![](\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2013\/03\/winb.jpg\")
[German]Microsoft employee Mark Russinovich released his Sysinternals tool Sysmon in version 11.0 on April 28, 2020. Here is some information about it. And also a look how the whole thing looks like from a security point of view.<\/p>\n[German]Microsoft employee Mark Russinovich released his Sysinternals tool Sysmon in version 11.0 on April 28, 2020. Here is some information about it. And also a look how the whole thing looks like from a security point of view.<\/p>\n
<\/p>\n
Version 11.0 is, according to the changelog<\/a>, a major update. File delete monitoring has been addes. The aim is to log such operations performed by malware or ransomware at least to help responders capture attacker tools.<\/p>\n In version 11.0 there is also an option to disable reverse DNS lockup). And empty fields are replaced by a '-' to avoid a WEF (Windows Event Forwarding Problem) error.<\/p>\n The new version also fixes an issue that caused some ProcessAccess events to be aborted. Furthermore, the new version of Sysmon no longer hashes the main data streams marked as stored in the cloud.<\/p>\n Sysmon does not have its own interface like Processmon, but it installs both a system service and a device driver under Windows. The necessary call options for installation are described in detail on the Sysmon page<\/a>.<\/p>\n After the installation the driver and the system service remain persistent on the system. The device driver then records the system activities that are logged by the service in the Event Viewer. This includes detailed information about creating processes and network connections as well as changes in file system object creation times.<\/p>\n Administrators can then use the Windows Event Viewer to view the entries in the event log. In addition, SIEM (Security information and event management<\/a>) solutions can be used to capture and analyze the event viewer. The goal is to detect malicious or anomalous activities through subsequent analysis and to understand how intruders and malware act in the network in the event of an attack.<\/p>\n The Sysinternals Tools are available for free download from this website<\/a>. On the Sysmon page<\/a> you can download the tool. There you can also find extensive documentation on how to install and uninstall Sysmon. Furthermore the range of functions is described.<\/p>\n (Source: YouTube<\/a>)<\/p>\n In the video above Marc Russionvich presents the April 2020 updates for the Sysinternals tools. Sysmon is also briefly discussed there.<\/p>\n As ingenious as the Sysinternals tools are, there's a 'dark side' I like to mention. To say it with the words of security researcher Stefan Kanthak: Russinovich is resistant to suggestion and has beginner's mistakes with his stuff.<\/p>\n For some time now I have started to run various tools advertised in blogs and websites in my security a testbed. The goal is to find out if these Windows programs are vulnerable to DLL hijacking. Executing the Sysmon program within my test bed produced a stack of warning dialogs – as shown below.<\/p>\n The program calls a number of required DLLs when it is started, without taking care about the path from where the library files are loaded. By default the required DLLs are located in the Windows subfolder system32<\/em> and should be loaded from there. However, if the programmer does not take this into account, Windows first searches the folder from which the main program was launched for DLLs with the appropriate name.<\/p>\n This is of course especially good for a tool like Sysmon, since its service and the device driver must be installed with administrator privileges under Windows. Malware that suspectedly stores DLL files with the same name in the program folder (in this case I the used my download folder), would thus receive administrative permissions when loading the DLLs in a piggyback manner.<\/p>\n Well, it's not rocket science to avoid DLL hijacking and it isn't completely unknown. Already in 2010 Microsoft has published the Security Advisory KB2269637 (Insecure Library Loading Could Allow Remote Code Execution) and the Advisory KB2533623<\/a>, after security researchers pointed out the potential vulnerability.<\/p>\n And there is this article<\/a> from Microsoft with recommendations on how developers can avoid this vulnerability in their code. This includes that when using API functions like LoadLibrary, LoadLibraryEx, CreateProcess<\/em> or ShellExecute<\/em>, a developer simply need to use a fully qualifying path (e.g. of the type %windir%\/system32\/<\/em>) in the required DLL name. This forces Windows to disable the default search for loading a DLL and to load it cleanly from the desired target folder.<\/p>\n This doesn't bother Mark Russinovich at all, although German security researcher Stefan Kanthak – at least as far as I know – pointed this problem out to him several times. Just to mention:\u00a0 had pointed out the same vulnerability to the developer of the AdwCleaner offered by Malwarebytes. Within a few hours I received a corrected version that no longer had this DLL hijacking vulnerability (see AdwCleaner 8.0.1 closes a DLL Hijacking vulnerability<\/a>).<\/p>\n The test bed is provided by German security researcher Stefan Kanthak, who deals with such security issues. You can download the file Forward.cab<\/a> from his website and unzip it with Windows Explorer into a folder (I called it Test). There is also a Sentinel.exe<\/a> which also moves into this folder.<\/p>\n If a virus raises an alarm visiting the Kanthak website: It's a test. Kanthak delivers the Eicar test virus in a data block attribute on its website to test whether browsers evaluate it and load it into memory for execution. A virus scanner should then be activated.<\/p>\n Copy the (portable) program to be tested into the testbed's folder instrumented with the DLL files and execute the application. If none of the messages shown above are present, the tested application most likely has no DLL hijacking vulnerabilities. If you got a warning, the tool comes with a DLL hijacking vulnerability and I would avoid using it anymore without additional measures. Unfortunately this isn't a single case I found in Microsoft software.<\/p><\/blockquote>\n Similar articles:<\/strong> [German]Microsoft employee Mark Russinovich released his Sysinternals tool Sysmon in version 11.0 on April 28, 2020. Here is some information about it. And also a look how the whole thing looks like from a security point of view.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1547,22,2],"tags":[2409,1499,195],"class_list":["post-14287","post","type-post","status-publish","format-standard","hentry","category-software","category-update","category-windows","tag-sysinterals","tag-sysmon","tag-update"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/14287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=14287"}],"version-history":[{"count":2,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/14287\/revisions"}],"predecessor-version":[{"id":35936,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/14287\/revisions\/35936"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=14287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=14287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=14287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The Sysinternals tools are a small collection of helpful tools for Windows (Windows 7 and later), which Microsoft employee Mark Russinovich offers for free and updates from time to time. An overview of all tools can be found on the Sysinternals tools website<\/a>.<\/p>\n
Sysmon v11.0, what's new?<\/h2>\n
What do you need Sysmon for?<\/h2>\n
Where can I get details and download?<\/h2>\n
The dark side:\u00a0 DLL-Hijacking on board<\/h2>\n
What we are talking about exactly?<\/h3>\n
![\"Sysmon](\"https:\/\/i.imgur.com\/1IixtAM.jpg\" "\\"Sysmon")
<\/p>\nSome more background information<\/h3>\n
\nMalwarebytes AdwCleaner 8.0<\/a>
\nMalwarebytes AdwCleaner 8.0, a 2nd view<\/a>
\nAdwCleaner 8.0.1 closes a DLL Hijacking vulnerability<\/a>
\nDLL hijacking vulnerabilities in Nirsoft tools<\/a>
\nRealtek closes a DLL Hijacking Vulnerability in HD Audio driver<\/a>
\nEdge and its poor installer security<\/a>
\nMicrosoft Teams and it's security<\/a>
\nMcAfee patches vulnerability in antivirus products<\/a>
\nWarning: Avoid NVTrimmer for Nvidia driver customization<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"