admin/trustedsec-SysmonCommunityGuide
1
0
Fork 0
mirror of https://github.com/trustedsec/SysmonCommunityGuide/ synced 2026-06-06 19:46:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #23 from trustedsec/v1.1

Browse Source 
V1.1
This commit is contained in:
Carlos Perez
2020-07-09 16:11:01 -03:00
committed by GitHub
parent 3d98633ac6 c4ec1b6fe6
commit 4025033791
17 changed files with 284 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2
View File
@@ -46,6 +46,8 @@ Table of Contents
* [File Create Time Change](./file-create-time-change.md)
* [File Stream Creation Hash](./file-stream-creation-hash.md)
* [File Delete](./file-delete.md)
* [Named Pipes](./named-pipes.md)
create-remote-thread.md
+32 -14
View File
@@ -69,21 +69,39 @@ Example where known processes that use the API call are excluded
```xml
<Sysmon schemaversion="4.22">
<CheckRevocation/>
<CheckRevocation/>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<CreateRemoteThread onmatch="exclude">
<!--The process activity of those in the list should be monitored since an-->
<!--attacker may host his actions in one of these to bypass detection.-->
<TargetImage condition="end with">Google\Chrome\Application\chrome.exe</TargetImage>
<SourceImage condition="is">C:\Windows\System32\wbem\WmiPrvSE.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\wininit.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\services.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\winlogon.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\audiodg.exe</SourceImage>
<StartModule condition="is">C:\windows\system32\kernel32.dll</StartModule>
<RuleGroup name="" groupRelation="or">
<CreateRemoteThread onmatch="exclude">
<!--The process activity of those in the list should be monitored since an-->
<!--attacker may host his actions in one of these to bypass detection.-->
<TargetImage condition="end with">
Google\Chrome\Application\chrome.exe
</TargetImage>
<SourceImage condition="is">
C:\Windows\System32\wbem\WmiPrvSE.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\svchost.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\wininit.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\csrss.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\services.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\winlogon.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\audiodg.exe
</SourceImage>
<StartModule condition="is">
C:\windows\system32\kernel32.dll
</StartModule>
</CreateRemoteThread>
</RuleGroup>
</EventFiltering>
dns-query.md
+107 -36
View File
@@ -33,42 +33,113 @@ Example that excludes known update and telemetry domains.
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<DnsQuery onmatch="exclude">
<!-- Browser Update Domains-->
<QueryName condition="end with">.mozaws.net</QueryName> <!--Mozilla-->
<QueryName condition="end with">.mozilla.com</QueryName> <!--Mozilla-->
<QueryName condition="end with">.mozilla.net</QueryName> <!--Mozilla-->
<QueryName condition="end with">.mozilla.org</QueryName> <!--Mozilla-->
<QueryName condition="is">clients1.google.com</QueryName> <!--Google-->
<QueryName condition="is">clients2.google.com</QueryName> <!--Google-->
<QueryName condition="is">clients3.google.com</QueryName> <!--Google-->
<QueryName condition="is">clients4.google.com</QueryName> <!--Google-->
<QueryName condition="is">clients5.google.com</QueryName> <!--Google-->
<QueryName condition="is">clients6.google.com</QueryName> <!--Google-->
<!-- Microsoft Domains -->
<QueryName condition="is">safebrowsing.googleapis.com</QueryName> <!--Google-->
<QueryName condition="end with">-pushp.svc.ms</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
<QueryName condition="end with">.b-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
<QueryName condition="end with">.bing.com</QueryName> <!-- Microsoft | Microsoft default exclusion -->
<QueryName condition="end with">.hotmail.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.live.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.live.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.s-microsoft.com</QueryName> <!--Microsoft-->
<QueryName condition="end with">.microsoft.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.microsoftonline.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.microsoftstore.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.ms-acdc.office.com</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
<QueryName condition="end with">.msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
<QueryName condition="end with">.msn.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.msocdn.com</QueryName> <!--Microsoft-->
