system monitoring Archives

Winsage

November 19, 2025

Sysmon – Go-to Tool for IT Admins, Security Pros, and Threat Hunters Coming to Windows

Microsoft will integrate native System Monitor (Sysmon) functionality into Windows 11 and Windows Server 2025, enhancing security operations for IT teams. This integration will provide instant threat visibility, automate compliance through Windows Update, and include features such as process monitoring, network connection tracking, credential access detection, file system monitoring, process tampering detection, WMI persistence tracking, and custom configuration support. It will also offer official customer service support and allow seamless access to events through Windows Event Logs or Security Information and Event Management (SIEM) systems. Administrators can enable Sysmon using the command "sysmon -i." Future plans include expanding Sysmon’s capabilities with enterprise-scale management and AI-powered detection.

Winsage

November 18, 2025

Microsoft Finally Makes Sysmon Native To Windows

Sysmon is a system monitoring tool that traditionally requires users to download and install it from Microsoft's Sysinternals page, often leading to its deployment only after issues arise. Pre-installing Sysmon can enhance proactive monitoring and issue diagnosis. Its effectiveness can be improved through tailored configurations, with resources available from Bleeping Computer for specific use cases like monitoring DNS queries. Additionally, Sysmon can now be installed on Linux systems via the Windows Subsystem for Linux (WSL), increasing its accessibility and versatility for users familiar with Sysmon.

Winsage

November 17, 2025

Custom Windows Event Viewer log notifications upped my debugging game

Windows Task Scheduler can be configured to monitor system events and send notifications for anomalies, allowing users to proactively address issues before they escalate. Users can set up custom notifications by specifying Event IDs in the Task Scheduler. Common Event IDs for debugging include: - Application crash: Event ID 1000 (Application Error) - Application hang: Event ID 1002 (Application Hang) - Service failure: Event ID 7000 (Service Control Manager) - Service stopped: Event ID 7036 (Service Control Manager) - Disk/I/O issues: Event ID 129 (Disk or NTFS) - Group policy failure: Event ID 1058 (Microsoft-Windows-GroupPolicy) - Driver error: Event ID 7023 (Service Control Manager or Kernel-PnP) - Failed logon: Event ID 4625 (Microsoft-Windows-Security-Auditing) - User account locked out: Event ID 4740 (Microsoft-Windows-Security-Auditing) - Audit log cleared: Event ID 1102 (EventLog) - Unexpected system shutdown: Event ID 41 (Kernel-Power) To set up notifications, users can create a PowerShell script that performs specific actions based on the event type, such as sending an email for critical alerts or displaying on-screen messages for less critical events. This setup enables effective monitoring without the need for third-party applications.

Tech Optimizer

November 13, 2025

Hackers Using RMM Tools LogMeIn and PDQ Connect to Deploy Malware as Legitimate Software

Cybersecurity researchers at AhnLab Security Intelligence Center (ASEC) have discovered an attack campaign that uses legitimate Remote Monitoring and Management (RMM) tools, specifically LogMeIn Resolve and PDQ Connect, to deploy backdoor malware on users' systems. Attackers lure victims to fake download sites that mimic legitimate software pages for utilities like Notepad++, 7-Zip, and VLC Media Player, delivering modified versions of LogMeIn Resolve. The malicious installers are disguised with filenames such as "notepad++.exe" and "chatgpt.exe." Once executed, these files install the RMM tool and additional malware capable of stealing sensitive information. ASEC has identified three CompanyId values associated with the attacks: 8347338797131280000, 1995653637248070000, and 4586548334491120000. The malware, known as PatoRAT, is a Delphi-developed backdoor that gathers system information and has extensive malicious capabilities, including keylogging and remote desktop access. Users are advised to download software only from official websites and verify digital signatures, while organizations should monitor for unauthorized RMM installations and the identified indicators of compromise.

