DISABLE ARCHIVES SYSMON

Question

DISABLE ARCHIVES SYSMON

arshaad S 0

WOULD YOU BE ABLE TO PLEASE ADD AN OPTION ON SYSMON TO DISABLE THE ARCHIVES BECAUSE THIS IS TAKING UNLIMITED STORAGE ON OUR SYSTEMS. ALSO YOU HAVE PUT A RESTRICTION AND WE CANNOT EASILY DO A CLEANUP.

THIS OPTION IS NICE BUT YOU SHOULD CONSIDER THE IMPACT WHEN MAKING SUCH A CHANGE! THANK YOU TO ADD AN OPTION TO DISABLE THE ARCHIVES ON A FUTURE RELEASE.

KINDLY GIVE US AN ESTIMATE FOR THIS FIX!

Rogers 0

https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

ArchiveDirectory	String	Name of directories at volume roots into which copy-on-delete files are moved. The directory is protected with a System ACL (you can use PsExec from Sysinternals to access the directory using psexec -sid cmd). Default: Sysmon


Event ID 23: FileDelete (File Delete archived)
A file was deleted. Additionally to logging the event, the deleted file is also saved in the ArchiveDirectory (which is C:\Sysmon by default). Under normal operating conditions this directory might grow to an unreasonable size - see event ID 26: FileDeleteDetected for similar behavior but without saving the deleted files.

Event ID 28: FileBlockShredding
This event is generated when Sysmon detects and blocks file shredding from tools such as SDelete.


Dump the current configuration:
sysmon -c

sysmon -c c:\windows\config.xml

23


On Vista and higher, events are stored in Applications and Services Logs/Microsoft/Windows/Sysmon/Operational, and on older systems events are written to the System event log. Event timestamps are in UTC standard time.
Sysmon tag and filters are under the EventFiltering tag.


<Sysmon schemaversion="4.82">
  <!-- Capture all hashes -->
  <HashAlgorithms>*</HashAlgorithms>
  <EventFiltering>
    <!-- Log all drivers except if the signature -->
    <!-- contains Microsoft or Windows -->
    <DriverLoad onmatch="exclude">
      <Signature condition="contains">microsoft</Signature>
      <Signature condition="contains">windows</Signature>
    </DriverLoad>
    <!-- Do not log process termination -->
    <ProcessTerminate onmatch="include" />
    <!-- Log network connection if the destination port equal 443 -->
    <!-- or 80, and process isn't InternetExplorer -->
    <NetworkConnect onmatch="include">
      <DestinationPort>443</DestinationPort>
      <DestinationPort>80</DestinationPort>
    </NetworkConnect>
    <NetworkConnect onmatch="exclude">
      <Image condition="end with">iexplore.exe</Image>
    </NetworkConnect>
  </EventFiltering>
</Sysmon>


https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-filtering-entries


<NetworkConnect onmatch="exclude">
  <Image condition="contains">iexplore.exe</Image>
</NetworkConnect>

Adding proper excludes like above to configuration, shall get you further along. Which of the event flags is triggering your main overflow?

arshaad S 0 Reputation points

2023-07-25T05:28:34.1266667+00:00

We does not understand the configuration file as it is complex. There is a line <ArchiveDirectory>Sysmon</ArchiveDirectory> on the configuration file. I believe it would have been great if this is left blank, no deleted files are saved. Or add another line to disable it without additional configuration. For example <DisableArchiveDirectory>Yes</DisableArchiveDirectory>.

We hope you will understand that this feature is representing a major issue and require a more easy fix than to read a complex configuration file and fixing it one by one.

1 answer

Your answer

arshaad S 0 Reputation points

2023-07-25T05:28:34.1266667+00:00

We does not understand the configuration file as it is complex. There is a line <ArchiveDirectory>Sysmon</ArchiveDirectory> on the configuration file. I believe it would have been great if this is left blank, no deleted files are saved. Or add another line to disable it without additional configuration. For example <DisableArchiveDirectory>Yes</DisableArchiveDirectory>.

We hope you will understand that this feature is representing a major issue and require a more easy fix than to read a complex configuration file and fixing it one by one.

Answer 1

arshaad S 0

............................................

Share via

DISABLE ARCHIVES SYSMON

1 answer

Your answer