Hello,
I might have stumbled across something looking like a bug.
Using the following configuration:
<Sysmon schemaversion="4.40">
<!-- Capture all hashes -->
<HashAlgorithms>*</HashAlgorithms>
<EventFiltering>
<RegistryEvent onmatch="exclude">
</RegistryEvent>
</EventFiltering>
</Sysmon>
The expected behavior based on the documentation is to see events for various registry operation (12,13,14). I can only see 14.
Downgrading the service to sysmon v11.11, schema version 4.32, I see those events I expected to see.
Question: is this a known problem with v12.02 and is there some workaround besides using older sysmon versions?
Thank you,
Bogdan