<QueryName condition="end with">.skype.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.skype.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
<QueryName condition="end with">.windows.com</QueryName> <!--Microsoft-->
<QueryName condition="end with">.windows.net.nsatc.net</QueryName> <!--Microsoft-->
<QueryName condition="end with">.windowsupdate.com</QueryName> <!--Microsoft-->
<QueryName condition="end with">.xboxlive.com</QueryName> <!--Microsoft-->
<QueryName condition="is">login.windows.net</QueryName> <!--Microsoft-->
<!-- Browser Update Domains-->
<!--Mozilla-->
<QueryName condition="end with">
.mozaws.net
</QueryName>
<QueryName condition="end with">
.mozilla.com
</QueryName>
<QueryName condition="end with">
.mozilla.net
</QueryName>
<QueryName condition="end with">
.mozilla.org
</QueryName>
<!--Google-->
<QueryName condition="is">
clients1.google.com
</QueryName>
<QueryName condition="is">
clients2.google.com
</QueryName>
<QueryName condition="is">
clients3.google.com
</QueryName>
<QueryName condition="is">
clients4.google.com
</QueryName>
<QueryName condition="is">
clients5.google.com
</QueryName>
<QueryName condition="is">
clients6.google.com
</QueryName>
<QueryName condition="is">
safebrowsing.googleapis.com
</QueryName>
<!-- Microsoft Domains -->
<!--Microsoft: Doesn't appear to host customer content or subdomains-->
<QueryName condition="end with">
-pushp.svc.ms
</QueryName>
<QueryName condition="end with">
.b-msedge.net
</QueryName>
<!-- Microsoft | Microsoft default exclusion -->
<QueryName condition="end with">
.bing.com
</QueryName>
<QueryName condition="end with">
.hotmail.com
</QueryName>
<QueryName condition="end with">
.live.com
</QueryName>
<QueryName condition="end with">
.live.net
</QueryName>
<QueryName condition="end with">
.s-microsoft.com
</QueryName>
<QueryName condition="end with">
.microsoft.com
</QueryName>
<QueryName condition="end with">
.microsoftonline.com
</QueryName>
<QueryName condition="end with">
.microsoftstore.com
</QueryName>
<QueryName condition="end with">
.ms-acdc.office.com
</QueryName>
<QueryName condition="end with">
.msedge.net
</QueryName>
<QueryName condition="end with">
.msn.com
</QueryName>
<QueryName condition="end with">
.msocdn.com
</QueryName>
<QueryName condition="end with">
.skype.com
</QueryName>
<QueryName condition="end with">
.skype.net
</QueryName>
<QueryName condition="end with">
.windows.com
</QueryName>
<QueryName condition="end with">
.windows.net.nsatc.net
</QueryName>
<QueryName condition="end with">
.windowsupdate.com
</QueryName>
<QueryName condition="end with">
.xboxlive.com
</QueryName>
<QueryName condition="is">
login.windows.net
</QueryName>
</DnsQuery>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
```
driver-loading.md
+1 -1
View File
@@ -3,7 +3,7 @@ Driver Loading
Sysmon will log EventID 6 for the loading of drivers. Drivers have been used by attackers for the installation of rootkits or to run tooling that needs to run at the kernel level. Mimikatz is known to use a driver to perform tasks to query and modify the UFI to bypass process protections.
Sysmon will provide code signing information allowing filtering on those fields. Sysmon can also check if a certificate the driver signed has been revoked.
Sysmon will provide code signing information allowing filtering on those fields. Sysmon can also check if a certificate that signed the driver has been revoked.
A recommended action for this event is to filter on the **Signature** and **SignatureStatus** fields and exclude known drivers. The main reason to filter on both fields is that many of the attacks steal certificates that are later revoked. By confirming that the **SignatureStatus** is valid, we can find easier drivers signed by a vendor who has been forced to revoke that specific signing certificate.
file-create.md
+2 -2
View File
@@ -1,7 +1,7 @@
File Create
===========
Via its filter driver, Sysmon can log the creation of files and information on what process is creating the file using **EventID 11**. This allows defender to filter for:
Via its filter driver, Sysmon can log the creation of files and information on what process is creating the file using **EventID 11**. This allows defenders to filter for:
* Dropping of files for later execution (PowerShell, Office Apps, certutil.exe)
@@ -9,7 +9,7 @@ Via its filter driver, Sysmon can log the creation of files and information on w
* Detection of malicious behaviors that create temporary or log files (.Net compile and run, DotNet2JS)
Since AV minifilter loads before Sysmon (due to the lower altitude number range), if an AV or EDR minifilter driver detects a malicious file and blocks it writing to disk, Sysmon will not see the event.
