From 141b89ad231ea514d35a7eead5cced1769db94cd Mon Sep 17 00:00:00 2001 From: Carlos Perez Date: Fri, 10 Jul 2020 12:29:37 -0400 Subject: [PATCH] Remove -A parameter from Sysmon.md Remove -A parameter from Sysmon.md --- Sysmon.md | 228 ++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 162 insertions(+), 66 deletions(-) diff --git a/Sysmon.md b/Sysmon.md index 4beaa6d..6b17319 100644 --- a/Sysmon.md +++ b/Sysmon.md @@ -323,12 +323,6 @@ sysmon.exe -i [configfile path] sysmon.exe -c [configfile path] ``` -* **-a** : Archive Folder - -```shell -sysmon.exe -a [archive folder] -``` - * **-u** : un-install Sysmon ```shell @@ -1639,11 +1633,15 @@ Process of use/abuse of CreateRemoteThread * Use **VirtualAllocEx( )** allocate a chunk of memory in the process. -* Use **WriteProcessMemory( )** write the payload to the newly allocated section. +* Use **WriteProcessMemory( )** write the payload to the newly + allocated section. -* User **CreateRemoteThread( )** to create a new thread in the remote process to execute the shellcode. +* User **CreateRemoteThread( )** to create a new thread in the remote + process to execute the shellcode. -There are multiple Process Injection techniques, Sysmon monitors for the most common one used. The infographic from +There are multiple Process Injection techniques, Sysmon monitors for the +most common one used. The infographic from + Illustrates the different techniques. @@ -1655,15 +1653,19 @@ The fields for the event are: * **UtcTime**: Time in UTC when event was created -* **SourceProcessGuid**: Process Guid of the source process that created a thread in another process +* **SourceProcessGuid**: Process Guid of the source process that + created a thread in another process -* **SourceProcessId**: Process ID used by the OS to identify the source process that created a thread in another process +* **SourceProcessId**: Process ID used by the OS to identify the + source process that created a thread in another process -* **SourceImage**: File path of the source process that created a thread in another process +* **SourceImage**: File path of the source process that created a + thread in another process * **TargetProcessGuid**: Process Guid of the target process -* **TargetProcessId**: Process ID used by the OS to identify the target process +* **TargetProcessId**: Process ID used by the OS to identify the + target process * **TargetImage**: File path of the target process @@ -1671,9 +1673,11 @@ The fields for the event are: * **StartAddress**: New thread start address -* **StartModule**: Start module determined from thread start address mapping to PEB loaded module list +* **StartModule**: Start module determined from thread start address + mapping to PEB loaded module list -* **StartFunction**: Start function is reported if exact match to function in image export tables +* **StartFunction**: Start function is reported if exact match to + function in image export tables Since the number of processes that use the **CreateRemoteThread()** API in a production environment is low, the best approach is to exclude known good processes by their full path. **CreateRemoteThread()** is not the only API call that can be used to create a thread, so it should not be relied on as a definitive guarantee of lack of process injection. @@ -1683,27 +1687,46 @@ Example where known processes that use the API call are excluded ```xml - + - - - - - Google\Chrome\Application\chrome.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\services.exe - C:\Windows\System32\winlogon.exe - C:\Windows\System32\audiodg.exe - C:\windows\system32\kernel32.dll + + + + + + Google\Chrome\Application\chrome.exe + + + C:\Windows\System32\wbem\WmiPrvSE.exe + + + C:\Windows\System32\svchost.exe + + + C:\Windows\System32\wininit.exe + + + C:\Windows\System32\csrss.exe + + + C:\Windows\System32\services.exe + + + C:\Windows\System32\winlogon.exe + + + C:\Windows\System32\audiodg.exe + + + C:\windows\system32\kernel32.dll + ``` + ## Raw Access Read Sysmon will log **EventID 9** for any process trying to read straight from a storage device by bypassing any filesystem restrictions that may be imposed by it. This information is logged by Sysmon leveraging its minifilter. This type of action is only done by drive imaging software or backup software in a normal operating environment. @@ -1751,7 +1774,8 @@ The fields for the event are: * **QueryResults**: Query results * **Image**: File path of the process that made the DNS query -Exclude known destinations in order to focus on new unknown destinations. This is a high-volume event generation filter, so it is recommended to experiment and build rules with filters for your specific environment if implemented. Some examples can be found in +Exclude known destinations in order to focus on new unknown destinations. This is a high-volume event generation filter, so it is recommended to experiment and build rules with filters for your specific environment if implemented. Some examples can be found in + Example that excludes known update and telemetry domains. @@ -1763,46 +1787,118 @@ Example that excludes known update and telemetry domains. - - .mozaws.net - .mozilla.com - .mozilla.net - .mozilla.org - clients1.google.com - clients2.google.com - clients3.google.com - clients4.google.com - clients5.google.com - clients6.google.com - - safebrowsing.googleapis.com - -pushp.svc.ms - .b-msedge.net - .bing.com - .hotmail.com - .live.com - .live.net - .s-microsoft.com - .microsoft.com - .microsoftonline.com - .microsoftstore.com - .ms-acdc.office.com - .msedge.net - .msn.com - .msocdn.com - .skype.com - .skype.net - .windows.com - .windows.net.nsatc.net - .windowsupdate.com - .xboxlive.com - login.windows.net + + + + + .mozaws.net + + + .mozilla.com + + + .mozilla.net + + + .mozilla.org + + + + + clients1.google.com + + + clients2.google.com + + + clients3.google.com + + + clients4.google.com + + + clients5.google.com + + + clients6.google.com + + + safebrowsing.googleapis.com + + + + + + -pushp.svc.ms + + + .b-msedge.net + + + + .bing.com + + + .hotmail.com + + + .live.com + + + .live.net + + + .s-microsoft.com + + + .microsoft.com + + + .microsoftonline.com + + + .microsoftstore.com + + + .ms-acdc.office.com + + + .msedge.net + + + .msn.com + + + .msocdn.com + + + .skype.com + + + .skype.net + + + .windows.com + + + .windows.net.nsatc.net + + + .windowsupdate.com + + + .xboxlive.com + + + login.windows.net + - - + + ``` + ## WMI Events WMI events, both temporary and permanent (survive a reboot), have been used for