diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3783df8 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ + +chapters/.DS_Store diff --git a/Build/Sysmon.md b/Build/Sysmon.md index c4c63f0..45e27c2 100644 --- a/Build/Sysmon.md +++ b/Build/Sysmon.md @@ -1862,7 +1862,7 @@ Example of libraries leveraged by attackers Sysmon will log **EventID 3** for all TCP and UDP network connections. This event will generate a large number of entries and filtering should be tuned for specific processes and ports. -For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering since it uses a reverse DNS Lookup to get this information, in Sysmon v11.0 this behaviour can be disabled by using the ```True``` at the root of the confifuration file. +For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering since it uses a reverse DNS Lookup to get this information, in Sysmon v11.0 this behaviour can be disabled by using the ```True``` at the root of the configuration file. For the DestinationPortName, the GetNameInfo API is used for the friendly name of ports. In the case of services doing connections on some systems due to memory use, they are hosted under svchost.exe and most connections will originate from this process. diff --git a/README.md b/README.md index e363f07..7cd897a 100644 --- a/README.md +++ b/README.md @@ -1,16 +1,12 @@

- # TrustedSec Sysmon Community Guide - -

Creative Commons License

This work is licensed under a [Creative Commons Attribution-ShareAlike 4.0 International License](http://creativecommons.org/licenses/by-sa/4.0/), please attribute to TrustedSec LLC - ###### You are free to: **Share** — copy and redistribute the material in any medium or format. @@ -19,7 +15,6 @@ This work is licensed under a [Creative Commons Attribution-ShareAlike 4.0 Inter The authors encourage you to redistribute this content as widely as possible, but require that you give credit to the primary authors below, and that you notify us on GitHub of any improvements you make. - Table of Contents ================= @@ -29,11 +24,16 @@ Table of Contents * [The Sysmon Driver](./chapters/the-sysmon-driver.md) - * [Install and Configuration](./chapters/install-and-configuration.md) + * [Install and Configuration](./chapters/install_windows.md) * Sysmon on Linux + * [sysinternalsEBPF](./chapters/eBPF.md) + * [Install and Configuration](./chapters/install_linux.md) + +* [Configuration](./chapters/configuration.md) + * Sysmon Events * [Process Events](./chapters/process-events.md) @@ -51,7 +51,7 @@ Table of Contents * [File Create Time Change](./chapters/file-create-time-change.md) * [File Stream Creation Hash](./chapters/file-stream-creation-hash.md) - + * [File Delete](./chapters/file-delete.md) * [File Delete Detected](./chapters/file_delete_detected.md) diff --git a/chapters/Sysmon.md b/chapters/Sysmon.md index dcd6d89..b221322 100644 --- a/chapters/Sysmon.md +++ b/chapters/Sysmon.md @@ -1835,7 +1835,7 @@ Example of libraries leveraged by attackers Sysmon will log **EventID 3** for all TCP and UDP network connections. This event will generate a large number of entries and filtering should be tuned for specific processes and ports. -For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering since it uses a reverse DNS Lookup to get this information, in Sysmon v11.0 this behaviour can be disabled by using the ```True``` at the root of the confifuration file. +For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering since it uses a reverse DNS Lookup to get this information, in Sysmon v11.0 this behaviour can be disabled by using the ```True``` at the root of the configuration file. For the DestinationPortName, the GetNameInfo API is used for the friendly name of ports. In the case of services doing connections on some systems due to memory use, they are hosted under svchost.exe and most connections will originate from this process. diff --git a/chapters/install-and-configuration.md b/chapters/configuration.md similarity index 60% rename from chapters/install-and-configuration.md rename to chapters/configuration.md index 2dd0ab4..25d6f70 100644 --- a/chapters/install-and-configuration.md +++ b/chapters/configuration.md @@ -1,256 +1,7 @@ -Install and Configuration -========================= - -* [Sysmon Command Line](#the-sysmon-command-line) - -* [Installation with Configuration](#installation-with-configuration) - - * [Uninstall](#uninstall) - - * [Installation Best Practice](#installation-best-practice) - -* [Configuration](#configuration) - - * [Command Line Parameters](#command-line-parameters) - - * [Filter Operators](#filter-operators) - - * [Event Schema](#event-schema) - - * [Configuration File](#configuration-file) - - * [RuleGroups](#rulegroups) - - * [Configuration File Best Practices](#configuration-file-best-practices) - - * [Configuration Tampering](#configuration-tampering) - - * [Configuration Deployment](#configuration-deployment) - - * [Deployment Script](#deployment-script) - - * [GPO Configuration Deployment](#gpo-configuration-deployment) - -The Sysmon Command Line -======================= - -Sysmon installation and configuration can be done via the command line. When Sysmon is downloaded from Microsoft, the zip file will contain two command line versions of the tool: - -* **Sysmon.exe** - x86 and x64 version. - -* **Sysmon64.exe** - 64bit only version. - -When using the tool, any errors will result in an error message and help information with basic switches. To see only the help information for the tool, the **-?** switch parameter is used. This help information will include: - -* Parameter sets for installation, configuration, and uninstall - -* Common command line parameters. - -* General notes on how the tool works and further details on how to get more help information. - -The parameters of the tool and the structure of the XML configuration file are defined in the tool Schema. This schema can be printed using the **-s "PrintSchema"** parameter; if no schema version is provided, it will print the default schema. - -The tool can be run in 4 main modes; 3 of them are shown in the help message: - -* **Install** - Install the driver, manifest and service on the host. - -* **Configure** - Parses a given configuration file or command line parameters to generate a configuration that is stored in the registry. - -* **Uninstall** - Removes the driver and service from the host. - -The semi-hidden and undocumented method is Debug, in which a specified configuration is parsed, and live events are shown in the console. - -Install -------- - -The key parameter that initiates the installation mode of Sysmon is the **-i** switch. The installation process will be as follows: - -* Decompresses and saves driver and copy of itself in to **%systemroot%** - -* Registers event log manifest - -* Creates a service - -* Enables a default configuration (ProcessCreation, ProcessTermination, DriverLoad , FileCreationTimeChanged, SHA1 for Images) if no configuration file is passed using the **-c \** parameter - -The Installation process allows for some obfuscation: - -* Driver name can be changed - -* Service name can be changed - -* Sysmon binary name can be renamed. - -These obfuscation changes will also affect registry paths for the driver and processes service keys. All of the obfuscation methods are part of the installation option set. - -The installation options are: - -* Default -- Driver is installed and named SysmonDrv and service Sysmon - -```shell -sysmon.exe --i --accepteula - -``` - -* Renamed Driver -- The driver file and registry entry are renamed. Name has an 8-character limit. - -```shell -sysmon.exe -i -d -``` - -* Renamed Service -- The executable name defines the service name. - -```shell -.exe -i -d -``` - -The installation process on a x64 system with the binary named sysmon.exe that is intended to work across x64 and x86 architectures is shown below. This is important since some of the actions may cause confusion or trigger alerts on monitoring systems. - -One important thing to keep in mind when obfuscating the driver name and service name is that certain characteristics remain the same. - -* Service description remains the same. (This can be modified post-install.) - -* Driver Altitude number remains the same. - -* The eventlog remains the same so as to not break collection from SIEM products. - -Process for x86 ---------------- - -![x86 bit insall process](./media/image6.png) - -x64 Process ------------ - -![x64 install process](./media/image7.png) - -Sysmon will create 2 registry keys to define the services for its operation under ***HKLM\\SYSTEM\\CurrentControlSet\\Services*** - -* Sysmon - Service that talks to the driver and performs the filtering action. It is named with the same name as the Sysmon executable. - -* SysmonDrv - Kernel Driver Service, this service loads the Sysmon driver with an altitude number of 385201 - -The settings for each service are: - -Main Service: - -* Name: **Name of the executable (default Sysmon or Sysmon64)** - -* LogOn: **Local System** - -* Description: **System Monitor service** - -* Startup: **Automatic** - -* ImagePath: **%windir%\\\** - -Driver Service: - -* Name: **SysmonDrv unless --d \ is** - -* LogOn: **Local System** - -* Description: **System Monitor driver** - -* Startup: **Automatic** - -* ImagePath: **\.sys** - -Installation with Configuration -------------------------------- -An XML configuration file can be passed during installation if an initial configuration needs to be set. This is the preferred method for production systems since a configuration file can cover all types and logic. The most used method is to pass a configuration file using the **-c \** parameter. - -```shell -sysmon.exe -i --accepteula -c -``` -If the configuration specifies a archive folder using the `````` element the **-a \** needs to be specified in the command line so that Sysmon can create the folder and set the proper permissions for version 11.0 of Sysmon, for version 11.1 the parameter was removed and now it is configured via the configuration file. If the folder is not present and even if specified Sysmon will create a folder named **Sysmon** instead and use that folder to archive the deleted files. - -We can control the hashing algorithm used for events that hash images and we can control checking of revocation of signatures. - -The hashing algorithm or combination of them can be specified with the **-h \** The specified algorithms will be used to hash all images. - -```shell -sysmon.exe -i -c -h -``` - -We can specify checking to see if certificates are revoked using the -r parameter. - -```shell -sysmon.exe -i -c -r - -``` - -SSome basic filtering can be done also from the command line. Only filtering by process name can be done for NetworkConnect, ImageLoad, and ProcessAccess via the command line. - -* **NetworkConnect** - Track network connections. - -```shell -sysmon.exe -i -c -n [] -``` - -* **ImageLoad** - DLL loading by processes. - -```shell -sysmon.exe -i -c -l [] -``` - -* **ProcessAccess** - Processes whose memory is accessed. - -```shell -sysmon.exe -i -c -k [] -``` - -Uninstall ---------- - -To uninstall Sysmon, a binary with the same name as the main service, if renamed, has to be run with the **-u** switch parameter. - -```shell -sysmon.exe -u -``` -When executed the command will run a series of steps to uninstall the service, driver and remove files for the tool. - -![Uninstall Process](./media/image8.png) - -There is an undocumented value that can be passed to the **-u** parameter of **"force"** to force the removal of the services even if a stop was not possible. - -```shell -sysmon.exe -u force -``` - -Installation Best Practice --------------------------- - -Installation best practices that can be followed to aid and minimize risk when deploying the Sysmon tool include: - -* Keep a repository of Sysmon versions archived; Microsoft does not provide older versions for download. - -* Sysmon is very dependent on the version of the binary for its configuration. The install/upgrade script should check the binary version for: - - * Upgrade - - * Version for applying initial config - -* If a GPO is used to push scheduled tasks for upgrades or to push configuration, use a WMI filter to target the specific version that was tested. Example: - -```sql -SELECT * FROM CIM_Datafile WHERE (Name="c:\\Windows\\Sysmon64.exe" OR Name="c:\\Windows\\Sysmon.exe") AND version="10.0.4.1" -``` - -* Check file versions they don't match release versioning. - -* It is better to not push configuration as an XML that gets run from a share or dropped on disk with a scheduled task: - - * Credentials are left that can be recovered via DPAPI for deleted scheduled tasks. - - * The file can be read more easily by an attacker if controls are not properly placed - - * There is a higher chance of human error - - * Better to push values via GPO or other methods with file version checking. Configuration ------------- + The configuration options of Sysmon and the structure of the configuration file are defined in its schema. Each version of Sysmon that adds capabilities raises the schema version, and this version number is not tied to the binary version number. To take a look at this schema, we would run the binary with the **-s \[schema version\]** parameter; if no schema version is specified, we would get the latest one for the binary. @@ -283,6 +34,10 @@ The main attributes for each of the command-line options: ![Configuration File Parameters](./media/image10.png) +Not all command parameters shown in the Schema apply to Sysmon for Linux, both tools share the general schema but in the Linux version only a subset of the parameters are implemented. + +Windows Parameters: + The main arguments that can be passed are: * **-i** : Install Sysmon @@ -291,6 +46,10 @@ The main arguments that can be passed are: sysmon.exe -i [configfile path] ``` +```shell +sysmon. -i [configfile path] +``` + * **-c** : apply config ```shell @@ -303,13 +62,13 @@ sysmon.exe -c [configfile path] sysmon.exe -u [force] ``` -* **-m** : Install event manifest +* **-m** : Install event manifest (Windows Only) ```shell sysmon.exe -m ``` -* **-t** : Debug mode +* **-t** : Debug mode (Windows Only) ```shell sysmon.exe -t [configfile path] @@ -321,7 +80,7 @@ sysmon.exe -t [configfile path] sysmon.exe -s [schema version] ``` -* **-nologo** : don't show sysmon logo +* **-nologo** : don't show sysmon logo (Windows Only) ```shell sysmon.exe -nologo @@ -330,56 +89,102 @@ sysmon.exe -nologo * **-accepteula** : Accepts the license agreement ```shell - sysmon.exe -accepteula +sysmon.exe -accepteula ``` * **--** : Resets the configuration to the default ```shell -sysmon.exe -- +sysmon.exe -c -- ``` The option elements under the comment "Configuration file" allow for the configuration of filters and parameters that relate to filters. -* **-h** : Hashing algorithm to has images. +* **-h** : Hashing algorithm to has images. (Windows Only) ```shell sysmon.exe -c -h ``` -* **-r** : Check for signature certificate revocation +* **-r** : Check for signature certificate revocation (Windows Only) ```shell sysmon.exe -c -r ``` -* **-n** : Track network connections for specified process/processes +* **-n** : Track network connections for specified process/processes. ```shell sysmon.exe -c -n [] ``` -* **-k** : Track when a specified process/processes memory are accessed +* **-k** : Track when a specified process/processes memory are accessed. (Windows Only) ```shell sysmon.exe -c -k [] ``` -* **-l** : Track modules (DLLs) loaded by a specified process/processes. +* **-l** : Track modules (DLLs) loaded by a specified process/processes. (Windows Only) ```shell sysmon.exe -c -k [] ``` -* **-d** : Rename the sysmon driver during install (8 character limit) +* **-d** : Rename the sysmon driver during install (8 character limit) (Windows Only) ```shell sysmon.exe -i -c -d ``` -> **-g** and **--dns** switches are listed but as of the current version, they +> **-g** and **--dns** switches are listed but as of the current version, they (Windows Only) > do not update the configuration. +Sysmon for Linux parameters are: + +The main arguments that can be passed are: + +* **-i** : Install Sysmon + +```shell +/usr/bin/sysmon -i [configfile path] +``` + +* **-c** : apply config + +```shell +/usr/bin/sysmon -c [configfile path] +``` + +```bash +/ussr/bin/sysmon -u [force] +``` + +* **-s** : Print schema + +```shell +/ussr/bin/sysmon -s [schema version] +``` + +* **-accepteula** : Accepts the license agreement + +```shell +/ussr/bin/sysmon -accepteula +``` + +* **--** : Resets the configuration to the default + +```shell +/ussr/bin/sysmon -c -- +``` + +The option elements under the comment "Configuration file" allow for the configuration of filters and parameters that relate to filters. + +* **-n** : Track network connections for specified process/processes. + +```bash +/ussr/bin/sysmon -c -n [] +``` + Filter Operators ---------------- @@ -387,15 +192,18 @@ In the filters element under configuration is the list of operators that can be | **Operator** | **Meaning** |------------------|------------------------------------------------------ -| Is| Exact match. -| IsNot| Negates and exact match -| Contains| The string is contained in any part of the value of the field. -| Excludes | Excludes the event from the logic if the event is the value matches -| Excludes All| Exclude if all values match. (values are separate by ";" ) -| Excludes Any | Excludes if any of the values match. (values are separate by ";" ) -| Image | Name of the image without the full path. -| BeginsWith | String value starts with. -| EndsWith | String value ends with +| is| Exact match. +| is not| Negates and exact match +| is any| Any of the exact values. (values are separate by ";" ) +| contains| The string is contained in any part of the value of the field. +| excludes | Excludes the event from the logic if the event is the value matches +| excludes all| Exclude if all values match. (values are separate by ";" ) +| excludes any | Excludes if any of the values match. (values are separate by ";" ) +| image | Name of the image without the full path. +| begins with | String value starts with the specified string. +| not begins with| String value does not starts with the specified string. +| ends with | String value ends with the specified string. +| not ends with| String value ends with the specified string. | LessThan | Numeric value is less than | MoreThan | Numeric value is more than | Contain Any | Contains any of the values. (values are separate by ";" ) @@ -434,7 +242,7 @@ We can filter on the Field Names defined in the data elements. They are defined ![Fields definition](./media/image12.png) -As of the latest version we have defined as event types: +As of the latest version we have defined as event types, one does need to be aware that not all fields and all event types will apply to both Sysmon fo Windows and Sysmon for Linux: * **NetworkConnect** - Network connections made by processes on the system; both TCP and UDP @@ -466,15 +274,18 @@ As of the latest version we have defined as event types: * **FileDelete** - Saves when possible and logs file deletion or file wipes. -* **ClipboardChange** - Stores and logs text that is stored in to the clipboard by processes and context of who stored the text. +* **ClipboardChange** - Stores and logs text that is stored in to the clipboard by processes and context of who stored the text. +* **ProcessTampering** - Detects some of the techniques of "hollow" and "herpaderp" where a process image is replace. + +* **FileDeleteDetected** - Only logs file deletion or file wipes. Configuration File ================== The main method of configuration of Sysmon is through the use of XML configuration files. XML configuration files allow for higher flexibility since more filtering options are possible by applying logical operations to the fields that are defined by the schema version for the event types. -Previous schemas can be used in newer releases of the binary allowing for upgrading of the binary without the need to update the configuration. The schema is defined on the root element (Sysmon) of the configuration file with the attribute schemaversion. +Previous schemas can be used in newer releases of the binary allowing for upgrading of the binary without the need to update the configuration. The schema is defined on the root element (Sysmon) of the configuration file with the attribute **schemaversion**. ![config file](./media/image13.png) @@ -553,6 +364,7 @@ Since getting stated can be complex, some great resources that serve as starting Configuration Tampering ----------------------- + One of the actions an attacker takes is the identification of controls and logging on a system. Due to initial footprint and safety, most advanced attackers limit their actions to enumerate controls to the most common actions that elements that will trigger a monitoring solution. The most common methods used are: @@ -561,11 +373,11 @@ Due to initial footprint and safety, most advanced attackers limit their actions * Process list. -* Listing of installed applications from the registry. +* Listing of installed applications from the registry (In the case of Windows). This does not mean that an attacker will not use more advanced methods to enumerate controls and find Sysmon on the system. -Detection of Sysmon is achieved by looking at the areas that cannot be changed. +Detection of Sysmon in Windowss is achieved by looking at the areas that cannot be changed. **Indicator** | **Can it be Changed** ----------------------------| ----------------------- @@ -578,16 +390,96 @@ Detection of Sysmon is achieved by looking at the areas that cannot be changed. When Sysmon configuration is modified using the Sysmon command line tool, an **EventId 16** is generated. If