Skip to content

Commit bbd03ec

Browse files
JSCU-CNDJSCU-CND
authored
Added Sysmon-events, modified DHCP-logging configuration.
* Added Sysmon-events to the subscription configuration. * Changed the logging-configuration for DHCP events from a registry-key, which was unreliable, to PowerShell-commands.
1 parent de7a678 commit bbd03ec

File tree

3 files changed

+309
-16
lines changed

3 files changed

+309
-16
lines changed

‎WindowsEventIDMapping.json

+228
Original file line numberDiff line numberDiff line change
@@ -1154,6 +1154,234 @@
11541154
}
11551155
}
11561156
},
1157+
"Microsoft Sysmon": {
1158+
"events":{
1159+
"Sysmon Service Status Changed ": {
1160+
"0": {
1161+
"level": "Information",
1162+
"channel": "Microsoft-Windows-Sysmon/Operational",
1163+
"provider": "Microsoft-Windows-Sysmon",
1164+
"notes": "Sysmon Service Status Changed"
1165+
}
1166+
},
1167+
"Process creation": {
1168+
"1": {
1169+
"level": "Information",
1170+
"channel": "Microsoft-Windows-Sysmon/Operational",
1171+
"provider": "Microsoft-Windows-Sysmon",
1172+
"notes": "Process creation"
1173+
}
1174+
},
1175+
"Process changed file creation time": {
1176+
"2": {
1177+
"level": "Information",
1178+
"channel": "Microsoft-Windows-Sysmon/Operational",
1179+
"provider": "Microsoft-Windows-Sysmon",
1180+
"notes": "A process changed a file creation time"
1181+
}
1182+
},
1183+
"Network connection": {
1184+
"3": {
1185+
"level": "Information",
1186+
"channel": "Microsoft-Windows-Sysmon/Operational",
1187+
"provider": "Microsoft-Windows-Sysmon",
1188+
"notes": "Network connection"
1189+
}
1190+
},
1191+
"Sysmon service state changed": {
1192+
"4": {
1193+
"level": "Information",
1194+
"channel": "Microsoft-Windows-Sysmon/Operational",
1195+
"provider": "Microsoft-Windows-Sysmon",
1196+
"notes": "Sysmon service state changed"
1197+
}
1198+
},
1199+
"Process terminated": {
1200+
"5": {
1201+
"level": "Information",
1202+
"channel": "Microsoft-Windows-Sysmon/Operational",
1203+
"provider": "Microsoft-Windows-Sysmon",
1204+
"notes": "Process terminated"
1205+
}
1206+
},
1207+
"Driver loaded": {
1208+
"6": {
1209+
"level": "Information",
1210+
"channel": "Microsoft-Windows-Sysmon/Operational",
1211+
"provider": "Microsoft-Windows-Sysmon",
1212+
"notes": "Driver loaded"
1213+
}
1214+
},
1215+
"Image loaded": {
1216+
"7": {
1217+
"level": "Information",
1218+
"channel": "Microsoft-Windows-Sysmon/Operational",
1219+
"provider": "Microsoft-Windows-Sysmon",
1220+
"notes": "Image loaded"
1221+
}
1222+
},
1223+
"Create Remote Thread": {
1224+
"8": {
1225+
"level": "Information",
1226+
"channel": "Microsoft-Windows-Sysmon/Operational",
1227+
"provider": "Microsoft-Windows-Sysmon",
1228+
"notes": "CreateRemoteThread"
1229+
}
1230+
},
1231+
"Raw Access Read": {
1232+
"9": {
1233+
"level": "Information",
1234+
"channel": "Microsoft-Windows-Sysmon/Operational",
1235+
"provider": "Microsoft-Windows-Sysmon",
1236+
"notes": "RawAccessRead"
1237+
}
1238+
},
1239+
"Process Access": {
1240+
"10": {
1241+
"level": "Information",
1242+
"channel": "Microsoft-Windows-Sysmon/Operational",
1243+
"provider": "Microsoft-Windows-Sysmon",
1244+
"notes": "ProcessAccess"
1245+
}
1246+
},
1247+
"File Create": {
1248+
"11": {
1249+
"level": "Information",
1250+
"channel": "Microsoft-Windows-Sysmon/Operational",
1251+
"provider": "Microsoft-Windows-Sysmon",
1252+
"notes": "FileCreate"
1253+
}
1254+
},
1255+
"Registry Create/Delete": {
1256+
"12": {
1257+
"level": "Information",
1258+
"channel": "Microsoft-Windows-Sysmon/Operational",
1259+
"provider": "Microsoft-Windows-Sysmon",
1260+
"notes": "RegisteryEvent (Object create and Delete)"
1261+
}
1262+
},
1263+
"Registry Value Set": {
