GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → olafhartong → Sysmon Modular

olafhartong / Sysmon Modular

Licence: mit
A repository of sysmon configuration modules

Programming Languages

powershell
5483 projects

Labels

security-toolsmodulardfirthreat-huntingmitre-attacksysmon

Projects that are alternatives of or similar to Sysmon Modular

Sentinel Attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
Stars: ✭ 676 (-45%)
Mutual labels:  security-tools, threat-hunting, mitre-attack, sysmon
Threatingestor
Extract and aggregate threat intelligence.
Stars: ✭ 439 (-64.28%)
Mutual labels:  dfir, security-tools, threat-hunting
rhq
Recon Hunt Queries
Stars: ✭ 66 (-94.63%)
Mutual labels:  dfir, threat-hunting, mitre-attack
Evtx Attack Samples
Windows Events Attack Samples
Stars: ✭ 1,243 (+1.14%)
Mutual labels:  dfir, threat-hunting, mitre-attack
Attackdatamap
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
Stars: ✭ 264 (-78.52%)
Mutual labels:  dfir, threat-hunting, mitre-attack
Whids
Open Source EDR for Windows
Stars: ✭ 188 (-84.7%)
Mutual labels:  dfir, threat-hunting, sysmon
Threathunting
A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
Stars: ✭ 738 (-39.95%)
Mutual labels:  dfir, threat-hunting, mitre-attack
ir scripts
incident response scripts
Stars: ✭ 17 (-98.62%)
Mutual labels:  dfir, sysmon, threat-hunting
Threathunter Playbook
A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.
Stars: ✭ 2,879 (+134.26%)
Mutual labels:  dfir, threat-hunting, sysmon
Malwless
Test Blue Team detections without running any attack.
Stars: ✭ 215 (-82.51%)
Mutual labels:  dfir, mitre-attack, sysmon
TA-Sysmon-deploy
Deploy and maintain Symon through the Splunk Deployment Sever
Stars: ✭ 31 (-97.48%)
Mutual labels:  dfir, sysmon, threat-hunting
Bluespawn
An Active Defense and EDR software to empower Blue Teams
Stars: ✭ 737 (-40.03%)
Mutual labels:  security-tools, threat-hunting, mitre-attack
Threatpinchlookup
Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension
Stars: ✭ 257 (-79.09%)
Mutual labels:  dfir, threat-hunting
Sysmon Config
Sysmon configuration file template with default high-quality event tracing
Stars: ✭ 3,287 (+167.45%)
Mutual labels:  threat-hunting, sysmon
Detectionlabelk
DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
Stars: ✭ 273 (-77.79%)
Mutual labels:  dfir, threat-hunting
Patrowlmanager
PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
Stars: ✭ 363 (-70.46%)
Mutual labels:  security-tools, threat-hunting
My Arsenal Of Aws Security Tools
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
Stars: ✭ 6,464 (+425.96%)
Mutual labels:  dfir, security-tools
fastfinder
Incident Response - Fast suspicious file finder
Stars: ✭ 116 (-90.56%)
Mutual labels:  dfir, threat-hunting
Auditd Attack
A Linux Auditd rule set mapped to MITRE's Attack Framework
Stars: ✭ 642 (-47.76%)
Mutual labels:  threat-hunting, mitre-attack
Ioc Explorer
Explore Indicators of Compromise Automatically
Stars: ✭ 73 (-94.06%)
Mutual labels:  security-tools, threat-hunting
View All Similar Projects ➔

sysmon-modular | A Sysmon configuration repository for everybody to customise

license Maintenance GitHub last commit Build Sysmon config with all modules Twitter

This is a Microsoft Sysinternals Sysmon configuration repository, set up modular for easier maintenance and generation of specific configs.

The sysmonconfig.xml within the repo is automatically generated after a successful merge by the PowerShell script and a successful load by Sysmon in an Azure Pipeline run.

NOTICE; Sysmon below 13 will not completely be compatible with this configuration

Older versions are still available in the branches, but are not as complete as the current branch

To understand added features in the latest version, have a look at my small blog post or watch my DerbyCon talk

Note: I do recommend using a minimal number of configurations within your environment for multiple obvious reasons, like; maintenance, output equality, manageability and so on. But do make tailored configurations for Domain Controllers, Servers and workstations.

Credits

Big credit goes out to SwiftOnSecurity for laying a great foundation and making this repo possible! sysmonconfig-export.xml.

Final thanks to Mathias Jessen for his Merge script, without it, this project would not have worked as well.

Contributing

Pull requests / issue tickets and new additions will be greatly appreciated!

More information

I started a series of blog posts covering this repo;

Mitre ATT&CK

I strive to map all configurations to the ATT&CK framework whenever Sysmon is able to detect it. A current ATT&CK navigator export of all linked configurations is found here and can be viewed here Mapping

Required actions

I highly recommend looking at the configs before implementing them in your production environment. This enables you to have as actionable logging as possible and as litte noise as possible.

Customization

You will need to install and observe the results of the configuration in your own environment before deploying it widely. For example, you will need to exclude actions of your antivirus, which will otherwise likely fill up your logs with useless information.

Generating a config

PowerShell

$> git clone https://github.com/olafhartong/sysmon-modular.git
$> cd sysmon modular
$> . .\Merge-SysmonXml.ps1
$> Merge-AllSysmonXml -Path ( Get-ChildItem '[0-9]*\*.xml') -AsString | Out-File sysmonconfig.xml

Use

Install

Run with administrator rights

sysmon.exe -accepteula -i sysmonconfig.xml

Update existing configuration

Run with administrator rights

sysmon.exe -c sysmonconfig.xml
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].