Start update for Sysmon for Linux

Start update for Sysmon for Linux

README.md

@@ -1,5 +1,5 @@
 
-<p><img align="left" width="100" height="100" src="media/tslogo.png"></p>
+<p><img align="left" width="100" height="100" src="chapters/media/tslogo.png"></p>
 
 
 # TrustedSec Sysmon Community Guide
@@ -23,55 +23,60 @@ The authors encourage you to redistribute this content as widely as possible, bu
 Table of Contents
 =================
 
-* [What is Sysmon](./what-is-sysmon.md)
+* [What is Sysmon](./chapters/what-is-sysmon.md)
 
-* [The Sysmon Driver](./the-sysmon-driver.md)
+* Sysmon on Windows
 
-* [Install and Configuration](./install-and-configuration.md)
+  * [The Sysmon Driver](./chapters/the-sysmon-driver.md)
+
+  * [Install and Configuration](./chapters/install-and-configuration.md)
+
+* Sysmon on Linux
+  * [sysinternalsEBPF](./chapters/eBPF.md)
 
 * Sysmon Events
 
-  * [Process Events](./process-events.md)
+  * [Process Events](./chapters/process-events.md)
 
-    * [Process Creation](./process-creation.md)
+    * [Process Creation](./chapters/process-creation.md)
 
-    * [Process Termination](./process-termination.md)
+    * [Process Termination](./chapters/process-termination.md)
 
-    * [Process Access](./process-access.md)
+    * [Process Access](./chapters/process-access.md)
 
   * File Events
   
-    * [File Create](./file-create.md)
+    * [File Create](./chapters/file-create.md)
 
-    * [File Create Time Change](./file-create-time-change.md)
+    * [File Create Time Change](./chapters/file-create-time-change.md)
 
-    * [File Stream Creation Hash](./file-stream-creation-hash.md)
+    * [File Stream Creation Hash](./chapters/file-stream-creation-hash.md)
     
-    * [File Delete](./file-delete.md)
+    * [File Delete](./chapters/file-delete.md)
 
-    * [File Delete Detected](./file_delete_detected.md)
+    * [File Delete Detected](./chapters/file_delete_detected.md)
 
-  * [Named Pipes](./named-pipes.md)
+  * [Named Pipes](./chapters/named-pipes.md)
 
-  * [Driver Loading](./driver-loading.md)
+  * [Driver Loading](./chapters/driver-loading.md)
 
-  * [Registry Actions](./registry-actions.md)
+  * [Registry Actions](./chapters/registry-actions.md)
 
-  * [Image Loading](./image-loading.md)
+  * [Image Loading](./chapters/image-loading.md)
 
-  * [Network Connections](./network-connections.md)
+  * [Network Connections](./chapters/network-connections.md)
 
-  * [Create Remote Thread](./create-remote-thread.md)
+  * [Create Remote Thread](./chapters/create-remote-thread.md)
 
-  * [Raw Access Read](./raw-access-read.md)
+  * [Raw Access Read](./chapters/raw-access-read.md)
 
-  * [DNS Query](./dns-query.md)
+  * [DNS Query](./chapters/dns-query.md)
 
-  * [WMI Events](./WMI-events.md)
+  * [WMI Events](./chapters/WMI-events.md)
   
-  * [Clipboard Capture](./clipboard-capture.md)
+  * [Clipboard Capture](./chapters/clipboard-capture.md)
   
-  * [Process Image Tampering](./process-tampering.md)
+  * [Process Image Tampering](./chapters/process-tampering.md)
   
