DOCSEARCHbyAlgolia
Submit Docs

sysmon-modular Documentation

repository·master·Indexed 25 days ago

https://github.com/olafhartong/sysmon-modular

A modular configuration repository for Microsoft Sysinternals Sysmon that enables the creation of customized, maintainable XML configurations. It provides tools for merging rule modules via PowerShell or Python, pre-generated configurations for various use cases (including MDE augmentation), and a mapping of configuration rules to the MITRE ATT&CK knowledge base.

Tokens
1.5K
Snippets
3
Records
9
Agent score
35%

What's inside sysmon-modular

  1. Compare Sysmon configuration approaches

    master

    When choosing a Sysmon configuration, consider these three major community approaches:

    • SwiftOnSecurity: A great introductory walkthrough of many settings. Use the sysmonconfig-export.xml for a quick start.
    • cyb3rops: A proactive, bleeding-edge fork of the SwiftOnSecurity configuration.
    • olafhartong (this repo): Focuses on high maintainability with detailed rule notes designed for guided response and SIEM integration.

  2. Understand MITRE ATT&CK mapping in Sysmon-Modular

    master

    This repository strives to map all configurations to the MITRE ATT&CK framework where Sysmon capabilities allow.

    Note on detections: A mapped technique represents a possible log entry that might lead to a detection. It is not guaranteed to be the only telemetry for that technique, and a single rule may relate to multiple techniques. The mapping provided is the one deemed most likely by the maintainer.

  3. Access pre-generated Sysmon configurations

    master

    The repository provides several pre-generated sysmonconfig.xml files for different use cases. Note that Sysmon version 15 or higher is recommended for full compatibility.

    TypeConfigDescription
    defaultsysmonconfig.xmlBalanced configuration, most commonly used.
    default+sysmonconfig-with-filedelete.xmlBalanced configuration including FileDelete event savings.
    verbosesysmonconfig-excludes-only.xmlIncludes all events, applying only exclusion modules. Not recommended for production due to high data volume and potential performance impact.
    super verbosesysmonconfig-research.xmlExtreme verbosity for research purposes. DO NOT USE IN PRODUCTION; high CPU/Memory usage.
    MDE augmentsysmonconfig-mde-augmentation.xmlDesigned to augment Microsoft Defender for Endpoint with minimal overlap.

  4. View the Sysmon-modular MITRE ATT&CK coverage matrix

    master

    The Sysmon-modular repository provides a mapping of its configuration rules to the MITRE ATT&CK knowledge base. You can view the full coverage matrix using the MITRE ATT&CK Navigator.

    To view the matrix online, use the following link which loads the project's latest coverage JSON directly into the online navigator:

    View Coverage Matrix in MITRE ATT&CK Navigator

    Alternatively, you can download the raw JSON file to use with your own local instance of the ATT&CK navigator.

  5. Generate a default Sysmon configuration using PowerShell

    master

    To generate a standard configuration by merging all available XML modules in the repository, use the provided PowerShell script. Ensure you are in the root of the cloned repository.

    $> git clone https://github.com/olafhartong/sysmon-modular.git
$> cd sysmon-modular
$> . .\Merge-SysmonXml.ps1
$> Merge-AllSysmonXml -Path ( Get-ChildItem '[0-9]*\*.xml') -AsString | Out-File sysmonconfig.xml

  6. Generate custom Sysmon configurations with Include/Exclude lists

    master

    You can create tailored configurations by specifying which rules to include or exclude using the Merge-AllSysmonXml function.

    List Formats

    • Specific Files: Provide the relative path to the XML file (e.g., 1_process_creation\exclude_adobe_acrobat.xml).
    • Entire Directories: Provide the directory name to include/exclude an entire event family (e.g., 1_process_creation).

    PowerShell Commands

    Find available rules: Use Find-RulesInBasePath to identify candidate XML files based on regex patterns.

    Find-RulesInBasePath -BasePath C:\users\sysmon\sysmon-modular\ -OutputRules | Out-File available_rules.txt

    Merge with Include List:

    Merge-AllSysmonXml -AsString -BasePath C:\Users\sysmon\sysmon-modular\ -IncludeList C:\users\sysmon\sysmon-modular\include_rules.txt

    Merge with Exclude List:

    Merge-AllSysmonXml -AsString -BasePath C:\Users\sysmon\sysmon-modular\ -ExcludeList C:\users\sysmon\sysmon-modular\exclude_rules.txt

    Note: The -BasePath must be the full absolute path to the sysmon-modular directory.

  7. Install and update Sysmon configurations

    master

    Use the Sysmon executable with administrator privileges to apply your generated configuration.

    To install Sysmon for the first time:

    sysmon.exe -accepteula -i sysmonconfig.xml

    To update an existing Sysmon configuration:

    sysmon.exe -c sysmonconfig.xml
    sysmon.exe -accepteula -i sysmonconfig.xml
sysmon.exe -c sysmonconfig.xml

  8. Generate Sysmon configs using the Python tool

    master

    An experimental Python tool is available for priority-based rule sorting. It merges configurations based on a CSV file containing two columns: filepath and priority.

    Usage:

    python merge_sysmon_configs.py config_lists/default_list/default_list.csv -f csv -b templates/sysmon_template.xml -o test.xml

    Features:

    • Dynamic Schemaversion based on the highest version in the provided rules.
    • Maintains XML comments and enforces proper indentation.
    python merge_sysmon_configs.py config_lists/default_list/default_list.csv -f csv -b templates/sysmon_template.xml  -o test.xml

  9. Use the Default_list as a priority template for Sysmon configurations

    master

    The Default_list serves as an example priority list used during the generation of ordered Sysmon configuration files. It defines the sequence in which rule groups are applied.

    Key characteristics of this list include:

    • Environment-specific cleanup: Programs that are not universally present in all environments (e.g., Dropbox) are typically removed from the list to prevent noise or errors in generic configurations.
    • Filter updates: The list is subject to updates regarding replaced filters.