Sysinternals Sysmon unleashed

Introduction

Warning: This post recommends Sysmon monitoring policy implementations that are not official Microsoft recommendations. Readers are encouraged to review and test all policy recommendations prior to their implementation in a production environment. Sysmon from Sysinternals is a very powerful Host-level tracing tool, which can assist you in detecting advanced threats on your network. In contrast to common Antivirus/HIDS solutions, Sysmon performs system activity deep monitoring, and log high-confidence indicators of advanced attacks.

Sysmon is using a device driver and a service that is running in the background and loads very early in the boot process.

Sysmon monitors the following activities:

• Process creation (with full command line and hashes)
• Process termination
• Network connections
• File creation timestamps changes
• Driver/image loading
• Create remote threads
• Raw disk access
• Process memory access

Some of these events can be gathered up by enabling Windows built-in auditing, yet the detail level provided by Sysmon is much higher. When it comes to analysis, Sysmon doesn’t provide any; you can use other tools to visualize and investigate the raw events, for example: SIEM, Microsoft SCOM, Splunk and Azure OMS.

Installation

Sysmon is a command-line tool; once downloaded from the Microsoft Sysinternals web site the installation is straightforward: Open elevated (“Run as Administrator”) command line and type the following command: Sysmon /?

Here is the output:

Let’s take a look at the install option available. Two basic options are offered:

1. Set up the tool with default configuration
2. Define the desired configuration directly from the command line or from a configuration file

Let’s start with the default configuration by running the following command:

That’s it; Sysmon is now installed (installation, or uninstallation, does require a reboot).

The default configuration includes the following events:

• Process create (with SHA1)
• Process terminate
• Driver loaded
• File creation time changed
• RawAccessRead
• CreateRemoteThread
• Sysmon service state changed

You can view the configuration by using the following command: Sysmon -c

Here is the output:

Once installed, Sysmon does its job automatically in the background. You can find out the results in the Event Viewer.

The events are written to Application and Services Logs/Microsoft/Windows/Sysmon/Operational log (For earlier - unsupported - versions of Windows, it places those under the Windows System log).

One thing that can help you here is to increase the event log size, I usually use 200 MB, with this command:

wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:209715200 

Hashes

Many events include the hash value of the process. Hash value is the result of a calculation that was performed on a file, and used to uniquely identify files, as well as look up potential threat details  using online services such as TotalHash and VirusTotal.

For example, in this event we have an SHA1 hash for eventvwr.exe process: 7A2C326970EFF8B9E2194377078B22944808CB71

Searching for this value in VirusTotal

Yields the following result (Clean on all 56 Anti-Virus engines)

From a malware analysis perspective, you’re better off using SHA256 or IMPHASH than MD5.

Configuration

Using the default setup option as we used above is limited, because we can’t apply advanced filtering and unleash the full potential of the tool.

Sysmon can be used with an XML configuration file, which allows you to use advanced and flexible filtering rules, specify the type of hashes and deploy it across the organization. The XML file can be applied during installation and changed any time later.

The XML file is divided into to two main sections: HashAlgorithms and EventFiltering

Under EventFiltering you can select any supported event that you want to include or exclude, here we are using the DriverLoad tag as an example.

If you are just using the tag without a filter, the rule (onmatch) has opposite effect!

For example, this line will configure Sysmon to log all driver load events (because we are not using any filter):

<DriverLoad onmatch=”exclude“></DriverLoad>

While this line will configure Sysmon to log drivers load events except (filter) if the signature is Microsoft Windows

<DriverLoad onmatch=”exclude“>

<Signature condition="is">Microsoft
Windows</Signature>

</DriverLoad>

The XML configuration file supports the following conditions:

Full sample XML configuration file is available here: https://github.com/MotiBa/Sysmon/blob/master/config_v3.xml

Once applied, the configuration is stored in the registry under this key:HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters.

Events

Sysmon features some of the most effective events you need to collect to trace attacker activity and increase host visibility, you can consider the events as breadcrumbs that attackers drop along the way.

The recommendations shown here is intended only to be a starting baseline guide to administrators. Each organization must make its own decisions regarding the threats they face.
A common mistake is to only monitor servers or domain controllers. Since the vast majority of malicious hacking initially occurs on workstations, not monitoring workstations is ignoring the best and earliest source of information.