1264+
"13": {
1265+
"level": "Information",
1266+
"channel": "Microsoft-Windows-Sysmon/Operational",
1267+
"provider": "Microsoft-Windows-Sysmon",
1268+
"notes": "RegisteryEvent value set"
1269+
}
1270+
},
1271+
"Registry Key/Value Rename": {
1272+
"14": {
1273+
"level": "Information",
1274+
"channel": "Microsoft-Windows-Sysmon/Operational",
1275+
"provider": "Microsoft-Windows-Sysmon",
1276+
"notes": "RegisteryEvent key and value rename"
1277+
}
1278+
},
1279+
"File Create Stream Hash": {
1280+
"15": {
1281+
"level": "Information",
1282+
"channel": "Microsoft-Windows-Sysmon/Operational",
1283+
"provider": "Microsoft-Windows-Sysmon",
1284+
"notes": "FileCreateStreamHash"
1285+
}
1286+
},
1287+
"Service Configuration Change": {
1288+
"16": {
1289+
"level": "Information",
1290+
"channel": "Microsoft-Windows-Sysmon/Operational",
1291+
"provider": "Microsoft-Windows-Sysmon",
1292+
"notes": "ServiceConfigurationChange"
1293+
}
1294+
},
1295+
"Pipe Created": {
1296+
"17": {
1297+
"level": "Information",
1298+
"channel": "Microsoft-Windows-Sysmon/Operational",
1299+
"provider": "Microsoft-Windows-Sysmon",
1300+
"notes": "PipeEvent pipe created"
1301+
}
1302+
},
1303+
"Pipe Connected": {
1304+
"18": {
1305+
"level": "Information",
1306+
"channel": "Microsoft-Windows-Sysmon/Operational",
1307+
"provider": "Microsoft-Windows-Sysmon",
1308+
"notes": "PipeEvent pipe connected"
1309+
}
1310+
},
1311+
"WMI Filter Activity": {
1312+
"19": {
1313+
"level": "Information",
1314+
"channel": "Microsoft-Windows-Sysmon/Operational",
1315+
"provider": "Microsoft-Windows-Sysmon",
1316+
"notes": "WMIEvent WMIEvenFilter activity detected"
1317+
}
1318+
},
1319+
"WMI Consumer Activity": {
1320+
"20": {
1321+
"level": "Information",
1322+
"channel": "Microsoft-Windows-Sysmon/Operational",
1323+
"provider": "Microsoft-Windows-Sysmon",
1324+
"notes": "WMIEvent Consumer activity detected"
1325+
}
1326+
},
1327+
"WMI Consumer to Filter Activity": {
1328+
"21": {
1329+
"level": "Information",
1330+
"channel": "Microsoft-Windows-Sysmon/Operational",
1331+
"provider": "Microsoft-Windows-Sysmon",
1332+
"notes": "WMIEvent Consumer to filter activity detected"
1333+
}
1334+
},
1335+
"DNS Query": {
1336+
"22": {
1337+
"level": "Information",
1338+
"channel": "Microsoft-Windows-Sysmon/Operational",
1339+
"provider": "Microsoft-Windows-Sysmon",
1340+
"notes": "DNSEvent DNS Query"
1341+
}
1342+
},
1343+
"File Delete": {
1344+
"23": {
1345+
"level": "Information",
1346+
"channel": "Microsoft-Windows-Sysmon/Operational",
1347+
"provider": "Microsoft-Windows-Sysmon",
1348+
"notes": "FileDelete a file delete was detected"
1349+
}
1350+
},
1351+
"Clipboard Change": {
1352+
"24": {
1353+
"level": "Information",
1354+
"channel": "Microsoft-Windows-Sysmon/Operational",
1355+
"provider": "Microsoft-Windows-Sysmon",
1356+
"notes": "ClipboardChange new content in clipboard"
1357+
}
1358+
},
1359+
"Process Tampering": {
1360+
"25": {
1361+
"level": "Information",
1362+
"channel": "Microsoft-Windows-Sysmon/Operational",
1363+
"provider": "Microsoft-Windows-Sysmon",
1364+
"notes": "ProcessTampering process image change"
1365+
}
1366+
},
1367+
"File Delete Detected": {
1368+
"26": {
1369+
"level": "Information",
1370+
"channel": "Microsoft-Windows-Sysmon/Operational",
1371+
"provider": "Microsoft-Windows-Sysmon",
1372+
"notes": "File Delete Detected"
1373+
}
1374+
},
1375+
"Error": {
1376+
"255": {
1377+
"level": "Information",
1378+
"channel": "Microsoft-Windows-Sysmon/Operational",
1379+
"provider": "Microsoft-Windows-Sysmon",
1380+
"notes": "Sysmon error"
1381+
}
1382+
}
1383+
}
1384+
},
11571385
"Windows Defender": {
11581386
"events": {
11591387
"ACG Audit": {