the registry binary value is modified directly, no event is generated, and configuration is applied as soon as the value is modified. -When a GPO is used to update configuration by default every 90 minutes, the configuration will be updated. A better solution is to use a configuration management solution like DSC that can monitor for changes and update as soon as a change is detected. +On Windows when a GPO is used to update configuration by default every 90 minutes, the configuration will be updated. A better solution is to use a configuration management solution like DSC that can monitor for changes and update as soon as a change is detected. + +In the case of Linux a solution like Puppet or Ansible is recommended where the configuration file in **/opt/sysmon/config.xml** and **/opt/sysmon/rules.bin**. Sysmon can be configured to monitor its own configuration to detect whether an attacker deletes or alters it. In the event that it is cleared, this will be the last event logged by Sysmon itself from its configured filters. - ![](./media/image21.png) ![](./media/image22.png) -In case the configurations are cleared, the default one will take over: +In the case of Sysmon for Linux the behavior is the same + +``` + +Event SYSMONEVENT_CREATE_PROCESS + RuleName: - + UtcTime: 2021-10-17 22:30:12.058 + ProcessGuid: {2424faa4-a3f4-616c-e1b4-2270fe550000} + ProcessId: 141030 + Image: /usr/bin/rm + FileVersion: - + Description: - + Product: - + Company: - + OriginalFileName: - + CommandLine: rm /opt/sysmon/rules.bin + CurrentDirectory: /home/carlos/Desktop + User: root + LogonGuid: {2424faa4-0000-0000-0000-000000000000} + LogonId: 0 + TerminalSessionId: 3 + IntegrityLevel: no level + Hashes: - + ParentProcessGuid: {2424faa4-a3f4-616c-d5ab-cd1b11560000} + ParentProcessId: 141029 + ParentImage: /usr/bin/sudo + ParentCommandLine: sudo + ParentUser: carlos +Event SYSMONEVENT_FILE_DELETE + RuleName: - + UtcTime: 2021-10-17 22:30:12.062 + ProcessGuid: {2424faa4-a3f4-616c-e1b4-2270fe550000} + ProcessId: 141030 + User: root + Image: /usr/bin/rm + TargetFilename: /opt/sysmon/rules.bin + Hashes: - + IsExecutable: - + Archived: - +``` + +``` +Event SYSMONEVENT_CREATE_PROCESS + RuleName: - + UtcTime: 2021-10-17 22:30:24.113 + ProcessGuid: {2424faa4-a400-616c-e194-bfcc63550000} + ProcessId: 141036 + Image: /usr/bin/rm + FileVersion: - + Description: - + Product: - + Company: - + OriginalFileName: - + CommandLine: rm /opt/sysmon/config.xml + CurrentDirectory: /home/carlos/Desktop + User: root + LogonGuid: {2424faa4-0000-0000-0000-000000000000} + LogonId: 0 + TerminalSessionId: 3 + IntegrityLevel: no level + Hashes: - + ParentProcessGuid: {2424faa4-a400-616c-d57b-eebae9550000} + ParentProcessId: 141035 + ParentImage: /usr/bin/sudo + ParentCommandLine: sudo + ParentUser: carlos +Event SYSMONEVENT_FILE_DELETE + RuleName: - + UtcTime: 2021-10-17 22:30:24.115 + ProcessGuid: {2424faa4-a400-616c-e194-bfcc63550000} + ProcessId: 141036 + User: root + Image: /usr/bin/rm + TargetFilename: /opt/sysmon/config.xml + Hashes: - + IsExecutable: - + Archived: - +``` + +In case the configurations are cleared, the default one will take over, in the case of Windows: * **ProcessCreation** @@ -599,7 +491,13 @@ In case the configurations are cleared, the default one will take over: * **SHA1 for Images** -Since any user in the system can read the rule binary data, an attacker can operate around rule configurations once they have read them by: +For Linux the default configuration is: + +* **ProcessCreation** + +* **ProcessTermination** + +In the case of Windows any user in the system can read the rule binary data, an attacker can operate around rule configurations once they have read them by: * Execute tasks not logged. @@ -607,11 +505,35 @@ Since any user in the system can read the rule binary data, an attacker can oper Existing tools for parsing rules out of the registry break often as Sysmon is updated, since the way the information is structured in the binary blob is not documented. However, an attacker can export and import into the test system and use Sysmon to read the configuration. -It is also important to monitor any process that access the Sysmon service process to prevent suspension of the process or modification of it in memory. +It is also important to monitor any process that access the Sysmon service process to prevent suspension of the process or modification of it in memory. + +For Linux only the root account can read and modify the the sysmon configuration file and its binary info. But the syslog file on most systems Configuration Deployment ------------------------ -Most environments that have the capabilities to leverage Sysmon enhanced log collection also have software deployment systems like Altiris, System Center Configuration Manager, Desired State Configuration, etc. This is why these are just general recommendations. + +Most environments that have the capabilities to leverage Sysmon enhanced log collection also have software deployment systems like Altiris, System Center Configuration Manager, Desired State Configuration, etc for Windows in the case of Linux we can leverage Ansible, Chef, Puppet and many other solutions. This is why these are just general recommendations. + +Sylog Message Size +------------------ + +Syslog message size limits are dictated by the syslog transport mapping in use. By default the rsyslog package which is one of the most popular packages in distributions limit the size to 1024 bytes. It is important to prevent parsing errors of the structured data to set max sizes that match the size and transport of the messages configured for your given Syslog package. This is achieved using the **FieldSizes** XML element and setting a size for the CommandLine and Image field sizes. We can specify the field and the length we want for the field like in the example bellow. + +```xml + + CommandLine:100,Image:100 + + + + +``` + +Fields that could benefit of this are: + +* Image +* ParentImage +* CommandLine +* ParentCommandLine Deployment Script ----------------- @@ -640,7 +562,7 @@ if ($Present) { } else { # Execute upgrade process. Write-Host -Object "[-] Sysmon needs upgrade." -ForegroundColor Red - -U + -U -I } } else { diff --git a/chapters/eBPF.md b/chapters/eBPF.md index 3a55143..2b5e83e 100644 --- a/chapters/eBPF.md +++ b/chapters/eBPF.md @@ -3,12 +3,16 @@ sysinternalsEBPF Sysmon for Linux uses its own library “sysinternalsEBPF” to handle the security events monitoring process. The advantages are that eBPF is a technology that allows programs to run in a sandbox in an operating system at the kernel level. The eBPF library will allow for the collection of information on: - - Processes - - System Calls - - Network Sockets +* Processes +* System Calls +* Network Sockets - The “sysinternalsEBPF” library is open sourced and licensed under the MIT License. The source is available in GitHub at https://github.com/Sysinternals/SysinternalsEBPF In GitHub the latest installation and build instructions can be found. + The “sysinternalsEBPF” library is open sourced and licensed under the MIT License. The source is available in GitHub at In GitHub the latest installation and build instructions can be found. -![Bind Event](media/image64.png) +![eBPF](media/image64.png) -The eBPF