olafhartong / ta-sysmon-deploy Goto Github PK

View Code? Open in Web Editor NEW

31.0 8.0 13.0 961 KB

Deploy and maintain Symon through the Splunk Deployment Sever

License: MIT License

Batchfile 100.00%

sysmon splunk-deployment splunk dfir threat-hunting

ta-sysmon-deploy's Issues

update.bat not updating sysmon config

Hi there,

I have altered my sysmon config on my deployment server within the TA-Sysmon-deploy but when the new config gets pushed out to clients sysmon on the endpoint doesn't get updated with the new config.

I can see the endpoint gets the new the configuration file copied to C:\Windows but sysmon continues to use the previous configuration still.

I haven't altered the update.bat script.

Any idea why it's not updating Sysmon on the endpoint with the new config?

Thanks

Multiple issues with deploy.bat scritp

Deploy.bat is not performing as it should be and it causes reinstalling sysmon every time it runs. Few issues:

sysmon.exe is not copied to c:\windows, however check is performed on it :
"FOR /F "delims=" %%b IN ('c:\windows\sysmon.exe ^| FIND /c "System Monitor v11.10"') DO"
"FIND /c "System Monitor v11.10" is hardcoded without a variable, therefore if you are having newer sysmon version it will allways goes to reinstalling sysmon
"if "%CHECK_SYSMON_RUNNIG%" == "1" " is incorrect and will never work because environment variables in batch files are expanded when a line is parsed. In the case of blocks delimited by parentheses (as your if defined) the whole block counts as a "line" or command.
This means that all occurrences of %FOO% are replaces by their values before the block is run. In your case with nothing, as the variable doesn't have a value yet.
To solve this you can enable delayed expansion:
setlocal enabledelayedexpansion
Delayed expansion causes variables delimited by exclamation marks (!) to be evaluated on execution instead of parsing which will ensure the correct behavior in your case:

if not defined BAR (
    set FOO=1
    echo Foo: !FOO!
)

batch issue

Hi,

i was unable to run your script on windows, when i push app. from splunk, he try to install sysmon (because i do not have it installed) and batch breaks with error:

C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin>deploy.bat

C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin>ECHO OFF
'c:\windows\sysmon.exe' is not recognized as an internal or external command,
operable program or batch file.

Usage:
Install:                 C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -i [<configfile>]
Update configuration:    C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -c [<configfile>]
Install event manifest:  C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -m
Print schema:            C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -s
Uninstall:               C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -u [force]
  -c   Update configuration of an installed Sysmon driver or dump the
       current configuration if no other argument is provided. Optionally
       take a configuration file.
  -i   Install service and driver. Optionally take a configuration file.
  -m   Install the event manifest (done on service install as well).
  -s   Print configuration schema definition of the specified version.
       Specify 'all' to dump all schema versions (default is latest).
  -u   Uninstall service and driver. Adding force causes uninstall to proceed
       even when some components are not installed.

The service logs events immediately and the driver installs as a boot-start driver to capture activity from early in the boot that the service will write to the event log when it starts.

On Vista and higher, events are stored in "Applications and Services Logs/Microsoft/Windows/Sysmon/Operational". On older systems, events are written to the System event log.

Use the '-? config' command for configuration file documentation.More examples are available on the Sysinternals website.

Specify -accepteula to automatically accept the EULA on installation, otherwise you will be interactively prompted to accept it.

Neither install nor uninstall requires a reboot.

is there error in script?
what in case where there is not installed sysmon, does he install it?

tnx.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.