 ## Current State:
 

chapters/WMI-events.md

@@ -1,111 +1,111 @@
-WMI Events
-==========
-
-WMI events, both temporary and permanent (survive a reboot), have been used for
-over a decade by vendors and enterprise users to automate actions on systems.
-Attackers leverage events in the same manner for automating actions and for
-persistence. Attackers will create or modify existing event components (APT 28,
-29) on systems for which they gain administrator privilege. WMI events are those
-events that happen when a specific Event Class instance is created or they are
-modified in the WMI Model.
-
-An attacker can monitor (and take certain actions) when these events occur by
-using subscriptions that monitor for them.
-
-There are two types of WMI Event Subscriptions:
-
--   **Temporary** - Subscription is active as long as the process that created
-    the subscription is active (They run under the privilege of the process)
-
--   **Permanent** - Subscription is stored in the CIM Database and is active
-    until removed from it (They always run as SYSTEM)
-
-All event subscriptions have three components:
-
--   **Filter** - WQL Query for the events we want
-
--   **Consumer** - An action to take upon triggering the filter
-
--   **Binding** - Registers a filter to a consumer
-
-The filter and consumer are created individually and then registered together.
-The actions that Sysmon filters on are those for permanent events. Sysmon will
-only log **ActiveScript** and **CommandLine** consumers since these are the ones
-abused by attackers.
-
-Fields for the Filter creation, modification, or deletion are:
-
--   **RuleName**: Rule name for filter
-
--   **EventType**: Will always be *WmiFilterEvent*
-
--   **UtcTime**: Time event happened
-
--   **Operation**: Created, modified or deleted
-
--   **User**: User that performed the action
-
--   **EventNamespace**: WMI Namespace where object was created
-
--   **Name**: Name of the filter
-
--   **Query**: Query defined for the filter
-
-The fields for Consumer creation, modification, or deletion are:
-
--   **RuleName**: Rule name for filter
-
--   **EventType**: Will always be *WmiConsumerEvent*
-
--   **UtcTime**: Time event happened
-
--   **Operation**: Created, modified, or deleted
-
--   **User**: User that performed the action
-
--   **Name**: Name of the consumer
-
--   **Type**: Type of consumer
-
--   **Destination**: Command or Script being executed
-
-The fields for filter to consumer binding are:
-
--   **RuleName**: Rule name for filter
-
--   **EventType**: Will always be *WmiBindingEvent*
-
--   **UtcTime**: Time event happened
-
--   **Operation**: Created, modified, or deleted
-
--   **User**: User that performed the action
-
--   **Consumer**: Consumer path in the CIM Database
-
--   **Filter**: Filter path in the CIM Database
-
-When a Permanent Event Subscription is created, an EventID **5861** in
-**Microsoft-Windows-WMI-Activity/Operational** is created in **Windows 2012 R2,
-Windows 2016,** and **Windows 10 Pro/Enterprise**.
-
-The event includes the Query and Consumer object information for the
-subscription in its data.
-
-![Bind Event](media/image62.png)
-
-It is recommended to log all instances of this event type.
-
-```XML
-<Sysmon schemaversion="4.22">
-   <!-- Capture all hashes -->
-   <HashAlgorithms>*</HashAlgorithms>
-   <CheckRevocation/>
-   <EventFiltering>
- <RuleGroup name="" groupRelation="or">
-      <WmiEvent onmatch="exclude">
-      </WmiEvent>
-</RuleGroup>
