Sysmon (System Monitor) is a free Microsoft tool that provides detailed logging of system activity on Windows devices. It captures valuable event data about processes, network connections, registry changes, and more that can expose malicious behavior.
While Windows event logging has some native capabilities in this area, Sysmon provides much richer information. It’s become an essential component of threat detection and incident response in many organizations.
However, with greater visibility comes greater volume. Sysmon generates a high volume of data that can quickly overwhelm storage and monitoring tools if not properly configured. As you deploy Sysmon, carefully consider what information you truly need to support your security strategy balanced with your infrastructure’s ability to handle it.
Getting Started with Sysmon
If you’re new to Sysmon, the first step is installing the Sysmon service on your Windows endpoints. Microsoft provides an open-source Sysmon configuration file from their GitHub repository that serves as a base configuration if you’re just getting used to the software.
Alternatively, there are also several commonly used community configurations available such as SwiftOnSecurity’s or Olaf Hartong’s modular config. While more refined, some of these turn on very verbose logging right away. Ensure that if these configurations are in use, that you are baselining your endpoints to notice any performance issues.
After installing Sysmon with a baseline configuration, ensure you have log collection and retention policies in place that align with your organizational requirements. Send Sysmon logs to your Security Information and Event Management (SIEM) platform or centralized log analysis tools. Many SIEMs have pre-built integrations, dashboards, and detection content for Sysmon as well.
Considerations for Sysmon Configuration
The key decisions around tuning your Sysmon deployment involve:
Which modules to enable: Sysmon provides various modules for logging different types of events, such as process creations, network connections, file changes, and driver loads. Consider enabling only the necessary modules based on your environment.
For resource-constrained machines, selectively enable high-value modules like process, DNS, and registry activity.
Log verbosity: Use include/exclude filters to control verbosity and reduce noise. For instance, exclude logs from frequently occurring OS processes to maintain clarity. Be cautious not to compromise detection capabilities by overly aggressive filtering.
Hash logging: Enabling hash logging allows you to log hashes of executables. While this aids reputation checking, it comes with storage and performance trade-offs.
Command line logging: Capturing full command line arguments provides valuable context but increases log volume. Use it judiciously.
Registry logging: Registry changes are critical to monitor. However, focus on essential registry areas to avoid excessive activity.
Getting the most value from Sysmon requires finding the right balance for your environment. Start with basic process and network visibility then expand modules judiciously with exclusions to control volume.
Sysmon Configuration Modes
Sysmon supports several configuration modes with the most common options being:
Inline configuration: Store configuration directly in the Windows registry. It’s straightforward but requires registry modifications for adjustments.
Configuration file: Use an XML file to store modules, filters, and parameters externally. Modifications automatically reload, making it convenient for frequent changes.
Sysmon Modular: Community-driven configuration with features like tagging rules using MITRE technique IDs. This requires additional software but offers customization options.
Consider using the configuration file method if you anticipate needing frequent configuration changes. Sysmon Modular also offers advantages if you utilize MITRE framework or want to customize rule naming conventions.
Integrating With Your SIEM
To take advantage of the expanded visibility provided by Sysmon, you need to integrate the log stream into your security analytics tools.
For SIEM platforms like Splunk, ArcSight or QRadar, add Sysmon to your Windows log collection. Most SIEMs now include out-of-the-box support for Sysmon’s schema and data.
Beyond basic collection, look to leverage Sysmon-specific use cases for detection content. Mapping Sysmon data fields to MITRE ATT&CK framework tactics and techniques is also best practice to enrich correlation.
Be sure to account for the increased data volume based on your configuration and environment size when planning SIEM infrastructure sizing and licensing.
Validating Sysmon Detection Capabilities
The best way to validate that your Sysmon deployment provides high-fidelity detection capabilities across critical use cases is to periodically test detection content.
Execute known malicious behaviors in a controlled manner to confirm that existing analytics fire as expected. Some methods include:
- Penetration testing activities like credential dumping
- Running sample behaviors from threat emulation tools
- Capturing historical threats seen previously and replaying
- Track test cases in a matrix mapped to MITRE tactics and techniques or other frameworks
Over time, you can build coverage across a breadth of potential threats.
Maximizing the Value of Sysmon
Deploying Sysmon provides crucial visibility into system, process, and network activity that can expose real-world attacks that would otherwise go undetected. However, maximizing its value requires carefully balancing Sysmon’s verbosity and filtering capabilities. By judiciously enabling modules, refining logging verbosity, and aligning data volume with security analytics infrastructure, security teams can harness Sysmon to illuminate stealthy attacker behaviors. Combined with mapping detections to frameworks like MITRE ATT&CK and validation through threat emulation testing, Sysmon can become a powerful tool for enhancing threat detection and incident response across Windows environments.
To further explore Sysmon’s capabilities for threat hunting, watch this video featuring Amanda Berlin, Blumira’s Head of Incident Detection Engineering, in conversation with security influencer Tom Lawrence.