library leverages a large library of Kernel memory offsets that are stored after installation in a JSON file at \ No newline at end of file +The eBPF library leverages a large library of Kernel memory offsets that are stored after installation in a JSON file at **/opt/sysinternalsEBPF/offsets.json** if the kernel is not one in the list it will do an auto discovery of the offsets and add them to **/opt/sysinternalsEBPF/sysinternalsEBPF_offsets.conf** There might be some cases where it will fail to do an autodiscovery of the offsets like in the case of a kernel update. In this case the service will fail to load and provide instructions on how to update the offsets. Bellow is the error that would be displayed in the case that autodiscovery fails. + +![Kernel Offset](media/image65.png) + +The GitHub repo instructions on how to build and offset config for the current kernel are provided diff --git a/chapters/file_delete_detected.md b/chapters/file_delete_detected.md index 799c755..7a8166b 100644 --- a/chapters/file_delete_detected.md +++ b/chapters/file_delete_detected.md @@ -9,7 +9,6 @@ It leverages the Sysmon minidriver and we should considered it altitude number w The minidriver monitors for three I/O request packets (IRP) IRP_MJ_CREATE, IRP_MJ_CLEANUP, and IRP_MJ_WRITE for file creates, complete handle closes, and writes respectively. - ### Event information The file delete event fields are: @@ -18,7 +17,7 @@ The file delete event fields are: * **UtcTime**: Time in UTC when event was created -* **ProcessGuid**: Process Guid of the process that deletec the file +* **ProcessGuid**: Process Guid of the process that deleted the file * **ProcessId**: Process ID used by the OS to identify the process that deleted the file (child) @@ -28,5 +27,4 @@ The file delete event fields are: **Hashes**: Full hash of the file with the algorithms in the HashType field. This is also the filename of the saved file in the ArchiveDirectory -This event type is recomended for those cases where there is a large number of false positive for a given rule but still it is of value to log the action or the rule has false positives for files that could be of great size like archive file or image files like ISO, IMG and others. - +This event type is recommended for those cases where there is a large number of false positive for a given rule but still it is of value to log the action or the rule has false positives for files that could be of great size like archive file or image files like ISO, IMG and others. diff --git a/chapters/install_linux.md b/chapters/install_linux.md new file mode 100644 index 0000000..d7a09fc --- /dev/null +++ b/chapters/install_linux.md @@ -0,0 +1,54 @@ +Install and Configuration +========================= + +Installation under Linux varies given that each Linux distribution and even version of each differ slightly in the steps to install the packages for sysinternalsEBPF and sysmonforlinux. The package installation steps for each distribution and is maintained in github at . The solution can be compiled and installed from source but it is not recommended for a production environment since it will add more complexity in the tracking of versions of dependencies and also introduced other packages that can be abused by an attacker if they gain access tto the system. + +The package installation process will create a sysmon elf binary as /usr/bin/sysmon this binary will be used to install and configure the service. + +When using the tool, any errors will result in an error message and help information with basic switches. To see only the help information for the tool, the **-?** switch parameter is used. This help information will include: + +* Parameter sets for installation, configuration, and uninstall + +* Common command line parameters. + +* General notes on how the tool works and further details on how to get more help information. + +The parameters of the tool and the structure of the XML configuration file are defined in the tool Schema. This schema can be printed using the **-s "PrintSchema"** parameter; if no schema version is provided, it will print the default schema. + +The tool can be run in 4 main modes; 3 of them are shown in the help message: + +* **Install** - Install the driver, manifest and service on the host. + +* **Configure** - Parses a given configuration file or command line parameters to generate a configuration that is stored in the registry. + +* **Uninstall** - Removes the driver and service from the host. + +Installation +------------ + +The key parameter that initiates the installation mode of Sysmon is the **-i** switch. The installation process will be as follows: + +* Decompresses and copy of itself in to **/opt/sysmon** + +* Creates a systemd service + +* Enables a default configuration (ProcessCreation and ProcessTermination) if no configuration file is passed to the **-i** parameter. + +The **-accepteula** parameter needs to be passed to accept the EULA for the tool. + +Uninstall +--------- + +To uninstall Sysmon, a binary with the same name as the main service, if renamed, has to be run with the **-u** switch parameter. + +```bash +/opt/sysmon/sysmon -u +``` + +When executed the command will run a series of steps to uninstall the service and remove files for the tool from **/opt/sysmon**. + +The value of **force** can be passed to the **-u** parameter fo force uninstallation. + +```bash +/opt/sysmon/sysmon -u force +``` diff --git a/chapters/install_windows.md b/chapters/install_windows.md new file mode 100644 index 0000000..f682c8a --- /dev/null +++ b/chapters/install_windows.md @@ -0,0 +1,253 @@ +Install and Configuration +========================= + +* [Sysmon Command Line](#the-sysmon-command-line) + +* [Installation with Configuration](#installation-with-configuration) + + * [Uninstall](#uninstall) + + * [Installation Best Practice](#installation-best-practice) + +* [Configuration](#configuration) + + * [Command Line Parameters](#command-line-parameters) + + * [Filter Operators](#filter-operators) + + * [Event Schema](#event-schema) + + * [Configuration File](#configuration-file) + + * [RuleGroups](#rulegroups) + + * [Configuration File Best Practices](#configuration-file-best-practices) + + * [Configuration Tampering](#configuration-tampering) + + * [Configuration Deployment](#configuration-deployment) + + * [Deployment Script](#deployment-script) + + * [GPO Configuration Deployment](#gpo-configuration-deployment) + +The Sysmon Command Line +======================= + +Sysmon installation and configuration can be done via the command line. When Sysmon is downloaded from Microsoft, the zip file will contain two command line versions of the tool: + +* **Sysmon.exe** - x86 and x64 version. + +* **Sysmon64.exe** - 64bit only version. + +When using the tool, any errors will result in an error message and help information with basic switches. To see only the help information for the tool, the **-?