-</EventFiltering>
-</Sysmon>
-```
+WMI Events
+==========
+
+WMI events, both temporary and permanent (survive a reboot), have been used for
+over a decade by vendors and enterprise users to automate actions on systems.
+Attackers leverage events in the same manner for automating actions and for
+persistence. Attackers will create or modify existing event components (APT 28,
+29) on systems for which they gain administrator privilege. WMI events are those
+events that happen when a specific Event Class instance is created or they are
+modified in the WMI Model.
+
+An attacker can monitor (and take certain actions) when these events occur by
+using subscriptions that monitor for them.
+
+There are two types of WMI Event Subscriptions:
+
+-   **Temporary** - Subscription is active as long as the process that created
+    the subscription is active (They run under the privilege of the process)
+
+-   **Permanent** - Subscription is stored in the CIM Database and is active
+    until removed from it (They always run as SYSTEM)
+
+All event subscriptions have three components:
+
+-   **Filter** - WQL Query for the events we want
+
+-   **Consumer** - An action to take upon triggering the filter
+
+-   **Binding** - Registers a filter to a consumer
+
+The filter and consumer are created individually and then registered together.
+The actions that Sysmon filters on are those for permanent events. Sysmon will
+only log **ActiveScript** and **CommandLine** consumers since these are the ones
+abused by attackers.
+
+Fields for the Filter creation, modification, or deletion are:
+
+-   **RuleName**: Rule name for filter
+
+-   **EventType**: Will always be *WmiFilterEvent*
+
+-   **UtcTime**: Time event happened
+
+-   **Operation**: Created, modified or deleted
+
+-   **User**: User that performed the action
+
+-   **EventNamespace**: WMI Namespace where object was created
+
+-   **Name**: Name of the filter
+
+-   **Query**: Query defined for the filter
+
+The fields for Consumer creation, modification, or deletion are:
+
+-   **RuleName**: Rule name for filter
+
+-   **EventType**: Will always be *WmiConsumerEvent*
+
+-   **UtcTime**: Time event happened
+
+-   **Operation**: Created, modified, or deleted
+
+-   **User**: User that performed the action
+
+-   **Name**: Name of the consumer
+
+-   **Type**: Type of consumer
+
+-   **Destination**: Command or Script being executed
+
+The fields for filter to consumer binding are:
+
+-   **RuleName**: Rule name for filter
+
+-   **EventType**: Will always be *WmiBindingEvent*
+
+-   **UtcTime**: Time event happened
+
+-   **Operation**: Created, modified, or deleted
+
+-   **User**: User that performed the action
+
+-   **Consumer**: Consumer path in the CIM Database
+
+-   **Filter**: Filter path in the CIM Database
+
+When a Permanent Event Subscription is created, an EventID **5861** in
+**Microsoft-Windows-WMI-Activity/Operational** is created in **Windows 2012 R2,
+Windows 2016,** and **Windows 10 Pro/Enterprise**.
+
+The event includes the Query and Consumer object information for the
+subscription in its data.
+
+![Bind Event](media/image62.png)
+
+It is recommended to log all instances of this event type.
+
+```XML
+<Sysmon schemaversion="4.22">
+   <!-- Capture all hashes -->
+   <HashAlgorithms>*</HashAlgorithms>
+   <CheckRevocation/>
+   <EventFiltering>
+ <RuleGroup name="" groupRelation="or">
+      <WmiEvent onmatch="exclude">
+      </WmiEvent>
+</RuleGroup>
+</EventFiltering>
+</Sysmon>
+```