Since AV minifilters load before Sysmon (due to their lower altitude number range), if an AV or EDR minifilter driver detects a malicious file and blocks it writing to disk, Sysmon will not log the event.
![minifilter](./media/image36.png)
file-delete.md
+76
View File
@@ -0,0 +1,76 @@
File Delete
===========
Via its filter driver, Sysmon can log the creation of files and information on what process is deleting of overwriting the file using **EventID 23**. This allows a defender to filter for:
* Dropper / stager that removes itself after execution (T1193 or T1064 and loads more) or attackers doing it manually
* Wiper software (T1485 and T1488)
* Ransomware (T1486)
![minifilter](./media/image36.png)
### Archive directory
By default this folder is set to Sysmon if no folder is specified during installation and specified either in the configuration either in config file with the ```<ArchiveDirectory>``` setting in XML configurations file or via the registry by setting the registry key value **FilterArchiveDirectory** under the driver registry key paramaters.
On version 11.0 of Sysmon if the folder is not created during install using the commandline **-a \<folder name\>** parameter Sysmon will use the default **Sysmon** folder name and create that one and not the one specified in the configuration. On version 11.1 of Sysmon the parameter was removed and it is now required to specify the folder in the XML configuration file or the default name will be used.
This folder is protected by a SYSTEM ACL, to access it you can use psexec to spawn a shell to access it via ```PsExec.exe -sid cmd```.
```
PS C:\> (Get-Acl C:\Sysmon\).access
FileSystemRights : FullControl
AccessControlType : Allow
IdentityReference : NT AUTHORITY\SYSTEM
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
```
### Event information
The file delete event fields are:
* **RuleName**: Name of rule that triggered the event
* **UtcTime**: Time in UTC when event was created
* **ProcessGuid**: Process Guid of the process that deletec the file
* **ProcessId**: Process ID used by the OS to identify the process that deleted the file (child)
* **Image**: File path of the process that deleted the file
* **TargetFilename**: Name of the file that was deleted
**Hashes**: Full hash of the file with the algorithms in the HashType field. This is also the filename of the saved file in the ArchiveDirectory
* **Archived**: States whether the archival action was succesful
Example monitoring for script file creation by extension:
```XML
<Sysmon schemaversion="4.30">
<ArchiveDirectory>SysmonIsAwesome</ArchiveDirectory>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<Rule groupRelation="or">
<TargetFilename condition="contains">\Downloads\</TargetFilename> <!--Download folder -->
<TargetFilename condition="end with">\Content.Outlook\</TargetFilename> <!--Outlook Temporary Internet files-->
<TargetFilename condition="end with">\AppData\Local\Temp\</TargetFilename>
<TargetFilename condition="end with">\AppData\Local\Microsoft\</TargetFilename> <!--Office temp files-->
<TargetFilename condition="begin with">C:\Windows\Temp</TargetFileName>
</Rule>
<!-- File extension options -->
<TargetFilename condition="contains any">.exe;.ps1;.js;.xls;.xlsm;.docm</TargetFileName>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
```
file-stream-creation-hash.md
+12 -1
View File
@@ -1,7 +1,7 @@
File Stream Creation Hash
=========================
Sysmon will log **EventID 15** for the creation of Alternate Data Streams (ADS). This is an old technique where many vendors already monitor for the creation of ADS on files where the alternate stream is a PE executable. Attackers have changed to use alternate streams to hide information and to store other payloads that are not PE executables (DLL, Scripts).
Sysmon will log **EventID 15** for the creation of Alternate Data Streams (ADS). This is an old technique where many vendors already monitor for the creation of ADS on files where the alternate stream is a PE executable. Attackers have changed to use alternate streams to hide information and to store other payloads that are not PE executables (DLL, Scripts). Sysmon will also capture the contents of text streams if they are less 1KB for the purpose of capturing Mark Of The Web (MOTW) streams.
Each record in NTFS on a drive is subdivided into a list of variable length attributes:
@@ -46,6 +46,13 @@ More execution examples at
<https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f> by
Oddvar Moe
In the case of downloads performed by browsers and email clients in Windows that leveragle the urlmon.dll for downloading files they have al indetifying stream added with information about the download including the URL and Refferer. This information can be used to track the origing of downloaded files by attackers with a console presense or via a phishing attack.
