Using Sysinternals Sysmon 8.0.0? Update to 8.0.4

[German]A quick tip for admins who use Sysmon from the Sysinternals system monitoring tools. There is a memory leak in version 8.0.0, which has been fixed in the updated version 8.0.4.


A quick look at Sysmon

Sysmon is part of the free Sysinternals tools from Microsoft. The tool is very helpful for system analysis. According to the description it provides the following functionality:

System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor system activity and log it to the Windows Event Log. 

Sysmon provides detailed information about network connections, process creation and file creation time changes. By collecting and analyzing the events generated by Sysmon using Windows Event Collection or SIEM agents, malicious or abnormal activities can be identified to understand how intruders and malware work on the network.

However, Sysmon cannot perform an analysis of the events it generates, nor can it protect itself from attackers or hide itself.

A memory leak in Sysmon 8.0.0/8.0.2

Bleeping Computer reported here about an issuenin Sysmon 8.x. There is a memory leak in Sysmon 8.0.0 utility (and probably in 8.0.2) that could cause a computer to run out of memory. Then the computer crashes when it routinely updates its configuration file with a scheduled task or otherwise. The bug has been discussed within this forum thread since summer 2018. It is only noticed when Sysmon runs for a very long time (30 days) in server environments.

User @iostorrm points out the memory leak in Sysmon 8.0.0 and possibly 8.0.2 in the tweet above. He recommends upgrading to Sysmon 8.0.4, and Marc Russinovich wrote on December 19, 2018 that the memory leak has been fixed in this release. The new version was released on 27.12.2018 and can be downloaded from the following linked website.


Download Sysinternals Tools

Cookies helps to fund this blog: Cookie settings

This entry was posted in issue, Software, Update, Windows and tagged , , . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *