Question regarding Sigcheck about lme HOT 4 CLOSED

Sorry, I accidentally labelled it as a bug.

from lme.

Sigcheck is used to check the versions of Sysmon available and deployed.
We cannot use Sysmon to determine the hash before Sysmon is installed, also without running the centrally stored version of Sysmon we are unable to get the filehash from Sysmon so we use Sigcheck for this.

from lme.

In addition, I think we used it to check the version number of the sysmon binary (the one in the binary header). We didn’t want every machine pulling down sysmon once a day to check if it had changed, for network bandwidth and unintentional DDoS reasons. Instead, we tested and sigcheck appears to be using windows networking to just read the file version, so takes minimal bandwidth. If we see the number change, then we pull it down. We can’t do this for the config xml, so pull that down and hash but it’s about 100kb.

from lme.

Thanks for that! it makes sense to use sigcheck.

from lme.