Introduction and Set Up of Sysmon
Log Analysis with Sysmon
Sysmon (System Monitor) is a robust tool from Microsoft Sysinternals that offers in-depth system activity logging, making it invaluable for forensic investigations and incident response. It logs critical system events such as process creation, network connections, and file changes, helping to detect and analyze malicious activities.
Key Features of Sysmon
Process Creation Monitoring:
Logs detailed information about new processes.
Network Connection Monitoring:
Tracks outbound network activity, identifying unusual communications.
File Creation Monitoring:
Monitors file creation events, including in sensitive directories.
Registry and Event Log Monitoring:
Captures changes to registry keys and event logs, which are often used for persistence.
DNS Query Monitoring:
Tracks DNS requests to detect suspicious domain lookups.
Sysmon Installation and Configuration
Step 1: Download and Install
Install Sysmon with default configuration:
Step 2: Use a Custom Configuration
For more granular control, use an XML configuration file:
A good starting point is the SwiftOnSecurity SysmonConfig file, which provides a well-optimized configuration for threat detection.
Sysmon Event IDs
Sysmon logs events in the Windows Event Viewer under: Applications and Services Logs → Microsoft → Windows → Sysmon/Operational
Key Event IDs:
Event ID 1: Process Creation
Event ID 3: Network Connections
Event ID 6: Driver Loaded
Event ID 7: Image Loaded
Event ID 11: File Creation
Event ID 12/13: Registry Object Created/Modified
Event ID 22: DNS Query
Log Analysis Techniques
1. Process Creation (Event ID: 1)
Purpose: Detect malicious or unexpected processes.
Example: Identify suspicious executions like
powershell.exeorcmd.exerunning encoded scripts.
PowerShell Command:
Look for:
Parent-Child relationships (e.g.,
winword.exespawningpowershell.exe).Command-line arguments for encoded or obfuscated scripts.
2. Network Connections (Event ID: 3)
Purpose: Detect outbound connections to suspicious IPs or domains.
Example: Spot C2 communication or data exfiltration.
PowerShell Command:
Look for:
Unusual destination IPs or ports (e.g., outbound traffic to a known malicious IP).
Abnormal traffic patterns, such as frequent connections on non-standard ports.
3. File Creation (Event ID: 11)
Purpose: Identify suspicious files or dropped payloads.
Example: Detect file creation in sensitive directories like
C:\Windows\System32.
PowerShell Command:
Look for:
Unexpected files in critical directories.
Known malicious file names or extensions.
4. Registry Modification (Event IDs: 12, 13)
Purpose: Monitor registry changes for persistence mechanisms.
Example: Detect modifications in
HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
PowerShell Command:
Look for:
Registry keys associated with startup or scheduled tasks.
Persistence mechanisms like registry-based malware.
5. DNS Query (Event ID: 22)
Purpose: Track DNS queries for potentially malicious domains.
Example: Identify lookups for suspicious or newly registered domains.
PowerShell Command:
Look for:
Domains flagged in threat intelligence feeds.
Uncommon domains queried by critical processes.
Real-World Use Cases
Persistence Mechanism Detection:
Analyze process and registry modification logs to identify persistence techniques (e.g., startup scripts or registry keys).
Lateral Movement Detection:
Monitor network connections for lateral movement via SMB or RDP.
Malware Execution:
Spot unusual process chains (e.g.,
winword.exe→powershell.exe).
Data Exfiltration:
Track large outbound connections to suspicious IPs.
Best Practices for Sysmon Deployment
Custom Configuration:
Use tailored XML configs like SwiftOnSecurity's SysmonConfig for precise logging.
Integration with SIEM:
Forward Sysmon logs to a SIEM (e.g., Splunk, Elastic) for real-time alerting and correlation.
Regular Review:
Periodically review logs to ensure anomalies are detected promptly.
Minimize Noise:
Adjust filters in the Sysmon configuration to focus on high-value events.
Key Points
Sysmon is a powerful tool that provides deep visibility into system activities. By leveraging its detailed logs, analysts can detect and respond to threats with greater accuracy. Combined with robust configurations and integration into SIEM solutions, Sysmon becomes a cornerstone of any incident detection and response strategy.
Last updated