Sysmon Config

https://github.com/swiftonsecurity/sysmon-config
Admin
Sysmon Config is a Microsoft Sysinternals Sysmon configuration file template providing high-quality...
Tokens:3,975
Snippets:26
Trust Score:6.1
Update:7 months ago
Show doc for...
Tokens:
Raw
### Install Sysmon with Configuration (PowerShell)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Installs the Sysmon service and driver using the provided configuration file. Requires administrator rights. Ensure Sysmon is downloaded from Microsoft Sysinternals first.

```powershell
# Download Sysmon from Microsoft Sysinternals
# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

# Install Sysmon with the configuration
sysmon.exe -accepteula -i sysmonconfig-export.xml
```

--------------------------------

### Sysmon Rule Example with Multiple Conditions (XML)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Demonstrates an example Sysmon rule group using multiple filter conditions for process creation monitoring. It includes conditions for command line arguments and image paths, showcasing how to combine different matching criteria.

```xml
<!--Example using multiple conditions-->
<RuleGroup name="CustomDetection" groupRelation="or">
    <ProcessCreate onmatch="include">
        <CommandLine condition="contains all">powershell;-enc</CommandLine>
        <CommandLine condition="contains any">Invoke-Mimikatz;Invoke-Expression</CommandLine>
        <Image condition="image">powershell.exe</Image>
    </ProcessCreate>
</RuleGroup>
```

--------------------------------

### Monitor File Creation with Sysmon

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Configures Sysmon Event ID 11 to monitor the creation of executable files, scripts, and files in sensitive system locations. This helps detect persistence mechanisms and unauthorized driver installations.

```xml
<RuleGroup name="" groupRelation="or">
    <FileCreate onmatch="include">
        <TargetFilename name="T1023" condition="contains">\Start Menu</TargetFilename>
        <TargetFilename name="T1165" condition="contains">\Startup\</TargetFilename>
        <TargetFilename name="EXE" condition="end with">.exe</TargetFilename>
        <TargetFilename name="DLL" condition="end with">.dll</TargetFilename>
        <TargetFilename condition="end with">.ps1</TargetFilename>
        <TargetFilename condition="end with">.bat</TargetFilename>
        <TargetFilename condition="end with">.vbs</TargetFilename>
        <TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename>
        <TargetFilename name="T1053" condition="begin with">C:\Windows\system32\Tasks</TargetFilename>
    </FileCreate>
</RuleGroup>
```

--------------------------------

### Update Sysmon Configuration (PowerShell)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Updates the configuration of an already installed Sysmon instance with new rules from the specified configuration file. This command applies the changes without requiring a service restart.

```powershell
# Update configuration on systems with Sysmon already installed
sysmon.exe -c sysmonconfig-export.xml
```

--------------------------------

### Sysmon Global Configuration Options

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Configures global Sysmon settings including hash algorithms for file monitoring and certificate revocation checking for loaded drivers. This XML snippet defines the schema version and specifies MD5, SHA256, and IMPHASH algorithms, along with enabling revocation checks.

```xml
<Sysmon schemaversion="4.50">
    <!--Generate MD5, SHA256, and Import Hash for all monitored files-->
    <HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms>

    <!--Check code-signing certificate revocation status for loaded drivers-->
    <CheckRevocation/>

    <EventFiltering>
        <!-- All event rules go here -->
    </EventFiltering>
</Sysmon>
```

--------------------------------

### Configure Sysmon for Windows Event Forwarding (WEF)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Sets up Windows Event Forwarding (WEF) to centrally collect Sysmon logs. This PowerShell command grants the Network Service account necessary permissions to access Sysmon operational logs, enabling their forwarding to a SIEM or central log management system.

```powershell
# Allow Network Service access to Sysmon logs for Windows Event Forwarding
wevtutil.exe sl Microsoft-Windows-Sysmon/Operational /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS)
```

--------------------------------

### Sysmon Event ID 1: Process Creation Rule (XML)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Monitors all process launches, excluding specific trusted Windows processes and common exclusions like Chrome subprocesses. This rule is crucial for detecting malware execution and suspicious command-line activities. It logs detailed information about the process, its parent, and command line arguments.

```xml
<!--SYSMON EVENT ID 1 : PROCESS CREATION [ProcessCreate]-->
<!--DATA: UtcTime, ProcessGuid, ProcessID, Image, FileVersion, Description, Product, Company, CommandLine, CurrentDirectory, User, LogonGuid, LogonId, TerminalSessionId, IntegrityLevel, Hashes, ParentProcessGuid, ParentProcessId, ParentImage, ParentCommandLine, RuleName-->

<RuleGroup name="" groupRelation="or">
    <ProcessCreate onmatch="exclude">
        <!--Exclude trusted Windows processes-->
        <CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine>
        <Image condition="is">C:\Windows\system32\conhost.exe</Image>
        <IntegrityLevel condition="is">AppContainer</IntegrityLevel>

        <!--Exclude trusted Microsoft Office Click2Run-->
        <ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</ParentImage>

        <!--Exclude Chrome subprocess spam-->
        <CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine>
    </ProcessCreate>
</RuleGroup>
```