We can use PowerShell Get-Item and Get-Content cmdlets to check is a Zone.Identifier stream exist and show its content.
![process](./media/image63.png)
The fields for the event:
* **RuleName**: Name of rule that triggered the event
@@ -56,11 +63,15 @@ The fields for the event:
* **TargetFilename**: Name of the file
* **CreationUtcTime**: File download time
* **Hash**: Full hash of the file with the algorithms in the HashType field
* **Content**: Contents of text streams.
The number of processes that create alternate streams should be low and easily excluded. Mail clients and browsers are the main generators of this event in normal operation to set the Zone attribute; Because of this, a maintenance process is recommended when leveraging these filters.
![process](./media/image43.png)
Since urlmon.dll sets different parts of the stream as the file is downloaded we see normally a total of 6 events as the data is added to the file. This provides important forensic information to track files that an attacker may have delived and correlated with other networks logs.
Example: Exclude common processes that create alternate data streams.
```xml
install-and-configuration.md
+11 -3
View File
@@ -163,6 +163,8 @@ An XML configuration file can be passed during installation if an initial config
```shell
sysmon.exe -i --accepteula -c <config file>
```
If the configuration specifies a archive folder using the ```<ArchiveDirectory>``` element the **-a \<archive folder\>** needs to be specified in the command line so that Sysmon can create the folder and set the proper permissions. If the folder is not present and even if specified Sysmon will create a folder named **Sysmon** instead and use that folder to archive the deleted files.
We can control the hashing algorithm used for events that hash images and we can control checking of revocation of signatures.
The hashing algorithm or combination of them can be specified with the **-h \<sha1\|sha2\|md5\|imphash\|\*\>** The specified algorithms will be used to hash all images.
@@ -174,7 +176,7 @@ sysmon.exe -i -c -h <sha1|sha2|md5|imphash\|*>
We can specify checking to see if certificates are revoked using the -r parameter.
```shell
sysmon.exe -i -c -r**
sysmon.exe -i -c -r
```
@@ -195,7 +197,7 @@ sysmon.exe -i -c -l [<process,...>]
* **ProcessAccess** - Processes whose memory is accessed.
```shell
**sysmon.exe -i -c -k [<process,...>]**
sysmon.exe -i -c -k [<process,...>]
```
Uninstall
@@ -295,6 +297,12 @@ sysmon.exe -i [configfile path]
sysmon.exe -c [configfile path]
```
* **-a** : Archive Folder
```shell
sysmon.exe -a [archive folder]
```
* **-u** : un-install Sysmon
```shell
@@ -574,7 +582,7 @@ When Sysmon configuration is modified using the Sysmon command line tool, an **E
When a GPO is used to update configuration by default every 90 minutes, the configuration will be updated. A better solution is to use a configuration management solution like DSC that can monitor for changes and update as soon as a change is detected.
Sysmon can be configured to monitor its own conjuration to detect whether an attacker deletes or alters it. In the event that it is cleared, this will be the last event logged by Sysmon itself from its configured filters.
Sysmon can be configured to monitor its own configuration to detect whether an attacker deletes or alters it. In the event that it is cleared, this will be the last event logged by Sysmon itself from its configured filters.
![](./media/image21.png)
media/image5.png
BIN
View File
Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 1.2 MiB

After

Width:  |  Height:  |  Size: 210 KiB

named-pipes.md
+2 -2
View File
@@ -130,5 +130,5 @@ Example excluding known good Pipe Names
```
One thing to consider is that Sysmon uses a minifilter just like the
file events, any AV or EDR with a higher altitude number if it triggers
on the named pipe and block Sysmon will not log the event.
file events. If any AV or EDR with a lower altitude number triggers
on a named pipe and blocks it, Sysmon will not log the event.
network-connections.md
+5 -1
View File
@@ -1,7 +1,11 @@
Network Connections
===================
Sysmon will log **EventID 3** for all TCP and UDP network connections. This event will generate a large number of entries and filtering should be tuned for specific processes and ports. For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering. For the DestinationPortName, the GetNameInfo API is used for the friendly name of ports. In the case of services doing connections on some systems due to memory use, they are hosted under svchost.exe and most connections will originate from this process.
Sysmon will log **EventID 3** for all TCP and UDP network connections. This event will generate a large number of entries and filtering should be tuned for specific processes and ports.