** switch parameter is used. This help information will include: + +* Parameter sets for installation, configuration, and uninstall + +* Common command line parameters. + +* General notes on how the tool works and further details on how to get more help information. + +The parameters of the tool and the structure of the XML configuration file are defined in the tool Schema. This schema can be printed using the **-s "PrintSchema"** parameter; if no schema version is provided, it will print the default schema. + +The tool can be run in 4 main modes; 3 of them are shown in the help message: + +* **Install** - Install the driver, manifest and service on the host. + +* **Configure** - Parses a given configuration file or command line parameters to generate a configuration that is stored in the registry. + +* **Uninstall** - Removes the driver and service from the host. + +The semi-hidden and undocumented method is Debug, in which a specified configuration is parsed, and live events are shown in the console. + +Install +------- + +The key parameter that initiates the installation mode of Sysmon is the **-i** switch. The installation process will be as follows: + +* Decompresses and saves driver and copy of itself in to **%systemroot%** + +* Registers event log manifest + +* Creates a service + +* Enables a default configuration (ProcessCreation, ProcessTermination, DriverLoad , FileCreationTimeChanged, SHA1 for Images) if no configuration file is passed using the **-c \** parameter + +The Installation process allows for some obfuscation: + +* Driver name can be changed + +* Service name can be changed + +* Sysmon binary name can be renamed. + +These obfuscation changes will also affect registry paths for the driver and processes service keys. All of the obfuscation methods are part of the installation option set. + +The installation options are: + +* Default -- Driver is installed and named SysmonDrv and service Sysmon + +```shell +sysmon.exe --i --accepteula + +``` + +* Renamed Driver -- The driver file and registry entry are renamed. Name has an 8-character limit. + +```shell +sysmon.exe -i -d +``` + +* Renamed Service -- The executable name defines the service name. + +```shell +.exe -i -d +``` + +The installation process on a x64 system with the binary named sysmon.exe that is intended to work across x64 and x86 architectures is shown below. This is important since some of the actions may cause confusion or trigger alerts on monitoring systems. + +One important thing to keep in mind when obfuscating the driver name and service name is that certain characteristics remain the same. + +* Service description remains the same. (This can be modified post-install.) + +* Driver Altitude number remains the same. + +* The eventlog remains the same so as to not break collection from SIEM products. + +Process for x86 +--------------- + +![x86 bit insall process](./media/image6.png) + +x64 Process +----------- + +![x64 install process](./media/image7.png) + +Sysmon will create 2 registry keys to define the services for its operation under ***HKLM\\SYSTEM\\CurrentControlSet\\Services*** + +* Sysmon - Service that talks to the driver and performs the filtering action. It is named with the same name as the Sysmon executable. + +* SysmonDrv - Kernel Driver Service, this service loads the Sysmon driver with an altitude number of 385201 + +The settings for each service are: + +Main Service: + +* Name: **Name of the executable (default Sysmon or Sysmon64)** + +* LogOn: **Local System** + +* Description: **System Monitor service** + +* Startup: **Automatic** + +* ImagePath: **%windir%\\\** + +Driver Service: + +* Name: **SysmonDrv unless --d \ is** + +* LogOn: **Local System** + +* Description: **System Monitor driver** + +* Startup: **Automatic** + +* ImagePath: **\.sys** + +Installation with Configuration +------------------------------- +An XML configuration file can be passed during installation if an initial configuration needs to be set. This is the preferred method for production systems since a configuration file can cover all types and logic. The most used method is to pass a configuration file using the **-c \** parameter. + +```shell +sysmon.exe -i --accepteula -c +``` + +If the configuration specifies a archive folder using the `````` element the **-a \** needs to be specified in the command line so that Sysmon can create the folder and set the proper permissions for version 11.0 of Sysmon, for version 11.1 the parameter was removed and now it is configured via the configuration file. If the folder is not present and even if specified Sysmon will create a folder named **Sysmon** instead and use that folder to archive the deleted files. + +We can control the hashing algorithm used for events that hash images and we can control checking of revocation of signatures. + +The hashing algorithm or combination of them can be specified with the **-h \** The specified algorithms will be used to hash all images. + +```shell +sysmon.exe -i -c -h +``` + +We can specify checking to see if certificates are revoked using the -r parameter. + +```shell +sysmon.exe -i -c -r + +``` + +SSome basic filtering can be done also from the command line. Only filtering by process name can be done for NetworkConnect, ImageLoad, and ProcessAccess via the command line. + +* **NetworkConnect** - Track network connections. + +```shell +sysmon.exe -i -c -n [] +``` + +* **ImageLoad** - DLL loading by processes. + +```shell +sysmon.exe -i -c -l [] +``` + +* **ProcessAccess** - Processes whose memory is accessed. + +```shell +sysmon.exe -i -c -k [] +``` + +Uninstall +--------- + +To uninstall Sysmon, a binary with the same name as the main service, if renamed, has to be run with the **-u** switch parameter. + +```shell +sysmon.exe -u +``` + +When executed the command will run a series of steps to uninstall the service, driver and remove files for the tool. + +![Uninstall Process](./media/image8.png) + +There is an undocumented value that can be passed to the **-u** parameter of **"force"** to force the removal of the services even if a stop was not possible. + +```shell +sysmon.exe -u force +``` + +Installation Best Practice +-------------------------- + +Installation best practices that can be followed to aid and minimize risk when deploying the Sysmon tool include: + +* Keep a repository of Sysmon versions archived; Microsoft does not provide older versions for download. + +* Sysmon is very dependent on the version of the binary for its configuration. The install/upgrade script should check the binary version for: + + * Upgrade + + * Version for applying initial config + +* If a GPO is used to push scheduled tasks for upgrades or to push configuration, use a WMI filter to target the specific version that was tested. Example: + +```sql +SELECT * FROM CIM_Datafile WHERE (Name="c:\\Windows\\Sysmon64.exe" OR Name="c:\\Windows\\Sysmon.exe") AND version="10.0.4.1" +``` + +* Check file versions they don't match release versioning. + +* It is better to not push configuration as an XML that gets run from a share or dropped on disk with a scheduled task: + + * Credentials are left that can be recovered via DPAPI for deleted scheduled tasks. + + * The file can be read more easily by an attacker if controls are not properly placed + + * There is a higher chance of human error + + * Better to push values via GPO or other methods with file version checking. + diff --git a/chapters/media/image65.png b/chapters/media/image65.png new file mode 100644 index 0000000..a4e8dbd Binary files /dev/null and b/chapters/media/image65.png differ diff --git a/chapters/media/image66.png