chapters/eBPF.md

@@ -0,0 +1,14 @@
+sysinternalsEBPF
+=================
+
+ Sysmon for Linux uses its own library “sysinternalsEBPF” to handle the security events monitoring process. The advantages are that eBPF is a technology that allows programs to run in a sandbox in an operating system at the kernel level. The eBPF library will allow for the collection of information on:
+
+ - Processes
+ - System Calls
+ - Network Sockets
+
+ The “sysinternalsEBPF” library is open sourced and licensed under the MIT License. The source is available in GitHub at https://github.com/Sysinternals/SysinternalsEBPF In GitHub the latest installation and build instructions can be found. 
+
+![Bind Event](media/image64.png)
+
+The eBPF library leverages a large library of Kernel memory offsets that are stored after installation in a JSON file at 

chapters/what-is-sysmon.md

@@ -0,0 +1,74 @@
+What is Sysmon
+==============
+
+Sysmon is a free tool initially developed by Mark Russinovich and  by Tomas Garnier,with contributions David Magnotti, Mark Cook, Rob Mead, Giulia Biagini, Alex Mihaiuc, Kevin Sheldrake, John Lambert and others at Microsoft. The tools was initially released for. Windows. host and on October 2021 a Open Source Linux version of the tools was release. The tool is designed to extend the current logging capabilities in Windows and Linux so as to aid in understanding and detecting attackers by behavior. 
+
+The original version the tool was for internal use at Microsoft.  Under Windows the tool the tool supports 64-bit and 32-bit systems and uses a single command line tool for installation and configuration management.
+
+For Linux the tool can be compiled from source or installed via the distribution package manager.  It supports the following distributions:
+
+- Ubuntu
+- Debian
+- Red Hat Enterprise Linux
+- Fedora Linux
+- OpenSuse
+- Suse Linux Enterprise Server
+
+Sysmon will store logs in the default operating system login system. For Windows all of the events generated by Sysmon are saved in Microsoft-Windows-Sysmon/Operational EventLog and in the case of Linux under /var/log/syslog in order to accommodate security products that already collect and centralize logs from both operating systems.
+
+Sysmon is able to monitor for a series of actions on a  host that relate to existing behavior that is abused by threat actors. With this view on the actions, defenders are able to better detect abnormal behavior and abuses on a system.
+
+The table below shows the event types and event ID that the version of Windows collects.
+
+| EventType| EventId|
+|---|---|
+|Sysmon Service Status Changed|0
+|ProcessCreate|1
+|FileCreateTime|2
+|NetworkConnect|3
+|Service State Change|4
+|ProcessTerminate|5
+|DriverLoad|6
+|ImageLoad|7
+|CreateRemoteThread| 8
+|RawAccessRead| 9
+|ProcessAccess| 10
+|FileCreate| 11
+|Registry object added or deleted | 12
+|Registry Create| 13
+|Registry Rename| 14
+|FileCreateStreamHash | 15
+|Sysmon Config Change| 16
+|Named Pipe Create| 17
+|Named Pipe Connected|18
+|WMI Event Filter|19
+|WMI Event Consumer|20
+|WMI Consumer to Filter|21
+|DNS Query|22
+|File Delete|23
+|Clipboard Capture|24
+|Process Tampering|25
+|File Delete Detected|26
+|Error|255
+
+The Linux version supports given the OS and technologies a smaller number of events. 
+
+| EventType| EventId|
+|---|---|
+|Sysmon Service Status Changed|0
+|ProcessCreate|1
+|NetworkConnect|3
+|Service State Change|4
+|ProcessTerminate|5
+|RawAccessRead| 9
+|FileCreate| 11
+|Sysmon Config Change| 16
+|File Delete|23
+
+
+
+The Sysmon version for Linux  is an open-source version of the tool, developed to collect security events from Linux environments using eBPF (Extended Berkeley Packet Filter) and placing the captured events in to Syslog for easy consumption by existing centralized log collection solutions.
+
+Sysmon for Linux use the sysinternalsEBPF library to allow it to capture actions against files on disk and network actions. eBPF is a technology that allows to run the program at the Kernel level in a sandbox allowing it to capture read and. Sysmon leverages this technology to capture information on processes, reads and writes to block devices and also for Socket and TCP/IP actions before they reach a network interface. This behaviour is similar to that of mini filter drivers in Windows that allow for the capture of events as they are executed by the APIs in the OS. 
+
+The sysinternalsEBPF and Sysmon for Linux are Open Source projects, this allows the community to contribute and to further expand the capabilities of the tools. They can be found at https://github.com/Sysinternals. Both Projects are written in C and in each repository they include documentation on how to build the utilities. 

what-is-sysmon.md

@@ -1,41 +0,0 @@
-What is Sysmon
-==============
-
-Sysmon is a free tool initially developed by Mark Russinovich and has contributions by Tomas Garnier, David Magnotti, Mark Cook, Rob Mead, Giulia Biagini, and others at Microsoft. The tool is designed to extend the current logging capabilities in Windows to aid in understanding and detecting attackers by behavior. It was developed originally for internal use at Microsoft. (Note: There are still two versions of the tool—internal and external.) Currently, the tool supports 64-bit and 32-bit systems and uses a single command line tool for installation and configuration management.
-
-All of the events generated by Sysmon are saved in Microsoft-Windows-Sysmon/Operational EventLog in order to accomodate security products that already leverage the EventLog, and to make the events easier to view and collect.
-
-Sysmon is able to monitor for a series of actions on a Windows host that relate to existing behavior that is abused by threat actors. With this view on the actions, defenders are able to better detect abnormal behavior and abuses on a system.
-
-The table below shows the event types and event ID for each.
-
-| EventType| EventId|
-|---|---|
-|Sysmon Service Status Changed|0
-|ProcessCreate|1
-|FileCreateTime|2
-|NetworkConnect|3
-|Service State Change|4
-|ProcessTerminate|5
-|DriverLoad|6
-|ImageLoad|7
-|CreateRemoteThread| 8
-|RawAccessRead| 9
-|ProcessAccess| 10
-|FileCreate| 11
-|Registry object added or deleted | 12
-|Registry Create| 13
-|Registry Rename| 14
-|FileCreateStreamHash | 15
-|Sysmon Config Change| 16
-|Named Pipe Create| 17
-|Named Pipe Connected|18
-|WMI Event Filter|19
-|WMI Event Consumer|20
-|WMI Consumer to Filter|21
-|DNS Query|22
-|File Delete|23
-|Clipboard Capture|24
-|Process Tampering|25
-|File Delete Detected|26
-|Error|255