--------------------------------

### Monitor Kernel Driver Loads with Sysmon

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Configures Sysmon Event ID 6 to detect potential rootkit activity by monitoring kernel driver loads. It uses an exclusion list to filter out trusted signatures from Microsoft and Intel.

```xml
<RuleGroup name="" groupRelation="or">
    <DriverLoad onmatch="exclude">
        <Signature condition="contains">microsoft</Signature>
        <Signature condition="contains">windows</Signature>
        <Signature condition="begin with">Intel </Signature>
    </DriverLoad>
</RuleGroup>
```

--------------------------------

### Sysmon Filter Conditions Reference (XML)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Lists and describes available filter conditions for Sysmon rules, including exact match, containment, and numeric comparisons. These conditions are used within Sysmon's XML configuration to define precise matching criteria for event logs.

```xml
<!--Available filter conditions for use in rules-->
<!--
    is          - Exact string match
    is not      - Does not match exactly
    contains    - String contains value
    contains any - String contains any of the semicolon-separated values
    contains all - String contains all of the semicolon-separated values
    excludes    - String does not contain value
    excludes any - String does not contain any of the values
    excludes all - String does not contain all of the values
    begin with  - String starts with value
    end with    - String ends with value
    less than   - Numeric comparison
    more than   - Numeric comparison
    image       - Matches filename or full path (special for Image fields)
-->
```

--------------------------------

### View and Filter Sysmon Events in Event Viewer

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Provides instructions on how to view Sysmon events in the Windows Event Viewer and how to apply a filter to exclude specific event IDs. The filter '-22' is used to hide DNS query events (Event ID 22) from the display.

```powershell
# View Sysmon events in Event Viewer
# Path: Applications and Services Logs > Microsoft > Windows > Sysmon > Operational

# Filter out DNS events from Event Viewer display (Event ID 22)
# Apply filter: -22
```

--------------------------------

### Monitor Registry Modifications (Event IDs 12, 13, 14)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Monitors registry key modifications for persistence techniques (T1060), service manipulation (T1031, T1050), security tampering (T1089), and IFEO injection (T1183), and COM hijacking (T1122). This configuration uses Sysmon's RegistryEvent rule to include specific target object patterns.

```xml
<RuleGroup name="" groupRelation="or">
    <RegistryEvent onmatch="include">
        <!--Monitor Run key persistence (T1060)-->
        <TargetObject name="T1060,RunKey" condition="contains">CurrentVersion\Run</TargetObject>
        <!--Monitor services modifications-->
        <TargetObject name="T1031,T1050" condition="end with">\ServiceDll</TargetObject>
        <TargetObject name="T1031,T1050" condition="end with">\ImagePath</TargetObject>
        <!--Monitor security tampering-->
        <TargetObject name="T1089,Tamper-Defender" condition="end with">\DisableAntiSpyware</TargetObject>
        <TargetObject name="T1088" condition="end with">Policies\System\EnableLUA</TargetObject>
        <!--Monitor IFEO injection (T1183)-->
        <TargetObject name="T1183,IFEO" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\</TargetObject>
        <!--Monitor COM hijacking (T1122)-->
        <TargetObject name="T1122" condition="end with">\InprocServer32(Default)</TargetObject>
    </RegistryEvent>
</RuleGroup>
```

--------------------------------

### Uninstall Sysmon (PowerShell)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Completely removes the Sysmon service and driver from the system. This action will stop all monitoring activities performed by Sysmon.

```powershell
# Uninstall Sysmon service and driver
sysmon.exe -u
```

--------------------------------

### Monitor DNS Queries (Event ID 22)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Monitors DNS queries to detect command-and-control communication and data exfiltration, while excluding known-good domains. This configuration uses Sysmon's DnsQuery rule with an 'exclude' match to filter out legitimate queries from Microsoft, certificate validation services, and reverse DNS lookups.

```xml
<RuleGroup name="" groupRelation="or">
    <DnsQuery onmatch="exclude">
        <!--Exclude Microsoft domains-->
        <QueryName condition="end with">.microsoft.com</QueryName>
        <QueryName condition="end with">.windows.com</QueryName>
        <QueryName condition="end with">.windowsupdate.com</QueryName>
        <!--Exclude OCSP/CRL for certificate validation-->
        <QueryName condition="end with">.digicert.com</QueryName>
        <QueryName condition="is">ocsp.msocsp.com</QueryName>
        <!--Exclude reverse DNS lookups-->
        <QueryName condition="end with">.arpa</QueryName>
        <!--Note: Do NOT exclude wpad - this is a common MitM vector-->
    </DnsQuery>
</RuleGroup>
```