b/chapters/media/image66.png new file mode 100644 index 0000000..c6f0238 Binary files /dev/null and b/chapters/media/image66.png differ diff --git a/chapters/media/image67.png b/chapters/media/image67.png new file mode 100644 index 0000000..89738f4 Binary files /dev/null and b/chapters/media/image67.png differ diff --git a/chapters/media/image68.png b/chapters/media/image68.png new file mode 100644 index 0000000..22ee068 Binary files /dev/null and b/chapters/media/image68.png differ diff --git a/chapters/network-connections.md b/chapters/network-connections.md index 1f579c5..a21f724 100644 --- a/chapters/network-connections.md +++ b/chapters/network-connections.md @@ -3,7 +3,7 @@ Network Connections Sysmon will log **EventID 3** for all TCP and UDP network connections. This event will generate a large number of entries and filtering should be tuned for specific processes and ports. -For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering since it uses a reverse DNS Lookup to get this information, in Sysmon v11.0 this behaviour can be disabled by using the ```True``` at the root of the confifuration file. +For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering since it uses a reverse DNS Lookup to get this information, in Sysmon v11.0 this behaviour can be disabled by using the ```True``` at the root of the configuration file. For the DestinationPortName, the GetNameInfo API is used for the friendly name of ports. In the case of services doing connections on some systems due to memory use, they are hosted under svchost.exe and most connections will originate from this process. diff --git a/chapters/process-creation.md b/chapters/process-creation.md index b9772b9..d25ae53 100644 --- a/chapters/process-creation.md +++ b/chapters/process-creation.md @@ -5,7 +5,7 @@ Process Creation Sysmon will log **EventID 1** for the creation of any new process when it registers with the kernel. -Sysmon will generate a ProcessGuid and LogonGuid with the information it +On Windows Sysmon will generate a ProcessGuid and LogonGuid with the information it obtains and it will hash the process main image. The command line of the process will be parsed and logged in to eventlog. When storage permits a common practice is to log all processes and to filter out common day to @@ -19,15 +19,15 @@ The fields on a process creation event are: * **Image** -- Full path of the executable image that was executed. -* **FileVersion** -- File version filed in the image metadata. +* **FileVersion** -- File version filed in the image metadata. (Windows Only) -* **Description** -- Description field in the image metadata. +* **Description** -- Description field in the image metadata.(Windows Only) -* **Product** -- Product field in the image metadata. +* **Product** -- Product field in the image metadata. (Windows Only) -* **Company** - Company field in the image metadata. +* **Company** - Company field in the image metadata. (Windows Only) -* **OriginalFileName** -- Original image name if renamed. +* **OriginalFileName** -- Original image name if renamed. (Windows Only) * **CommandLine** -- Command line that executed the image. @@ -46,7 +46,7 @@ The fields on a process creation event are: * **IntegrityLevel** - Integrity label assigned to a process * **Hashes** - Full hash of the file with the algorithms in the - HashType field. + HashType field. (Windows Only) * **ParentProcessGuid** - ProcessGUID of the process that spawned/created the main process (child) @@ -59,8 +59,27 @@ The fields on a process creation event are: * **ParentCommandLine -** Arguments which were passed to the executable associated with the parent process -Sysmon offers an advantage over the regular process logging since it not +Sysmon offers an advantage over the regular process logging in Windows since it not only pulls the same information as with **EventID** **4688** but it also pulls information from the PE header, hashes the images for correlation with IOC databases like Virus Total and it also provides unique fields -when querying for events. \ No newline at end of file +when querying for events. + +In Linux the advantage provided by Sysmon is that the data is structured in a wa that makes it easier to parse and leverage in a SIEM that leverages the logs. Bellow is an auditd example of the "ping -c 8.8.8.8" command. + +```conf +type=PROCTITLE msg=audit(10/26/2021 12:51:14.046:1385) : proctitle=-bash +type=PATH msg=audit(10/26/2021 12:51:14.046:1385) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=401163 dev=08:05 mode=file,755 ouid=root ogid=root rdev=00:00 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 +type=PATH msg=audit(10/26/2021 12:51:14.046:1385) : item=0 name=/usr/bin/ping inode=394173 dev=08:05 mode=file,755 ouid=root ogid=root rdev=00:00 nametype=NORMAL cap_fp=net_raw cap_fi=none cap_fe=1 cap_fver=2 cap_frootid=0 +type=CWD msg=audit(10/26/2021 12:51:14.046:1385) : cwd=/root +type=EXECVE msg=audit(10/26/2021 12:51:14.046:1385) : argc=4 a0=ping a1=-c a2=3 a3=8.8.8.8 +type=SYSCALL msg=audit(10/26/2021 12:51:14.046:1385) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x55c090caa2b0 a1=0x55c090ca9050 a2=0x55c090cb0750 a3=0x8 items=2 ppid=9313 pid=10184 auid=carlos uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=5 comm=ping exe=/usr/bin/ping subj=unconfined key=(null) +``` + +Here is the same command logged in Sysmon where the event is contained in XML format. + +```xml +Oct 26 13:11:11 ubuntu sysmon: 154100x8000000000000000216077Linux-Sysmon/Operationalubuntu-2021-10-26 20:11:11.159{2424faa4-60df-6178-315b-20b68b550000}2669/usr/bin/ping-----ping -c 3 8.8.8.8/home/carlos/Desktopcarlos{2424faa4-0000-0000-e803-000000000000}10003no level-{2424faa4-60b3-6178-0517-a76010560000}2641/usr/bin/bashbashcarlos +``` + +In addition to this having a unique LogonGUID and ProcessGUID for correlation makes correlation much quicker. \ No newline at end of file diff --git a/chapters/process-events.md b/chapters/process-events.md index edec623..f2d6cab 100644 --- a/chapters/process-events.md +++ b/chapters/process-events.md @@ -2,12 +2,45 @@ Process Events ============== -Sysmon can log process creation, process termination and process access events. The process events are captured via ObjRegisterCallbacks at the kernel level using its driver, and contain a unique, deterministically generated ProcessGuid and LogonGuid that are unique to their process instance and LSA logon session respectively. +Sysmon can log process creation, process termination and process access events. For Windows the process events are captured via ObjRegisterCallbacks at the kernel level using its driver, and contain a unique, deterministically generated ProcessGuid and LogonGuid that are unique to their process instance and LSA logon session respectively. -The ProcessGuid and LoginGuid make tracking individual process and users much easier. The ProcessGuid attribute is used in all events associated with its process, and, unlike a ProcessID, will not be reused by the host system later. The LogonGuid attirbute similarly is assigned to a login session of a particular user, and will not be reused later as a LoginID would. +The ProcessGuid and LoginGuid make tracking individual process and users much easier. The ProcessGuid attribute is used in