Blog Post

Sysinternals Blog
1 MIN READ

Sysmon v15.11

Alex_Mihaiuc's avatar
Alex_Mihaiuc
Icon for Microsoft rankMicrosoft
Nov 13, 2023
Sysmon v15.11 This update to Sysmon resolves a bug resulting in spurious error events.  
Published Nov 13, 2023
Version 1.0
Alex_Mihaiuc's avatar
Alex_Mihaiuc
Icon for Microsoft rankMicrosoft
Dec 06, 2023

ScottWilbers this behavior may be caused by trying to uninstall Sysmon with the new Sysmon binary, as opposed to the one used for installing.

 

To manually remove the driver (and service), just delete the autostart keys for the driver and the service, from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services: Sysmon64 and SysmonDrv. Then reboot (so that the driver stays unloaded) and also delete the binaries from C:\Windows: Sysmon64.exe and SysmonDrv.sys.

The new install will work after this - but go directly to v15.11, it has improvements.