--------------------------------

### Detect Remote Thread Creation with Sysmon

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Configures Sysmon Event ID 8 to identify process injection attempts (MITRE ATT&CK T1055). It excludes known legitimate system processes and kernel modules to reduce false positives.

```xml
<RuleGroup name="" groupRelation="or">
    <CreateRemoteThread onmatch="exclude">
        <SourceImage condition="is">C:\Windows\system32\wbem\WmiPrvSE.exe</SourceImage>
        <SourceImage condition="is">C:\Windows\system32\svchost.exe</SourceImage>
        <SourceImage condition="is">C:\Windows\system32\csrss.exe</SourceImage>
        <SourceImage condition="is">C:\Windows\system32\services.exe</SourceImage>
        <StartModule condition="is">C:\Windows\system32\kernel32.dll</StartModule>
    </CreateRemoteThread>
</RuleGroup>
```

--------------------------------

### Sysmon Event ID 2: File Creation Time Changed Rule (XML)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Detects modifications to file creation timestamps, a technique known as timestomping used by attackers to conceal their activities (MITRE ATT&CK T1099). This rule includes exclusions for trusted processes and specific conditions to identify suspicious timestamp changes, such as those originating from Volume Shadow Copies.

```xml
<!--SYSMON EVENT ID 2 : FILE CREATION TIME RETROACTIVELY CHANGED [FileCreateTime]-->
<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, PreviousCreationUtcTime-->

<RuleGroup name="" groupRelation="or">
    <FileCreateTime onmatch="include">
        <!--Detect timestomping in user directories-->
        <Image name="T1099" condition="begin with">C:\Users</Image>
        <!--Alert on any executable with modified timestamps-->
        <TargetFilename name="T1099" condition="end with">.exe</TargetFilename>
        <!--Detect writes from Volume Shadow Copies-->
        <Image name="T1099" condition="begin with">\Device\HarddiskVolumeShadowCopy</Image>
    </FileCreateTime>
</RuleGroup>
```

--------------------------------

### Monitor Network Connections with Sysmon

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Configures Sysmon Event ID 3 to track network activity from suspicious tools and locations. It monitors specific processes like powershell.exe and common lateral movement ports such as 22 and 3389.

```xml
<RuleGroup name="" groupRelation="or">
    <NetworkConnect onmatch="include">
        <Image name="Usermode" condition="begin with">C:\Users</Image>
        <Image condition="image">powershell.exe</Image>
        <Image condition="image">cmd.exe</Image>
        <Image condition="image">certutil.exe</Image>
        <Image condition="image">mshta.exe</Image>
        <Image condition="image">wmic.exe</Image>
        <Image condition="image">rundll32.exe</Image>
        <DestinationPort name="SSH" condition="is">22</DestinationPort>
        <DestinationPort name="RDP" condition="is">3389</DestinationPort>
        <DestinationPort name="Alert,Metasploit" condition="is">4444</DestinationPort>
    </NetworkConnect>
</RuleGroup>
```

--------------------------------

### Detect Malicious Named Pipes (Event IDs 17, 18)

Source: https://context7.com/swiftonsecurity/sysmon-config/llms.txt

Detects the creation and connection of named pipes used by malicious tools such as Cobalt Strike, Metasploit, and credential dumping utilities. This configuration uses Sysmon's PipeEvent rule to include specific pipe name patterns associated with these threats.

```xml
<RuleGroup name="" groupRelation="or">
    <PipeEvent onmatch="include">
        <!--Remote Command Execution Tools-->
        <PipeName condition="contains any">paexec;remcom;csexec</PipeName>
        <!--Credential Dumping Tools-->
        <PipeName condition="contains any">\lsadump;\cachedump;\wceservicepipe</PipeName>
        <!--Cobalt Strike Indicators-->
        <PipeName condition="contains all">MSSE;-server</PipeName>
        <PipeName condition="begin with">\postex_</PipeName>
        <PipeName condition="begin with">\msagent_</PipeName>
        <!--Known Malware Pipes-->
        <PipeName condition="contains any">\isapi_http;\gruntsvc;\bizkaz</PipeName>
    </PipeEvent>
</RuleGroup>
```
Tokens:
Raw