sysmon-modular | A Sysmon configuration repository for everybody to customise
This is a Microsoft Sysinternals Sysmon configuration repository, set up modular for easier maintenance and generation of specific configs.
NOTICE; Sysmon 8.02 is not compatible with this configuration, it will cause severe blind spots in your logging. Please use Sysmon 8.0 or 8.0.4
Note: I do recommend using a minimal number of configurations within your environment for multiple obvious reasons, like; maintenance, output equality, manageability and so on.
Big credit goes out to SwiftOnSecurity for laying a great foundation and making this repo possible! sysmonconfig-export.xml.
Final thanks to Matt Graeber for his PowerShell Modules, without them, this project would not have worked as well.
Pull requests / issue tickets and new additions will be greatly appreciated!
I started a series of blog posts covering this repo;
- Endpoint detection Superpowers on the cheap - part1 - MITRE ATT&CK, Sysmon and my modular configuration
- Endpoint detection Superpowers on the cheap — part 2 — Deploy and Maintain
- Endpoint detection Superpowers on the cheap — part 3 — Sysmon Tampering
Following this blogpost Sysmon 8.0, a leap forward in event annotation I've been working on updating the configuration modules to schemaversion 4.1 as well as adding the MITRE annotation fields. Eventually I deviated a little bit from my blogpost and went with the OSSEM field naming; technique_id and technique_name
I highly recommend looking at the configs before implementing them in your production environment. This enables you to have as actionable logging as possible and as litte noise as possible.
Install the PowerShell modules from PSSysmonTools
git clone https://github.com/olafhartong/PSSysmonTools.git cd PSSysmonTools Import-Module .\PSSysmonTools.psm1
You will need to install and observe the results of the configuration in your own environment before deploying it widely. For example, you will need to exclude actions of your antivirus, which will otherwise likely fill up your logs with useless information.
Generating a config
git clone https://github.com/olafhartong/sysmon-modular.git cd sysmon modular .\Generate-Sysmon-Config.ps1
Optionally you can omit the comments from the merged config with the “-ExcludeMergeComments” switch.
You might see an error like ; Merge-SysmonXMLConfiguration : The schema version of C:\Temp\sysmon-modular-master\sysmonconfig.xml () does not match that of the reference configuration: The error is due to the validator. When executing the oneliner the sysmonconfig.xml is created but it is still empty at that time. Therefore it is not a valid config at that time, the file is filled with data at the end of the generation phase. You can safely ignore it.
You can test your config if it's schema compliant
Run with administrator rights
sysmon.exe -accepteula -i sysmonconfig.xml
Update existing configuration
Run with administrator rights
sysmon.exe -c sysmonconfig.xml
- Link more indicators to Mitre ATT&CK techniques.
- Add / Improve comments
- Extend, extend, extend.