BeaKer

BeaKer combines Microsoft Sysmon, WinLogBeat, Elasticsearch, and Kibana to provide insights into network traffic.

https://www.activecountermeasures.com/free-tools/beaker/

https://www.activecountermeasures.com/beaker-instant-forensics/

https://github.com/activecm/BeaKer

SysmonSimulator

SysmonSimulator is an open source Windows event simulation utility designed to generate attack data for the relevant Sysmon Event IDs.

https://github.com/ScarredMonk/SysmonSimulator

Sysmon template files and resources

Below are links to a few different resources for Sysmon template files.

https://github.com/SwiftOnSecurity/sysmon-config

https://github.com/olafhartong/sysmon-modular

https://github.com/f8al/sysmon-config

https://github.com/randomuserid/Tylium/blob/master/Windows/sysmon-att%26ck.xml

https://github.com/wubbaroo/sysmon/blob/master/sysmon_config.xml

https://github.com/Neo23x0/sysmon-config

Below is a link to a guide for Sysmon.

https://github.com/trustedsec/SysmonCommunityGuide/releases

Below are the links to the deployment of Sysmon.

https://github.com/jokezone/Update-Sysmon

https://www.syspanda.com/index.php/2017/02/28/deploying-sysmon-through-gpo/

Below is a resource for the log entries that are created.

https://www.blackhillsinfosec.com/a-sysmon-event-id-breakdown/

Below is a cheat sheet page.

https://github.com/olafhartong/sysmon-cheatsheet

Newer versions can block certain file types.

https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-can-now-block-malicious-exes-from-being-created/

Sysinternals Sysmon

Sysmon is a Windows system service and device driver that remains resident across system reboots to monitor and log system activity to the Windows event log. It can log detailed information about process creations, network connections, and changes to file creation time. 


https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

A pre-built configuration file can be found at:

https://github.com/SwiftOnSecurity/sysmon-config

To install Sysmon and use the configuration file, download the Sysmon utility and extract the .ZIP file.  If you download the .XML file using a browser and attempt to use it, an error may be returned with the text of "DTD is prohibited."

To avoid this error, click on the link for the .XML file and then copy/paste the contents into a text editor such as Notepad++, and then save the file using the original file name.

To verify the service was installed and logging is occurring, launch an elevated PowerShell session and enter the following commands.

Get-Service sysmon

Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 10

The logs can be manually viewed via the Computer Management MMC (compmgmt.msc) using the path Event Viewer -> Applications and Services Logs -> Microsoft -> Windows -> Sysmon -> Operational.

The .XML file includes comments concerning some of the parameters included.

Below is an example of a log entry from using the nslookup command.

Network connection detected:
RuleName:
UtcTime: 2019-02-23 23:41:00.742
ProcessGuid: {8fcfd9c4-da0c-5c71-0000-0010dc068801}
ProcessId: 1636
Image: C:\Windows\System32\nslookup.exe
User: sam
Protocol: udp
Initiated: true
SourceIsIpv6: false
SourceIp: 192.168.254.27
SourceHostname: computer
SourcePort: 60836
SourcePortName:
DestinationIsIpv6: false
DestinationIp: 192.168.254.254
DestinationHostname:
DestinationPort: 53
DestinationPortName: domain

Sysinternals Process Monitor

Process Monitor is a Windows utility from Sysinternals.

https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

By default, the application is logging for Registry, File, Network, and Process.

Control + E toggles capture, and Control + X clears the logs.

A quick method to create a filter is the right-click on the name within one of the columns.

One common use of Process Monitor is to determine the Registry location of a parameter.  The filter parameter would be RegSetValue.

In this example, below is the Registry key to enable DEP.

To launch the Registry Editor with the path in question, right-click the entry and use the Jump To option.

Another option is to click on the Target icon and drag on the parameter in question.

Applications can be filtered based on process name.

Certain items are filtered by default.  To see all data, use the Filter –> Enabled Advanced Output option.

The Process Tree view can be accessed using Control Key + T.