Okay, so this talk is about the importance of Sysmon for investigations. I'm Extreme
Paperclip. Who am I exactly? Digital forensics nerd, Linux geek, infosec dork, lifelong student
of everything, amateur history buff, spice fanatic, loads of fun. You can follow me on
the Twitters, but I'm probably not that interesting. Okay. What this talk is and is not about. This
talk is not an advanced guide to Sysmon. What it is, is basically just a simple intro to
Sysmon.
Here are a few things we're going to talk about. We're going to talk about what is Sysmon,
an overview of the Sysmon events, what is the Sysmon config. We'll go over installing
Sysmon and some examples of my favorite Sysmon events and some Sysmon examples for an investigation.
Okay, so you're probably asking,
really, just cut to the chase and tell me, what is Sysmon? Okay, here's the TLDR. Sysmon
creates the logs that should exist in Windows event logs by default, but do not. Sysmon
creates very unique event logs specific for security. Think of it that way. Here are some
more facts about Sysmon.
sysmon so sysmon was created by mark racinevich and thomas garnier sysmon is short for system
monitor it's a part of the windows sys internal suite sysmon was released in 2014 it's
both a device driver and a service and it creates logs specifically for security you could say
a very brief history of sysmon so it was first released in 2014
and it initially only had three event ids event id 1 which shows a process created
event id 2 a process changed a
file from jeni kays' web logUE file creation time and event id 3
network connection this little snippet right here I took from web archive
so let's do it an overview here of the sysmon events
the latest version of Sysmon has 26 event ids it's version 1334,
and you can see there that it was recently
released in May 2022. Note, also, there's also a version for Linux. This is a recent thing.
I'm not going to go into it on this talk, but it's something you should check out.
Okay, let's go over all the events. Don't worry, we're not going to deep dive into these.
So, let's do an overview of these events. Event ID 1, like I said earlier, is process creation.
Some of the things that are really interesting about event ID 1, of course, two things, in my opinion.
You're going to see the command line, and you're going to get a hash of the process. It's very useful.
I'm going to go a little quicker here.
So, event ID 2, the process changed, the file creation time.
Event ID 3, network connection, very useful.
Event ID 4, Sysmon service state changed. You can see in the logs if Sysmon was stopped.
And, of course, event ID 5, the process was terminated.
Event ID 6, a driver was loaded.
This can be...
This can be very useful.
Event ID 7 is image loaded.
Now, think of an image, not like a picture.
In the world of Sysmon, an image is basically an executable.
Event ID 8 is create remote thread.
Event ID 9, raw access read.
Event ID 10, process access.
Now, event ID 11, process access.
ID 10 can be very useful.
For example, at finding evidence of Mimi cats.
Event ID 11 file create also very useful.
You can see something like if a somebody ran a query to spit out bloodhound zip, you're
going to see that that file was created.
Event ID 12, these are you could think of these as the registry events here.
This one, event ID 12 talks about an object was created or deleted in the registry.
Event ID 13 shows you the value that was set for that registry event and event ID 14 talks
about the key and value rename.
Okay.
Event ID 15 file create stream hash, I'll be honest, this one hasn't really rocked my
world.
Event ID 16 service configuration change.
And these two below are the pipe events.
So you can see a pipe created event ID 17 and event ID 18.
A pipe connected.
This can be very useful in malware hunting.
Event ID 19 WMI event, these are you could think of these as the WMI events here.
You can show event ID 19 shows activity detected.
Event ID 20 shows the consumer.
Event ID 21, consumer to filter, fun stuff.
Okay, event ID 22 DNS event, very cool, I love that one.
Event ID 23 file deleted, can be useful, it can also be noisy.
Event ID 24 clipboard change.
I'll be honest, this one kind of baffles me.
Event ID 25 process tampering.
A good example of that is if you hollow an executable, let's see, there's a tool called
shelter that can help you do that, where you can insert a payload for shellcode.
Event ID 26 file delete detected.
Can be useful.
It can be good and it can be bad because it can be very noisy.
Okay, those are the events.
So let's talk about the sysmon config.
The sysmon config, here's the TLBR.
The sysmon config is an XML file that defines what gets included or excluded in the sysmon
logs.
It's a big deal.
Why?
Why?
Why is it a big deal?
Well, okay.
So it's a big deal because if your sysmon config is configured to be over inclusive,
you could end up with a lot of garbage data that can make it hard to analyze and sift
through.
And on the other hand, if you exclude too much in your sysmon config, then you're probably
going to be missing valuable log data.
That could potentially contain evidence of malicious activity.
So here's a few facts about the sysmon config.
Here's a little example.
So right here you can see in the XML files some things.
I'll just point them out.
The rule group is like a simple way you can group the rules for a specific event ID.
And note the way that in this case, the sysmon config rules that you can use for a specific
In this case, the group relation uses the and to define how the rules are used.
An alternative to this would be an or
OK, process create.
Let's see is an example of basically event
ID one and this rule right here is going to match on include.
Image, like I said, is the word used for an executable.
In this example, the image is timeout
exe.
Command line.
Is one of the fields in event ID one,
and in this example, it shows us that the command line simply just contains 100.
Little more about the system on config.
