Sysmon 12.03 not logging EventID:2 (file creation time modified)

Julien Bachmann 96

Hello,

I just made a test with Sysmon 9.1.0 on a VM and I was able to get file creation time modification events. Upgrading to 12.03 with the same configuration allows to get all the other events except this one.

Test was made using a ps1 script that modifies 100 files using the following:

[System.IO.File]::SetCreationTimeUtc($f.FullName, (Get-Date))

Anyone else with the same issue? We tested on 2 hosts with 12.01 and 12.03 and the result is the same: no EventID:2 event.

Best regards

dstaulcu 351 Reputation points

2020-12-19T19:23:40.43+00:00
Just worked for me with Sysmon v12.03 using schema v4.40 using your method and mine:

$TemporaryFile = New-TemporaryFile (Get-Item -path $TemporaryFile.FullName).CreationTime=("08 March 2016 18:00:00")

Here is my sysmon config:

<Sysmon schemaversion="4.40"> <EventFiltering> <RuleGroup name="" groupRelation="or"> <FileCreateTime onmatch="exclude"> </FileCreateTime> </RuleGroup> </EventFiltering> </Sysmon>

What does your configuration XML and resultant sysmon -c output look like? Configuration xml schema has changed dramatically since 9.1 so you'll likely need adapt your configuration to mainstream schema for optimal support. From schema.xml comparisons between versions, it looks like FileCreateTime ruledefaults have changed from include to exclude.
Julien Bachmann 96 Reputation points

2020-12-23T07:31:11.28+00:00

Indeed, it was working w/o those lines in the configuration before but now we have to add them for the events to be generated.

Thanks!
dstaulcu 351 Reputation points

2020-12-24T02:30:57.05+00:00

Glad to to hear of an easy way forward. Happy holidays!

Accepted answer

Julien Bachmann 96

As mentioned by @dstaulcu , we need the following lines in sysmon config for the events to trigger since schema 4.40

>      <Sysmon schemaversion="4.40">  
>          <EventFiltering>  
>              <RuleGroup name="" groupRelation="or">  
>                  <FileCreateTime onmatch="exclude">  
>                  </FileCreateTime>  
>              </RuleGroup>  
>          </EventFiltering>  
>      </Sysmon>

Share via

Sysmon 12.03 not logging EventID:2 (file creation time modified)

0 additional answers