
    make[2]: *** [CMakeFiles/sysmonLogView.dir/build.make:102: sysmonmsgop.man.utf16] Error 255
    make[1]: *** [CMakeFiles/Makefile2:156: CMakeFiles/sysmonLogView.dir/all] Error 2
    make: *** [Makefile:91: all] Error 2
    Error: error building at STEP "RUN make": error while running runtime: exit status 2
    

    I tracked down the line within CMakeLists.txt that relates to sysmonmsgop.man.utf16 and noticed it was updated recently by commit a7844a09aa624d34bd76c78da9b28ba270698583. With that in mind, I tried checking out and building the prior commit (c3ba9694fe352a1253c4d3dfe1fa6e07ea181b94) but that resulted in a different error:

    STEP 25/25: RUN make
    [  1%] Building C object CMakeFiles/checkEBPFsizes.dir/checkEBPFsizes/checkEBPFsizes.c.o
    [  2%] Linking C executable checkEBPFsizes
    [  2%] Built target checkEBPFsizes
    [  3%] Extracting sysmonmsgop.man.utf16
    /usr/lib/monodevelop/AddIns/MonoDevelop.TextTemplating/TextTransform.exe: /usr/lib/monodevelop/AddIns/MonoDevelop.TextTemplating/TextTransform.exe: cannot execute binary file
    make[2]: *** [CMakeFiles/sysmonLogView.dir/build.make:102: sysmonmsgop.man.utf16] Error 126
    make[1]: *** [CMakeFiles/Makefile2:156: CMakeFiles/sysmonLogView.dir/all] Error 2
    make: *** [Makefile:91: all] Error 2
    Error: error building at STEP "RUN make": error while running runtime: exit status 2
    

    I'm no expert with either TextTransform or Mono so I'm not entirely sure what's going on here that I might be able to fix. If we take the error message at face value, there's too many values in the !!version!internal parameter being fed to TextTransform by this line maybe?:

    https://github.com/Sysinternals/SysmonForLinux/blob/b3098b7123f845d7932b65d46907626db7b7033b/CMakeLists.txt#L398

    For debug purposes, I've produced a Dockerfile which should reliably reproduce the issue when executed with docker build or podman build:

    FROM registry.fedoraproject.org/fedora:35 as buildbin
    
    # Prereqs
    RUN dnf install -y clang cmake elfutils-libelf-devel g++ gcc git gtest-devel json-glib-devel libxml2-devel llvm mono-devel monodevelop-devel
    
    # Clone SysinternalsEBPF source
    RUN git clone https://github.com/Sysinternals/SysinternalsEBPF.git /tmp/SysinternalsEBPF
    RUN mkdir /tmp/SysinternalsEBPF/build
    WORKDIR /tmp/SysinternalsEBPF/build
    
    # Checkout a consistent commit for reproducibility
    RUN git checkout 26a5cef40713c29f2fdb16f43cc80afa3a15c402
    
    # Build SysinternalsEBPF
    RUN cmake ..
    RUN make
    
    # Install SysinternalsEBPF
    RUN make install
    
    # Clone SysmonForLinux source
    RUN git clone --recurse-submodules https://github.com/Sysinternals/SysmonForLinux.git /tmp/SysmonForLinux
    RUN mkdir /tmp/SysmonForLinux/build
    WORKDIR /tmp/SysmonForLinux/build
    
    # Checkout a consistent commit for reproducibility
    RUN git checkout c3ba9694fe352a1253c4d3dfe1fa6e07ea181b94
    
    # Build SysmonForLinux
    RUN cmake ..
    RUN make
    
    bug 
    opened by alexhaydock 3
  • Only seeing Event Types 1 and 5 (Process Creation/Termination)

    Only seeing Event Types 1 and 5 (Process Creation/Termination)

    I've installed SysmonForLinux on Ubuntu, but it only seems to be generating Process Create and Termination events. I've ran commands that created files, and network connections, but they only resulted in process creations. I've also installed it on Debian, same problem...

    Any suggestions on what I need to change so I'm capturing all events?

    Found the/my problem - the default config, config.xml does minimal data collection. Using https://gist.githubusercontent.com/Cyb3rWard0g/bcf1514cc340197f0076bf1da8954077/raw/293db31bb81c48ff18a591574a6f2bf946282602/SysmonForLinux-CollectAll-Config.xml instead of the default made all the difference

    opened by rgb44317 2
  • centos 8 Image and CommandLine  returned in null values

    centos 8 Image and CommandLine returned in null values

    I want to install sysmon on Centos 8 . for centos 8 i did the following steps but Null values ​​are returned in /var/log/messages. How did you do? can you help me?

    Centos 8

    Register Microsoft key and feed sudo rpm -Uvh https://packages.microsoft.com/config/centos/8/packages-microsoft-prod.rpm Install SysmonForLinux sudo dnf install sysmonforlinux

    example log from /var/log/messages

    Jan 6 09:58:15 localhost sysmon[1861664]:<Event><System><Provider Name="Linux-Sysmon" Guid="{fd293-a1d3-4f13-b0d6-01fc80f97}"/><EventID>5</EventID><Version>3</Version><Level>4</Level><Task>5</Task><Opcode>0</Opcode><Keywords>0x800000000000000</Keywords><TimeCreated SystemTime="2022-01-06T09:51:15.175756000Z"/><EventRecordID>358070</EventRecordID><Correlation/><Execution ProcessID="1861664" ThreadID="1861664"/><Channel>Linux-Sysmon/Operational</Channel><Computer>localhost.localdomain</Computer><Security UserId="0"/></System><EventData><Data Name="RuleName">-</Data><Data Name="UtcTime">2022-01-06 06:58:15.177</Data><Data Name="ProcessGuid">{4f20d11a-4478-61d5-0000-000000000000}</Data><Data Name="ProcessId">188</Data><Data Name="Image">(null)</Data><Data Name="User">-</Data></EventData></Event>

    opened by frkn4129 6
Releases(v1.0.2)
Owner
Sysinternals
Sysinternals
This repository is build for reviewing the CodingInterviews, Coding in ACM mode with C++.