AppWizard

October 20, 2025

Massive AWS outage took down the internet for several hours impacting Reddit, Fortnite, and more

On October 20, a significant internet disruption occurred due to an outage at Amazon Web Services (AWS), affecting platforms like Reddit, Fortnite, Snapchat, Canva, and Apple TV, as well as global government services. The issues began around midnight ET, peaking at 3 AM ET, with over 13,000 users reporting disruptions between 4 AM and noon ET. The outage was caused by a flaw in an internal system monitoring network load balancers within AWS's EC2 network, leading to increased error rates and latency. This incident has raised concerns about the reliance on a single cloud provider for essential internet functions and prompted discussions on the need for multi-region or multi-cloud strategies. Elon Musk criticized AWS, emphasizing the importance of diversification in cloud service providers.

Tech Optimizer

September 20, 2025

Cyberattackers Leverage Trusted Drivers to Disable Antivirus Software and Bypass Security Protocols

A cyberattack on a Brazilian enterprise involved the use of legitimate, digitally signed drivers to disable antivirus solutions and deploy MedusaLocker ransomware. The attackers executed a Bring Your Own Vulnerable Driver (BYOVD) attack by exploiting the ThrottleStop.sys driver, which has a critical vulnerability (CVE-2025-7771) allowing unauthorized memory access. They compromised an SMTP server using valid RDP credentials, extracted user credentials with Mimikatz, and moved laterally across the network. The attackers uploaded and executed an AV killer program and a renamed version of the driver, terminating antivirus processes to facilitate ransomware deployment. The malware targeted major antivirus vendors and employed kernel-level commands to eliminate security processes. Recommendations for defense include multi-factor authentication, hardening RDP access, and implementing layered security measures.

Winsage

July 7, 2025

Oh dear – Microsoft Windows Firewall was found to be complaining about…Microsoft code?

Microsoft has acknowledged an issue with Windows Firewall following the June 2025 preview update of Windows 11 24H2 (KB5060829, OS Build 26100.4484). Users may encounter an error event labeled 'Config Read Failed' with the message 'More data is available' each time they restart their device. Microsoft assures that this does not indicate a malfunction within Windows Firewall and can be disregarded. The issue is linked to a feature under development, and no timeline for a fix has been provided. Additionally, there is another issue affecting the display of Chinese, Japanese, and Korean characters at 96 DPI in Chromium-based browsers, which Microsoft is working on with Google.

Winsage

July 7, 2025

Oh dear – Microsoft Windows Firewall was found to be complaining about…Microsoft code?

Microsoft acknowledged an issue with Windows Firewall following the June 2025 preview update of Windows 11 24H2 (KB5060829), which generates "Config Read Failed" error messages in security event logs. Despite frequent logging upon device restarts, Microsoft stated that this does not indicate a malfunction of Windows Firewall and can be ignored. The issue is linked to an under-development feature, and no resolution timeline has been provided. Additionally, there is a problem with displaying Chinese, Japanese, and Korean characters at 96 DPI in Chromium-based browsers, which Microsoft is working on with Google.

Tech Optimizer

July 7, 2025

Atlassian moved 4 million Postgres databases to AWS Aurora

Atlassian has migrated its database infrastructure to Amazon Web Services’ Aurora, transferring four million Postgres databases that support Jira implementations. The migration involved approximately 3,000 PostgreSQL servers across 13 AWS regions. The move aims to reduce costs, enhance reliability, and improve performance, upgrading the service level agreement from 99.95% uptime on RDS to 99.99% on Aurora. Samsung has postponed the completion of its chip manufacturing plant in Texas due to difficulties in securing customers. Infosys has advised its employees against exceeding nine hours and 15 minutes of work daily to combat burnout. Qantas has acknowledged a cyberattack affecting six million customers and will provide details on the incident's impact. Xerox has acquired Lexmark from Ninestar Corporation for .5 billion. India and Australia are collaborating on a research initiative to improve tracking of submarines and underwater vehicles. JPMorgan Chase has requested to terminate its custom top-level domains, ".CHASE" and ".JPMORGAN." China’s National Space Administration has released images of Earth and the Moon taken by its Tianwen 2 probe.