For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering since it uses a reverse DNS Lookup to get this information, in Sysmon v11.0 this behaviour can be disabled by using the ```<DnsLookup>True</DnsLookup>``` at the root of the confifuration file.
For the DestinationPortName, the GetNameInfo API is used for the friendly name of ports. In the case of services doing connections on some systems due to memory use, they are hosted under svchost.exe and most connections will originate from this process.
The fields for the event are:
process-access.md
+3 -13
View File
@@ -1,21 +1,11 @@
Process Access
==============
Sysmon Process Access events will monitor of one process opening
another. The access with higher permissions allows for also reading the
content of memory, patching memory, process hollowing, creations of
threads and other tasks that are abused by attackers. This technique has
been used for access to credentials, keys and data that are in the
process memory.
When one process opens another, sysmon will log this with an event ID of 10. The access with higher permissions allows for also reading the content of memory, patching memory, process hollowing, creations of threads and other tasks that are abused by attackers. This technique has been used for access to credentials, keys and data that are in the process memory.
This task is common for processes that query information on another
process, such as Task Manager, tasklist.exe and others, this requires
that a baseline be stablished and filter out at a SIEM level taking into
consideration other factors like image fullpath, parent process and
account used so as to prevent any whitelisted processes to be used as
staging for attacks.
This task is also common for benign processes that query information on another process, such as Task Manager, tasklist.exe and others, this requires that a baseline be established and filtered out at a SIEM level taking into consideration other factors like image fullpath, parent process and account used so as to prevent any whitelisted processes from being used as staging for attacks.
Sysmon generates this event using ObRegisterCallbacks levering its
Sysmon generates this event using ObRegisterCallbacks leveraging its
driver. The main 2 filtering fields recommended are:
* **TargetImage** - File path of the executable being accessed by
process-events.md
+9 -11
View File
@@ -2,15 +2,9 @@
Process Events
==============
Sysmon can log process creation, process termination and process access
events. The prorocess actions are captured via ObjRegisterCallbacks at
the kernel level using its driver. These events are important since the
**ProcessGuid** field of these events are used by other so as to provide
more context on the process that relates to the actions and the
ProcessGuid maps to the **LogonGuid** that it is then used to track all
actions of a given logon session. The main reason for using this GUIDs
is that Process ID and Logon ID on a system get re-used as time passes.
In the case of processes ID it can happen multiple times in a days.
Sysmon can log process creation, process termination and process access events. The process events are captured via ObjRegisterCallbacks at the kernel level using its driver, and contain a unique, deterministically generated ProcessGuid and LogonGuid that are unique to their process instance and LSA logon session respectively.
The ProcessGuid and LoginGuid make tracking individual process and users much easier. The ProcessGuid attribute is used in all events associated with its process, and, unlike a ProcessID, will not be reused by the host system later. The LogonGuid attirbute similarly is assigned to a login session of a particular user, and will not be reused later as a LoginID would.
![ProcessGUID Source](./media/image31.png)
@@ -22,11 +16,15 @@ they will have 2 Logon IDs assigned if:
* UAC (User Access Control) is enabled.
These sessions will be linked by a Linked Login ID in Successful Logon
Event ID 4624, making the login of this event important.
Event ID 4624, making the logging of this event important.
The ProcessGUID depending on the event and where in the process tree it
is, it will also be known by other names by its relation to the action
monitored
monitored.
ProcessGUID is generated by Sysmon when Sysmon logs the event. ProcessGUID
specifically is not an attribute of the internal Windows process data structs
(EPROCESS). Sysmon keeps track of the GUID until the process exits.
![ProcessGUID Relation](./media/image32.png)
registry-actions.md
+3 -2
View File
@@ -1,13 +1,14 @@
Registry Actions
================
Sysmon has the capability to monitor for three major actions against Registry
Sysmon has the capability to monitor for three major actions against the Registry
* **EventID 12** - Registry object added or deleted
* **EventID 13** - Registry value set
* **EventID 14** - Registry object renamed
The Windows Registry has been a source of information gathering, persistence, storage, and configuration control for attackers since its wider use introduction in Windows NT 4.0/Windows 95.
Sysmon uses abbreviated versions of Registry root key names, with the following mappings:
@@ -81,7 +82,7 @@ In registry events, the value name is appended to the full key path with a \"\\\
Default key values are named \"\\(Default)\"
When filtering for keys or values in HKCU, use **contains** or **end with** when filtering against **TargetObject** since the SID of the user is appended after the Hive name.