CodingInterviews(剑指 Offer) 建立这个仓库为了重新复习一下《剑指 Offer》,上传的是ACM模式版本。 如果本仓库对你有任何帮助,请点 ?? 支持,谢谢! ??

Mike Zheng 17 Mar 4, 2022
Parsing the Linux procfs

Very easy to use, procfs parsing library in C++. Build Run cmake . && make Currently supported CMake configuration flags: BUILD_SHARED_LIBS=<ON|OFF>:

Daniel Trugman 63 Jul 8, 2022
C++ 98/11/14 manual pages for Linux/MacOS

cppman C++ 98/11/14/17/20 manual pages for Linux, with source from cplusplus.com and cppreference.com. Features Supports two backends (switch it with

Wei-Ning Huang 1k Jul 26, 2022
Linux C/C++ 学习笔记、内含视频 + 电子书 + 项目等,专注于 C++ 技术栈!

programming-cpp C++ 方向 一、要不要选择 C++ 二、C++ 选择经历 2.1、上 2.2、下 个人履历 编程学习 C++ 学习笔记 一、汇编 二、Linux 三、C 语言基础 四、C 语言实战 五、数据结构实战 六、C++ 基础 七、STL 八、Boost 库 九、网络编程 十

null 81 Aug 5, 2022
A very small v8 javascript runtime for linux only

Just A very small v8 javascript runtime for linux only Build and Run Currently working on modern linux (debian/ubuntu and alpine teste

theanarkh 9 Nov 8, 2021
Linux 源码分析

alinux Linux 源码分析 本项目地址 欢迎大家以 Markdown 的形式提交有关硬件内容的 PR!!! 配置开发环境 克隆代码,执行命令 git clone https://github.com/StevenBaby/alinux.git 然后可以在 devel 目录执行 make b

Steven 17 Jun 27, 2022
A simple floating clock for Linux

Hoverclock Hoverclock is a simple, yet customizable floating clock for Linux created with QT. Table of contents General info Technologies Quick note U

Kostoski Stefan 14 May 20, 2022
Linux Network Programming in Modern C++

Linux Network Programming in Modern C++ Starter code for network programming in the Linux environment, providing wrapper classes written in modern C++

Francis Y. Yan 13 Feb 7, 2022
The C++ Core Guidelines are a set of tried-and-true guidelines, rules, and best practices about coding in C++

The C++ Core Guidelines are a collaborative effort led by Bjarne Stroustrup, much like the C++ language itself. They are the result of many person-years of discussion and design across a number of organizations. Their design encourages general applicability and broad adoption but they can be freely copied and modified to meet your organization's needs.

Standard C++ Foundation 35k Aug 8, 2022
Welcome to my dungeon. Here, I keep all my configuration files in case I have a stroke and lose all my memory. You're very welcome to explore and use anything in this repository. Have fun!

Fr1nge's Dotfiles Welcome to my dungeon. Here, I keep all my configuration files in case I have a stroke an d lose all my memory. You're very welcome

Fr1nge 32 Apr 16, 2022
This repository contains notes and starter code for Bit manipulation and mathematics session for DSA bootcamp organized by Codeflows.

Bitmanipulation_maths This repository contains notes and starter code for Bit manipulation and mathematics session for DSA bootcamp organized by Codef

Joe 7 Jun 15, 2022
cpp fundamentals and questions for beginners and intermediates

DSA 60 days Hi people! So we have started grasping dsa concepts and solving problems from 12 July. And we shall continue till September 10 Starting fr

Sushree Satarupa 202 Aug 6, 2022
A demonstration of implementing, and using, a "type safe", extensible, and lazy iterator interface in pure C99.

c-iterators A demonstration of implementing, and using, a "type safe", extensible, and lazy iterator interface in pure C99. The iterable is generic on

Chase 62 Jul 26, 2022
About Write a program to create a circular doubly linked list and perform insertions and deletions of various cases

Write a program to create a circular doubly linked list and perform insertions and deletions of various cases Circular Doubly Linked List Circular Dou

MH Miyazi 3 Aug 28, 2021
This repository aims to solve and create new problems from different spheres of coding. A path to help students to get access to solutions and discuss their doubts.

CPP-Questions-and-Solutions ?? This repository aims to solve and create new problems from different spheres of coding, which will serve as a single po

null 49 Jul 27, 2022
The Repository Contains all about Data Structure and Algorithms with Practice problems, series, and resources to follow!

?? The Complete DSA Preparation ?? This repository contains all the DSA (Data-Structures, Algorithms, 450 DSA by Love Babbar Bhaiya,STriver Series ,FA

Pawan Roshan Gupta 6 Jan 8, 2022
Starting with OpenCV and Qt on MacOS is a bit of difficult if you haven't installed and used libraries in XCode.

OpenCV and Qt on MacOS Introduction Starting with OpenCV and Qt on MacOS is a bit of difficult if you haven't installed and used libraries in XCode. T

Martin Kersting 1 Nov 18, 2021
A place where you can learn and practise various Problems and algorithms

Problem-Solving Problem solving is an art of solving some real time challenges. And this is a place to get started, you can find many problems to solv

Google DSC, GVP Chapter 10 Apr 22, 2022
This repo is created to post all my codes and learning of C++ and DSA in C++

This is a readme file where you can read some documentaton about learning on c++and Data Structures and algorithms . I will be posting each and every

BIPIN GHIMIRE 6 Jul 27, 2022