Why is there still no user SID in Sysmon Event id 1? Are you planning to add this field?(Perhaps this is some ancient legend that I have not heard).
Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.
1 Person is following this question.
Installing Sysmon application using SCCM
Sysmon - not logging "Pipe created" events (Event 17)
Sysmon 12.03 - FileDelete rules on Win2008 R2 cause Sysmon to crash
Inquiry about nesting Sysmon rule groups