When filtering for keys or values in HKCU, use **contains** or **ends with** when filtering against **TargetObject** since the SID of the user is appended after the Hive name.
![HKCU Test](./media/image51.png)
sysmon-events.md
+15 -2
View File
@@ -112,10 +112,23 @@ Fields for the Event:
* **Description**: Description of what caused the error.
### Known errors
|ID |Description |
|---------------|-------------------------------|
| DriverCommunication |Failed to retrieve events|
| DriverCommunication |Incorrect event size [value]|
| DriverCommunication |Failed to access the driver|
| ServiceThread |Failed to initialize event for dispatch|
| ServiceThread |Failed to initialize the rule engine with data|
| ServiceThread |Failed to initialize signature verification|
| ServiceThread |Failed to allocate [value] bytes|
Example:
![Sysmon Error](./media/image28.png)
Service State Change
--------------------
@@ -320,7 +333,7 @@ against the one returned. It is not a bitwise operation, care should be
taken to track the proper combinations.
|Access | Mask |
|--------------------------------------|------------
|--------------------------------------|------------|
| PROCESS\_CREATE\_PROCESS |0x0080|
| PROCESS\_CREATE\_THREAD |0x0002|
| PROCESS\_DUP\_HANDLE |0x0040|
@@ -988,7 +1001,7 @@ Sysmon uses abbreviated versions of Registry root key names, with the
following mappings:
|**Key name** |**Abbreviation** |
|---------------------------------------------|---------------------------------
|---------------------------------------------|---------------------------------|
| HKEY\_LOCAL\_MACHINE |HKLM|
| HKEY\_USERS |HKU|
| HKEY\_LOCAL\_MACHINE\\System\\ControlSet00x |HKLM\\System\\CurrentControlSet|
the-sysmon-driver.md
+1 -1
View File
@@ -3,7 +3,7 @@ The Sysmon Driver
All of the monitoring is performed thanks to a driver that Sysmon installs called SysmonDrv. The driver will hook into Windows APIs and leverage Event Tracing for Windows (ETW) to capture the information on the actions it wants to monitor.
This Sysmon Driver has a unique attitude number of 385201 that determines the order of loading of the driver in comparison to other drivers on the system. Some blog posts recommend changing this number in the registry for obfuscation, but this may cause a conflict with another driver and prevent Sysmon from working or cause other errors on the system.
This Sysmon Driver has a unique altitude number of 385201 that determines the order of loading of the driver in comparison to other drivers on the system. Some blog posts recommend changing this number in the registry for obfuscation, but this may cause a conflict with another driver and prevent Sysmon from working or cause other errors on the system.
The driver is loaded by a service at system startup and a secondary service then queries the cached information.
what-is-sysmon.md
+3 -2
View File
@@ -3,11 +3,11 @@ What is Sysmon
Sysmon is a free tool initially developed by Mark Russinovich and has contributions by Tomas Garnier, David Magnotti, Mark Cook, Rob Mead, Giulia Biagini, and others at Microsoft. The tool is designed to extend the current logging capabilities in Windows to aid in understanding and detecting attackers by behavior. It was developed originally for internal use at Microsoft. (Note: There are still two versions of the tool—internal and external.) Currently, the tool supports 64-bit and 32-bit systems and uses a single command line tool for installation and configuration management.
For ease of collecting the logs, all of the events generated are saved in Microsoft-Windows-Sysmon/Operational EventLog, which allows current security products that already leverage collection from the EventLog in Windows.
All of the events generated by Sysmon are saved in Microsoft-Windows-Sysmon/Operational EventLog in order to accomodate security products that already leverage the EventLog, and to make the events easier to view and collect.
Sysmon is able to monitor for a series of actions on a Windows host that relate to existing behavior that is abused by threat actors. With this view on the actions, defenders are able to better detect abnormal behavior and abuses on a system.
The table below shows the evet types and event ID for each.
The table below shows the event types and event ID for each.
| EventType| EventId|
|---|---|
@@ -34,4 +34,5 @@ The table below shows the evet types and event ID for each.
|WMI Event Consumer|20
|WMI Consumer to Filter|21
|DNS Query|22
|File Delete|23
|Error|255