Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Internals
  New Posts New Posts RSS Feed - Sysmon 6 doesn't filter FileCreateTime
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Sysmon 6 doesn't filter FileCreateTime

 Post Reply Post Reply
Author
Message
PierreKa View Drop Down
Newbie
Newbie
Avatar

Joined: 03 March 2017
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote PierreKa Quote  Post ReplyReply Direct Link To This Post Topic: Sysmon 6 doesn't filter FileCreateTime
    Posted: 03 March 2017 at 10:35am
Hello,
With sysmon i receive an eventid:
File created:
UtcTime: 2017-03-03 07:45:12.846
ProcessGuid: {c1ec32d1-1f03-58b9-0000-00107b02ac0a}
ProcessId: 27480
Image: C:\Program Files\System Center Operations Manager\Agent\MonitoringHost.exe
TargetFilename: C:\Program Files\System Center Operations Manager\Agent\Health Service State\Monitoring Host Temporary Files 14022\11725\DiscoverSQL2008DB.vbs
CreationUtcTime: 2017-03-03 07:45:12.846
I configure exclude rule which doesn't work:

<FileCreateTime onmatch="exclude">
	**<!--SECTION: MyOwnSection-->**
	<Image condition="image">C:\Program Files\System Center Operations Manager\Agent\MonitoringHost.exe</Image>
	<Image condition="end with">C:\Program Files\System Center Operations Manager\Agent\MonitoringHost.exe</Image>
</FileCreateTime>
Question: What's the right method of filtering processes by specifying their image for events of type: FileCreateTime
Back to Top
c_APT_ure View Drop Down
Newbie
Newbie


Joined: 06 March 2017
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote c_APT_ure Quote  Post ReplyReply Direct Link To This Post Posted: 06 March 2017 at 4:59pm
Can you post a "Sysmon.exe -c" output?

Also, for testing you might try the following to see if it works:
<Image condition="contains">\MonitoringHost.exe</Image>

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 11.06
Copyright ©2001-2016 Web Wiz Ltd.