all events associated with its process, and, unlike a ProcessID, will not be reused by the host system later. The LogonGuid attribute similarly is assigned to a login session of a particular user, and will not be reused later as a LoginID would. ![ProcessGUID Source](./media/image31.png) +The ProcessGUID depending on the event and where in the process tree it +is, it will also be known by other names by its relation to the action +monitored. + +ProcessGUID is generated by Sysmon when Sysmon logs the event. ProcessGUID +specifically is not an attribute of the internal Windows process data structs +(EPROCESS). Sysmon keeps track of the GUID until the process exits. + +In Linux the process for generating the ProcessGuid is similar to Windows with the exception that the hexadecimal value in **/etc/machine-id**, this hexadecimal value is unique per host, it is usually generated from a random source during system installation or first boot and stays constant for all subsequent boots. Optionally, for stateless systems, it is generated during runtime during early boot if necessary. + +![Linux ProcessGUID Source](./media/image66.png) + +The ProcessGUIs is referenced in several events under different names. + +![ProcessGUID Relation](./media/image32.png) + +The only Event Types that will not reference a ProcessGuid or one of its +derived names are + +* WMI events + +* Kernel Driver Load + +All processes associated to a unique logon session can be mapped using the LogonGuid field. This field is generated using similar values as the ProcessGuid with the exception that instead of a process Id it uses in the case of Windows the Logon Session hexadecimal value and in the case of Linux the Logon Id to generate a unique identifier to match all actions taken. + +For Windows + +![LogonGuide Source](./media/image68.png) + +For Linux + +![Linux LogonGuide Source](./media/image67.png) + When a user logs onto on a modern version of Windows (Windows 2016/10) they will have 2 Logon IDs assigned if: @@ -18,24 +51,8 @@ they will have 2 Logon IDs assigned if: These sessions will be linked by a Linked Login ID in Successful Logon Event ID 4624, making the logging of this event important. -The ProcessGUID depending on the event and where in the process tree it -is, it will also be known by other names by its relation to the action -monitored. - -ProcessGUID is generated by Sysmon when Sysmon logs the event. ProcessGUID -specifically is not an attribute of the internal Windows process data structs -(EPROCESS). Sysmon keeps track of the GUID until the process exits. - -![ProcessGUID Relation](./media/image32.png) - -The only Event Types that will not reference a ProcessGuid or one of its -derived names are - -* WMI events - -* Kernel Driver Load - The image of the process is also related in other processes and can be used to track all actions related to a specific one. ![Image Relation](./media/image33.png) + diff --git a/chapters/raw-access-read.md b/chapters/raw-access-read.md index 5a30ef6..25d0c12 100644 --- a/chapters/raw-access-read.md +++ b/chapters/raw-access-read.md @@ -1,9 +1,11 @@ Raw Access Read =============== -Sysmon will log **EventID 9** for any process trying to read straight from a storage device by bypassing any filesystem restrictions that may be imposed by it. This information is logged by Sysmon leveraging its minifilter. This type of action is only done by drive imaging software or backup software in a normal operating environment. +Sysmon will log **EventID 9** for any process trying to read straight from a storage device by bypassing any filesystem restrictions that may be imposed by it. This information is logged by Sysmon on Windows by leveraging its minifilter. This type of action is only done by drive imaging software or backup software in a normal operating environment. -Attackers have been known to use this technique to copy NTDS.dit and SAM Registry Hives off host for the purpose of credential harvesting. +On Linux this event is logged when a block device is directly accessed and eBPF is used to detect this type of action. + +Attackers have been known to use this technique on Windows to copy NTDS.dit and SAM Registry Hives off host for the purpose of credential harvesting. In the case of Linux it is the raw access to the device for similar purposes too access credentials, key material and binaries of the system. The fields for the event are: @@ -19,7 +21,8 @@ The fields for the event are: * **Device**: Target device -Given that no process should be performing this action normally, it is best to log all instances of it or, even better, to target the NTDS.dit file on domain controllers and SAM hive file on all systems. On systems with many file modifications, slightly higher resource usage may result if monitoring is enabled for all files. +In the case of Windows given that no process should be performing this action normally, it is best to log all instances of it or, even better, to target the NTDS.dit file on domain controllers and SAM hive file on all systems. On systems with many file modifications, slightly higher resource usage may result if monitoring is enabled for all files. + Example that captures all instances of this event diff --git a/chapters/what-is-sysmon.md b/chapters/what-is-sysmon.md index 536526b..78c4f83 100644 --- a/chapters/what-is-sysmon.md +++ b/chapters/what-is-sysmon.md @@ -65,10 +65,8 @@ The Linux version supports given the OS and technologies a smaller number of eve |Sysmon Config Change| 16 |File Delete|23 - - The Sysmon version for Linux is an open-source version of the tool, developed to collect security events from Linux environments using eBPF (Extended Berkeley Packet Filter) and placing the captured events in to Syslog for easy consumption by existing centralized log collection solutions. -Sysmon for Linux use the sysinternalsEBPF library to allow it to capture actions against files on disk and network actions. eBPF is a technology that allows to run the program at the Kernel level in a sandbox allowing it to capture read and. Sysmon leverages this technology to capture information on processes, reads and writes to block devices and also for Socket and TCP/IP actions before they reach a network interface. This behaviour is similar to that of mini filter drivers in Windows that allow for the capture of events as they are executed by the APIs in the OS. +Sysmon for Linux use the sysinternalsEBPF library to allow it to capture actions against files on disk and network actions. eBPF is a technology that allows to run the program at the Kernel level in a sandbox allowing it to capture read and. Sysmon leverages this technology to capture information on processes, reads and writes to block devices and also for Socket and TCP/IP actions before they reach a network interface. This behavior is similar to that of mini filter drivers in Windows that allow for the capture of events as they are executed by the APIs in the OS. The sysinternalsEBPF and Sysmon for Linux are Open Source projects, this allows the community to contribute and to further expand the capabilities of the tools. They can be found at https://github.com/Sysinternals. Both Projects are written in C and in each repository they include documentation on how to build the utilities.