Issues

• Any event type with no include element and two or more exclude elements is silently dropped entirely.

  olafhartong/sysmon-modular#232 · Filter by author beratyntn opened on Oct 8, 2026

• Generated Sysmon 15.21 config creates multiple DriverLoad exclude blocks seems to prevent Event ID 6 generation

  olafhartong/sysmon-modular#226 · Filter by author LiorKagan opened on Sep 25, 2026

• MDE-augment configuration config is missing

  olafhartong/sysmon-modular#225 · Filter by author wheremeltwinds opened on Sep 22, 2026
  1

• Three silent config issues: begin with with ; lists (3 detections inert), PipeEvent catch-all shadows named rules, contains Identities over-matches

  olafhartong/sysmon-modular#223 · Filter by author chefm4tt opened on Jul 29, 2026
  1

• WMI Event Subscription events (EID 19/20/21) tagged T1047 instead of T1546.003

  olafhartong/sysmon-modular#220 · Filter by author jeremiah-onyema opened on Jun 21, 2026

• c:\sysmon filling up

  olafhartong/sysmon-modular#218 · Filter by author krandill opened on Jan 6, 2026

• svchost exclusion

  olafhartong/sysmon-modular#215 · Filter by author krandill opened on Nov 13, 2025

• Alternate data streams removal issue

  olafhartong/sysmon-modular#212 · Filter by author ivodelver opened on Feb 25, 2025
  1

• typo event 13 T1562.002 Disable Windows Event Logging

  olafhartong/sysmon-modular#209 · Filter by author PSMdeJong opened on Oct 8, 2024

• Suggested addition to ProcessAccess event, for MS Intune

  olafhartong/sysmon-modular#208 · Filter by author cyb3rxp opened on Oct 7, 2024

• FileDelete Issue, cannot remove C:\Sysmon locked .dlls

  olafhartong/sysmon-modular#200 · Filter by author deathrig07 opened on Mar 19, 2024
  4

• Config causing 35 second delay opening modern MS Office file formats (.docx & .xlsx etc)

  olafhartong/sysmon-modular#199 · Filter by author smogm opened on Mar 8, 2024
  1

• Error 255 appears, please help me figure it out.

  olafhartong/sysmon-modular#198 · Filter by author h3nkbleck opened on Mar 1, 2024
  2

• Incorrect rule format?

  olafhartong/sysmon-modular#197 · Filter by author 3ch035 opened on Feb 26, 2024

• User condition in exclusions for RegistryEvents

  olafhartong/sysmon-modular#196 · Filter by author schwf5 opened on Feb 7, 2024

• Exclusion Trend Micro WFBS

  olafhartong/sysmon-modular#194 · Filter by author s3-schneider opened on Dec 21, 2023

• Duplicates

  olafhartong/sysmon-modular#193 · Filter by author PiRomant opened on Nov 24, 2023

• KAV exclusion

  olafhartong/sysmon-modular#190 · Filter by author PiRomant opened on Nov 3, 2023

• XML Issue with sysmonconfig-excludes-only.xml

  olafhartong/sysmon-modular#187 · Filter by author jvossler opened on Oct 11, 2023

• Suggested additions to Microsoft Defender ProcessCreation event

  olafhartong/sysmon-modular#185 · Filter by author cyb3rxp opened on Aug 21, 2023

• Suggested additions to TrendMicro ProcessCreation event exclusion

  olafhartong/sysmon-modular#184 · Filter by author cyb3rxp opened on Aug 21, 2023

• Super verbose config missing from Azure Pipelines

  olafhartong/sysmon-modular#178 · Filter by author Korving-F opened on Jul 28, 2023

• Event ID 8 - CreateRemoteThread - Appends to bottom of config

  olafhartong/sysmon-modular#173 · Filter by author Cyber74-Brian-McCaleb opened on May 24, 2023

• Repo Folder index

  olafhartong/sysmon-modular#168 · Filter by author afg-jmck opened on Mar 6, 2023

• Sysmon 14.14 - Anti-Tamper Controls?

  olafhartong/sysmon-modular#167 · Filter by author bmcmahon-fa opened on Feb 27, 2023
  3