Sysmon 10.42

Evgeny Kuzmin 1

Hello.
We are using Sysmon 10.42 and faced the problem of a long launch of published applications from Citrix. We also use antivirus McAfee Endpoint Security 10.7. Sysmon has been added to exceptions, but there are suggestions that blocking occurs.
Could you help or maybe there are recommendations for setting up Sysmon?

Thank you.

dstaulcu 351 Reputation points

2020-12-06T19:44:05.217+00:00

Does the problem persist with sysmon v12.03 installed?

Have you tried narrowing down the problem to a specific sysmon event type like DriverLoad or ImageLoad or CreateRemoteThread or PipeEvent (prime suspects in up to 10.42) through iterative reduction of enabled event types in your sysmon configuration?
Evgeny Kuzmin 1 Reputation point

2020-12-07T08:01:07.93+00:00

we have a lot of where this Sysmon 10.42 is deployed.
Disabling DriverLoad and ImageLoad helps. And still the launch time of published applications is quite long.
Maybe there are any recommendations for Citrix?
dstaulcu 351 Reputation points

2020-12-08T16:24:33.67+00:00

Please report on whether problem persists with sysmon v12.03. While 10.42 seemed pretty stable in environments which included Citrix, it's not really worth time of others to debug a code base that is a year old and has had many issues addressed in versions since.

Do you have CheckRevocation enabled in Sysmon? If so, for DriverLoad and ImageLoads, Sysmon will check the signing certificate revocation status of any driver you don't exclude. If your Citrix clients are not internet connected, this can create performance problems.

Check out section header comments in the SwiftOnSecurity sysmon-config project configuration xml file for great advice on performance issues to watch out for.