|
3 | 3 | Master version: 44 | Date: 2017-02-22
|
4 | 4 | Master author: @SwiftOnSecurity, with contributors credited in-line or on Git.
|
5 | 5 | Master project: https://github.com/SwiftOnSecurity/sysmon-config
|
6 |
| - Master license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, or deploy for commercial use - with attribution in the text. |
7 |
| - Any additions may by incorporated by the original author (SwiftOnSecurity) into the master version, with in-line or changelog attribution. |
| 6 | + Master license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. |
| 7 | + Any additions may by incorporated by the original author (SwiftOnSecurity) into the master version, with in-line or changelog attribution. |
8 | 8 |
|
9 | 9 | Fork version: <N/A>
|
10 | 10 | Fork author: <N/A>
|
|
20 | 20 | much filtering as possible onto the client. This is to make analysis of intrusions possible by hand, and try to
|
21 | 21 | surface anomalous activity as quickly as possible to any technician armed only with Event Viewer.
|
22 | 22 |
|
23 |
| - NOTE: Sysmon is not hardened against a determined attacker with admin rights. This configuration offers an attacker, willing |
| 23 | + NOTE: Sysmon is not hardened against a determined attacker with admin rights. Also, this configuration offers an attacker, willing |
24 | 24 | to study it closely, several ways to evade some of the alerting. If you are in a high-threat environment and have significant
|
25 | 25 | security staff, you should consider a much broader log-all approach. However, in the vast majority of cases, an attacker
|
26 | 26 | will bumble along through multiple behavioral traps which this configuration monitors, especially in the first minutes.
|
27 | 27 |
|
28 |
| - NOTE: There is best-effort support for 32-bit systems, but it's not a test scenario and will require your own tuning. |
29 |
| -
|
30 | 28 | NOTE: "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
|
31 | 29 | "ProcessGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual process launches.
|
32 | 30 | "LoginGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual user sessions.
|
|
0 commit comments