17th February 2017  By Mike Williams

 

Microsoft Sysinternals has shipped Sysmon 6.0, a powerful system monitor for Windows.

 

The new release can log processes which are accessing other processes, a simple way to detect automated Mimikatz-like credential dumping.

 

Sysmon logs Registry object creates, deletes, value sets and renames, and these all now use "friendly" key names for improved readability.

 New named pipe events ("Pipe Created" and "Pipe Connected") may help you spot communications between separate malware processes.

 

Sysmon configuration changes are now logged as a separate event, making it much more difficult for anyone or anything else to secretly change your setup.

 

Full Article