As you'll note in the system on config, there are conditions you can use.
You can see here in this little example, it's a and
and or condition equals is or condition equals end with
or begin with.
So you might be thinking,
where do I get a good pre-made system on config that I can start with?
Yeah, that's a great question.
So.
I would say that.
Olaf Hartung has a great system on config
and he makes a great modular system on config that you can use
to easily customize your rules for each event ID.
It makes it very easy to manage.
Big thanks to Olaf for making such great system on config.
OK, let's take a little look here.
So here you can see a little of what his system on config looks like.
A lot of system on config is pretty darn great, but you have to understand you will
need to spend some time getting to know the system on config and adjust it to your specific environment.
To.
It's a big part of it, a big deal.
To help you with that, you can go to the TrustedSec Syswon Community Guide,
which is quite wonderful and written by Carlos Perez, Dark Operator.
A note about Carlos, pretty much anything he writes or creates is amazing.
You can learn a lot from him.
OK.
Now let's talk about installing system on.
It's quite easy.
You just follow these steps.
You basically download this system on unzip.
Grab your system on config, make sure you save it to the same folder
and then you're going to run this command right there.
Note, you can also do this with the script, of course.
I'm not going to go into that for the sake of time, but just know that that's
an option.
So after Syswon is installed, you should see this.
And if you want to go see the Syswon logs,
you can open up Event Viewer and go to Applications Services Logs,
Microsoft, Windows, Syswon and click on Operational and then you'll see the logs.
OK.
Now what?
You might say, OK, I have installed Syswon.
Now what?
Well, now you need to send these Syswon events to a SIEM.
And you might ask, wait, what is a SIEM?
A SIEM is basically a security information and event management system,
and it's think of it like it's basically a central place to send all your logs
so you can analyze and search the data.
And here are a few examples.
Splunk
is they have, of course, a paid version
and they have a free version.
But note that the free version allows up to 500 megabytes per day,
which is actually not a lot of data.
You might be surprised how quickly you get to that limit.
Security Onion is great.
It's free.
It's a great community.
But note that you're on your own to set it up and get it running.
And the same is true with the Elk Stack by Elastic.
So
let's talk a bit about some examples of my favorite Syswon events.
Syswon event, like I said, event ID one process creation.
It's just fabulous.
Sysmon event ID three network connection.
Also fabulous.
Sysmon event 22 DNS event.
Fabulous.
Let's talk about them.
So in Sysmon event ID one,
I wanted to show you here a little example of some of the fields that it captures.
Sysmon.
So in the field rule name, you can see there.
I just want to note.
Olaf Sysmon config contains Mitre attack IDs here.
And that's very useful.
Note the image, which is the executable.
In this case, it's notepad plus plus.
Let's see.
Also, you can see here the command line.
That's the greatest.
It's wonderful.
Okay.
You can see the user in this case.
It's just usernames.
Just an example.
And this is also very, very important.
You get hashes.
So you can see the Shaw one MD five hash.
It's cut off, but you can't see it.
But over on the right, you can also get in hash
note.
Also at the bottom, you can see the parent image, which was the parent executable
and the parent command line.
Wonderful.
Okay.
Event ID three network connection.
Here I show you an example here.
I just included it.
Note in the rule name.
You can see right there what Olaf Sysmon config has for the rule name.
You can see the Mitre attack ID.
Wonderful.
And in this case, let's see.
You can also see the user.
You can see the protocol source IP source port destination IP destination port.
Absolutely wonderful.
So valuable.
So event ID 22 DNS event DNS query.
This is such a great event.
One of.
The greatest parts about this.
You can see the query name right there in the middle.
In this case, it's some Google telemetry garbage, probably.
And you can see the image, the executable Firefox, and it shows you the user.
OK, let's get to some examples of Sysmon used during an investigation.
So in this case, you can see Sysmon event.
Event ID one, and we're doing a query for the command.
Who am I?
This can be either completely.
Harmless.
Event.
Or it could be an attacker that ran, who am I to understand what kind
of privileges they have because they had just popped the box in there.
So.
Very useful.
And here we're looking at Sysmon event ID three.
And this is just a general search, really, to look at
the processes, source IP, source port, destination IP, destination port.
These can be very interesting.
For example, if I was to specify the destination port as four, four or five,
that would be very interesting.
Showing SMB.
OK, Sysmon event ID 22.
This is a really good one. It's really fun.
This is rare DNS queries.
So we're looking basically at one machine in particular,
and we're looking at the rare DNS queries that it ran.
This can be very interesting, very helpful during an investigation.
OK, some closing thoughts.
So what do you see here?
Yeah.
These are some typical answers I've
heard when I ask folks who work in incident response,
if the companies they work with resolving an incident have Sysmon deployed in their environment.
So I see things like rarely, never, hardly ever.
This is a good one.
Yes, but not configured to send to the SIEM.
So I guess I just want to say, you know.
If you have never
deployed Sysmon
in your environment, please do
install Sysmon and make sure you send
the Sysmon events to a SIEM.
Could really help everybody in an incident.
That's it.
Thanks.
Join the conversation.
Meet up with the Blue Team Village, discord.blueteamvillage.org.
I'm Extreme Paperclip.
Thanks.
And you're clear.