A curated list of resources for learning about deploying, managing and hunting with Microsoft Sysmon. Contains presentations, deployment methods, configuration file examples, blogs and additional github repositories.
- General
- Presentations
- How to Go from Responding to Hunting with Sysinternals Sysmon - Mark Russinovich
- Tracking Hackers on Your Network with Sysinternals Sysmon - Mark Russinovich
- Advanced Incident Detection and Threat Hunting using Sysmon and Splunk Video - Tom Ueltschi
- Advanced Incident Detection and Threat Hunting using Sysmon and Splunk Slides - Tom Ueltschi
- Splunking the Endpoint - James Brodsky
- Splunking the Endpoint: “Hands on!” Ransomware Edition - James Brodsky & Dimitri McKay
- Graylog
- ELK
- Splunk
- RSA Netwitness
- Deploy Sysmon
- Sysmon Configuration Files
- Microsoft System Center
- Blogs
- Detecting (Some) Malicious Office Documents Using Sysmon - @malwaresoup
- Chronicles of a Threat Hunter: Hunting for WMImplant with Sysmon and ELK - Part I - Roberto Rodriguez
- Chronicles of a Threat Hunter: Hunting for In-Memory Mimikatz with Sysmon and ELK - Part I (Event ID 7) - Roberto Rodriguez
- Effectively analysing sysmon logs - Adrian Shaw
- Explaining and adapting Tay’s Sysmon configuration - Lennart Koopmann
- Detecting Lateral Movement Using Sysmon and Splunk - David French
- Setting up Elasticsearch 5.x – Sending Windows Logs using WinLogbeat 5.x Part 2/3 - Pablo Delgado
- Advanced Sysmon filtering using Logstash - Pablo Delgado
- Sample sysmon events and the schema you can expect in Sysmon v6 - @williballenthin
- Sysmon Woes, Elasticsearch and MITRE’s ATT&CK Matrix - Black Lantern Security
- Parsing Sysmon Events for IR Indicators - CrowdStrike
- Detecting Advanced Threats with Sysmon, WEF and ElasticSearch - Joshua Lewis
- Sysinternals New Tool Sysmon (System Monitor) - Carlos Perez
- Putting attackers in hi vis jackets with sysmon - Adrian Shaw
- Sample sysmon events and the schema you can expect in Sysmon v6 - @williballenthin
- Sysmon Github Projects
- Presentations
@SwiftOnSecurity config
Recommended.
Config will assist with bringing you up to speed in relation to critical process monitoring, network utilization, and so on. Note that the concept is to not log everything, but the most important items.
https://github.com/SwiftOnSecurity/sysmon-config
Sysmon_config.xml
Solid, detailed config. Probably one of the best ones out there in relation to completeness.
Sysmon-a.cfg
Basic config that will monitor critical Windows process execution. Very basic, but a good config to get used to sysmon and how things operate.
Blog post by blacklanternsecurity
Sysmon-b.cfg
Crypsis Group published config and PDF. Fairly detailed list of excludes that should assist with understanding how they work and get a configuration started.
Sysmon-c.cfg
Great configuration to understand excludes and contains.
Sysmon-d.cfg
Solid blog post related to getting started with Sysmon. Config is nicely laid out and easy to understand.
Sysmon-e.cfg
Config is specific but it provides a good foundation for capturing a lot of specific data.
https://github.com/Prevenity/sysmon
(Translated comments to english)
StartLogging.xml
Provided by https://github.com/VVard0g - Roberto Rodriguez
https://gist.github.com/VVard0g/136481552d8845e52962534d1a4b8664
Sysmoncfg_v2|31.xml
Related material from Splunking the Endpoint .conf talk by James Brodsky and Dimitri McKay.
Splunking the Endpoint - Files from presentation
Configs are optimized for Splunk.
Additional configs
Configs are updated frequently --
SwiftOnSecurity Fork by Ion-Storm
Server Config: https://gist.github.com/Neo23x0/a4b4af9481e01e749409
Client config: https://gist.github.com/Neo23x0/f56bea38d95040b70cf5