So they're going to deliver sysmon.exe as a windows optional feature. There's nothing native to it. No config management via GPO or CSP or similar. Nothing. Just replacing the scheduled task/powershell script downloading exe and config by one enabling the feature and downloading the config.
this post was submitted on 22 Nov 2025
3 points (100.0% liked)
blueteamsec
549 readers
13 users here now
For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.
founded 2 years ago
MODERATORS