Internet Explorer 11 and Sysmon Mark of the Web RRS feed

  • Question

  • Description

    I was testing the new features from Sysmon 11.10, event id 15 FileCreateStreamHash. But it seems like when a file is being downloaded from Internet Explorer 11, it does not provide the same Mark of the Web as if you download it from modern browsers such as Edge.

    Is this an expected behavior or is that IE 11 needs extra configuration in order to track down this information?

    Thanks for your help.

    Tuesday, June 30, 2020 5:31 PM