# Introduction and Set Up of Sysmon

## **Log Analysis with Sysmon**

**Sysmon** (System Monitor) is a robust tool from Microsoft Sysinternals that offers in-depth system activity logging, making it invaluable for forensic investigations and incident response. It logs critical system events such as process creation, network connections, and file changes, helping to detect and analyze malicious activities.

***

## **Key Features of Sysmon**

1. **Process Creation Monitoring**:
   * Logs detailed information about new processes.
2. **Network Connection Monitoring**:
   * Tracks outbound network activity, identifying unusual communications.
3. **File Creation Monitoring**:
   * Monitors file creation events, including in sensitive directories.
4. **Registry and Event Log Monitoring**:
   * Captures changes to registry keys and event logs, which are often used for persistence.
5. **DNS Query Monitoring**:
   * Tracks DNS requests to detect suspicious domain lookups.

***

## **Sysmon Installation and Configuration**

### **Step 1: Download and Install**

* **Download** Sysmon from the [Sysinternals website](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon).
* **Install** Sysmon with default configuration:

  ```bash
  sysmon -i
  ```

### **Step 2: Use a Custom Configuration**

* For more granular control, use an XML configuration file:

  ```bash
  sysmon -i sysmonconfig.xml
  ```
* A good starting point is the **SwiftOnSecurity SysmonConfig** file, which provides a well-optimized configuration for threat detection.

***

## **Sysmon Event IDs**

Sysmon logs events in the **Windows Event Viewer** under: **Applications and Services Logs → Microsoft → Windows → Sysmon/Operational**

Key Event IDs:

* **Event ID 1**: Process Creation
* **Event ID 3**: Network Connections
* **Event ID 6**: Driver Loaded
* **Event ID 7**: Image Loaded
* **Event ID 11**: File Creation
* **Event ID 12/13**: Registry Object Created/Modified
* **Event ID 22**: DNS Query

***

## **Log Analysis Techniques**

### **1. Process Creation (Event ID: 1)**

**Purpose**: Detect malicious or unexpected processes.

* **Example**: Identify suspicious executions like `powershell.exe` or `cmd.exe` running encoded scripts.

**PowerShell Command**:

```powershell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 1}
```

**Look for**:

* Parent-Child relationships (e.g., `winword.exe` spawning `powershell.exe`).
* Command-line arguments for encoded or obfuscated scripts.

### **2. Network Connections (Event ID: 3)**

**Purpose**: Detect outbound connections to suspicious IPs or domains.

* **Example**: Spot C2 communication or data exfiltration.

**PowerShell Command**:

```powershell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 3}
```

**Look for**:

* Unusual destination IPs or ports (e.g., outbound traffic to a known malicious IP).
* Abnormal traffic patterns, such as frequent connections on non-standard ports.

### **3. File Creation (Event ID: 11)**

**Purpose**: Identify suspicious files or dropped payloads.

* **Example**: Detect file creation in sensitive directories like `C:\Windows\System32`.

**PowerShell Command**:

```powershell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 11}
```

**Look for**:

* Unexpected files in critical directories.
* Known malicious file names or extensions.

### **4. Registry Modification (Event IDs: 12, 13)**

**Purpose**: Monitor registry changes for persistence mechanisms.

* **Example**: Detect modifications in `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`.

**PowerShell Command**:

```powershell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 13}
```

**Look for**:

* Registry keys associated with startup or scheduled tasks.
* Persistence mechanisms like registry-based malware.

### **5. DNS Query (Event ID: 22)**

**Purpose**: Track DNS queries for potentially malicious domains.

* **Example**: Identify lookups for suspicious or newly registered domains.

**PowerShell Command**:

```powershell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 22}
```

**Look for**:

* Domains flagged in threat intelligence feeds.
* Uncommon domains queried by critical processes.

## **Real-World Use Cases**

1. **Persistence Mechanism Detection**:
   * **Analyze** process and registry modification logs to identify persistence techniques (e.g., startup scripts or registry keys).
2. **Lateral Movement Detection**:
   * **Monitor** network connections for lateral movement via SMB or RDP.
3. **Malware Execution**:
   * **Spot** unusual process chains (e.g., `winword.exe` → `powershell.exe`).
4. **Data Exfiltration**:
   * **Track** large outbound connections to suspicious IPs.

***

## **Best Practices for Sysmon Deployment**

1. **Custom Configuration**:
   * Use tailored XML configs like **SwiftOnSecurity's SysmonConfig** for precise logging.
2. **Integration with SIEM**:
   * Forward Sysmon logs to a SIEM (e.g., Splunk, Elastic) for real-time alerting and correlation.
3. **Regular Review**:
   * Periodically review logs to ensure anomalies are detected promptly.
4. **Minimize Noise**:
   * Adjust filters in the Sysmon configuration to focus on high-value events.

***

## Key Points

Sysmon is a powerful tool that provides deep visibility into system activities. By leveraging its detailed logs, analysts can detect and respond to threats with greater accuracy. Combined with robust configurations and integration into SIEM solutions, Sysmon becomes a cornerstone of any incident detection and response strategy.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/lets-defend/incident-responder-path/log-analysis-with-sysmon/introduction-and-set-up-of-sysmon.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.