Windows telemetry with Sysmon
You install and configure Sysmon, learn to read process, network, registry and file events, and make attack traces visible with a configuration that cuts noise.
Level 201 · 17 lessons · 15 practice labs
Lessons
Installation and events
- Why Sysmon: the details Windows logs don’t show
- Installing Sysmon with a config file
- Event 1: process creation, command line and parent
- Event 3: network connections
- Event 11: file creation and downloaded files
- Short task: trace a PowerShell download command across three events
Advanced events
- Registry events: Run keys and persistence
- Loaded DLLs and signature information
- Event 10: processes accessing LSASS
- Event 22: DNS queries
- Short task: find the persistence added to the registry and the process that added it
Configuration
- Config structure: include, exclude, rule groups
- Cutting noise: excluding trusted processes
- Rule tags mapped to ATT&CK
- Examining EVTX files with PowerShell and command-line tools
- Short task: halve the event count without losing the attack events
Capstone
- Capstone: build an attack timeline from Sysmon records
Practice labs
- Find the suspicious command line in Event 1: Filter Sysmon process creation records and show the hidden PowerShell command together with its parent.
- Link a download to its execution across three events: Match Event 3, 11 and 1 records by process GUID and build the download-and-execute chain.
- Catch a renamed system tool through OriginalFileName: Find a tool running under a different name through the OriginalFileName field in Event 1 and report its path.
- Find which process connected out: Identify the process and time of a connection to an unknown external address in Event 3 records.
- Match a DNS query to a connection and a process: Link the suspicious domain in Event 22 to the Event 3 connection and the process that started it.
- Find C2 hidden among normal browser traffic: Prove from Event 3 records that a non-browser process connects to the same address at regular intervals.
- Find the Run key entry and who added it: Find the value written to a Run key in Event 13 records and the process that wrote it.
- Pick out the process accessing LSASS by its access rights: Filter Event 10 by GrantedAccess and find the access that is not from the usual security products.
- Catch an unsigned DLL load: Find the unsigned DLL loaded from a user folder in Event 7 records and explain which process loaded it.
- Add a new include rule to the Sysmon config: Add a rule catching file writes to the Task Scheduler folder, load the config and generate the event.
- Cut the noise from a trusted backup tool: Exclude the backup process that produces half the events with a narrow rule and confirm the attack events remain.
- Find the attacker slipping through an exclusion: Show an over-broad Image exclusion hides the attack process and fix the rule with full path and signature conditions.
- Tag rules with ATT&CK and count the events: Add technique IDs to the config rules and count how many events each technique has in the EVTX file.
- Query an EVTX file from the command line: Use Get-WinEvent to pull only one event ID and time range from the file.
- Join process, network and file events into one chain by ProcessGuid: Starting from a suspicious process’s ProcessGuid in an EVTX file, order the related events 1, 3 and 11 and state what it downloaded and where it connected.
About this course
You install and configure Sysmon, learn to read process, network, registry and file events, and make attack traces visible with a configuration that cuts noise.
What you will learn
- Installation and events
- Advanced events
- Configuration
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.