Introduction and Set Up of Sysmon

Log Analysis with Sysmon

Sysmon (System Monitor) is a robust tool from Microsoft Sysinternals that offers in-depth system activity logging, making it invaluable for forensic investigations and incident response. It logs critical system events such as process creation, network connections, and file changes, helping to detect and analyze malicious activities.

---

Key Features of Sysmon

1. Process Creation Monitoring:

   • Logs detailed information about new processes.

2. Network Connection Monitoring:

   • Tracks outbound network activity, identifying unusual communications.

3. File Creation Monitoring:

   • Monitors file creation events, including in sensitive directories.

4. Registry and Event Log Monitoring:

   • Captures changes to registry keys and event logs, which are often used for persistence.

5. DNS Query Monitoring:

   • Tracks DNS requests to detect suspicious domain lookups.

---

Sysmon Installation and Configuration

Step 1: Download and Install

• Download Sysmon from the Sysinternals website.

• Install Sysmon with default configuration:

  sysmon -i

Step 2: Use a Custom Configuration

• For more granular control, use an XML configuration file:

  sysmon -i sysmonconfig.xml

• A good starting point is the SwiftOnSecurity SysmonConfig file, which provides a well-optimized configuration for threat detection.

---

Sysmon Event IDs

Sysmon logs events in the Windows Event Viewer under: Applications and Services Logs → Microsoft → Windows → Sysmon/Operational

Key Event IDs:

• Event ID 1: Process Creation

• Event ID 3: Network Connections

• Event ID 6: Driver Loaded

• Event ID 7: Image Loaded

• Event ID 11: File Creation

• Event ID 12/13: Registry Object Created/Modified

• Event ID 22: DNS Query

---

Log Analysis Techniques

1. Process Creation (Event ID: 1)

Purpose: Detect malicious or unexpected processes.

• Example: Identify suspicious executions like powershell.exe or cmd.exe running encoded scripts.

PowerShell Command:

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 1}

Look for:

• Parent-Child relationships (e.g., winword.exe spawning powershell.exe).

• Command-line arguments for encoded or obfuscated scripts.

2. Network Connections (Event ID: 3)

Purpose: Detect outbound connections to suspicious IPs or domains.

• Example: Spot C2 communication or data exfiltration.

PowerShell Command:

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 3}

Look for:

• Unusual destination IPs or ports (e.g., outbound traffic to a known malicious IP).

• Abnormal traffic patterns, such as frequent connections on non-standard ports.

3. File Creation (Event ID: 11)

Purpose: Identify suspicious files or dropped payloads.

• Example: Detect file creation in sensitive directories like C:\Windows\System32.

PowerShell Command:

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 11}

Look for:

• Unexpected files in critical directories.

• Known malicious file names or extensions.

4. Registry Modification (Event IDs: 12, 13)

Purpose: Monitor registry changes for persistence mechanisms.

• Example: Detect modifications in HKLM\Software\Microsoft\Windows\CurrentVersion\Run.

PowerShell Command:

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 13}

Look for:

• Registry keys associated with startup or scheduled tasks.

• Persistence mechanisms like registry-based malware.

5. DNS Query (Event ID: 22)

Purpose: Track DNS queries for potentially malicious domains.

• Example: Identify lookups for suspicious or newly registered domains.

PowerShell Command:

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 22}

Look for:

• Domains flagged in threat intelligence feeds.

• Uncommon domains queried by critical processes.

Real-World Use Cases

1. Persistence Mechanism Detection:

   • Analyze process and registry modification logs to identify persistence techniques (e.g., startup scripts or registry keys).

2. Lateral Movement Detection:

   • Monitor network connections for lateral movement via SMB or RDP.

3. Malware Execution:

   • Spot unusual process chains (e.g., winword.exe → powershell.exe).

4. Data Exfiltration:

   • Track large outbound connections to suspicious IPs.

---

Best Practices for Sysmon Deployment

1. Custom Configuration:

   • Use tailored XML configs like SwiftOnSecurity's SysmonConfig for precise logging.

2. Integration with SIEM:

   • Forward Sysmon logs to a SIEM (e.g., Splunk, Elastic) for real-time alerting and correlation.

3. Regular Review:

   • Periodically review logs to ensure anomalies are detected promptly.

4. Minimize Noise:

   • Adjust filters in the Sysmon configuration to focus on high-value events.

---

Key Points

Sysmon is a powerful tool that provides deep visibility into system activities. By leveraging its detailed logs, analysts can detect and respond to threats with greater accuracy. Combined with robust configurations and integration into SIEM solutions, Sysmon becomes a cornerstone of any incident detection and response strategy.