‎WindowsEventLogging.adoc

+41-10
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ The table below provides an overview of the events further described in section
2424
| Network Activity (<<network-activity-policy, policy>>, <<network-activity-default,default>>) | Network activity on the host which wasn't included in other categories, e.g. DHCP leases, DNS, Remote Desktop use and BITS jobs. | Low
2525
| Scheduled Tasks (<<scheduled-tasks-policy, policy>>, <<scheduled-tasks-default, default>>) | Records the creation and modification of Scheduled Tasks. | Low
2626
| <<Services>> | Records the creation and modification of services. | Low
27+
| <<System Monitor (Sysmon), Sysmon>> | Provides additional detection capabilities such as information about process creations, network activity, loading of drivers and more. | Depends on rule sets
2728
| <<System Security Extension>> | Records the loading of extension packages such as Security Support Providers (SSP) or Password Filters into the Local Security Authority (LSA) process. | Low
2829
| <<System Status>> | Records startup and shutdown of systems. Records application crashes and hangs. | Low
2930
| <<Object Access>> | Records access to network shares and objects that have system access control lists (SACL) specified. | High
@@ -107,20 +108,22 @@ Some organizations have guidelines or policies in place to limit the use of exte
107108
The events described here are aimed at providing additional context during analysis such as having a history of DHCP leases or domain names that may have been resolved in the past.
108109

109110
===== Address Assignment (DHCP)
110-
Records the assignment of IP addresses to interfaces. This information can be useful during analysis to determine which IP address was assigned to a system at some point in time. For these events to be available the DHCP-Client channel must be enabled. You can configure a Registry Key that enables the channel domain-wide using Group Policies.
111+
Records the assignment of IP addresses to interfaces. This information can be useful during analysis to determine which IP address was assigned to a system at some point in time.
111112

112-
`Computer Configuration -> Preferences -> Windows Settings -> Registry -> New -> Registry Item`
113+
For these events to be available the DHCP-Client and DHCPv6-Client channel must be enabled. There are multiple ways these channels can be enabled but we found that using PowerShell provides the most reliable result.
113114

114-
DHCPv4: `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Dhcp-Client/Operational`
115+
[source,powershell]
116+
----
117+
$logs = Get-WinEvent -ListLog "Microsoft-Windows-Dhcp*-Client/Operational"
118+
Foreach($log in $logs) {
119+
$log.IsEnabled = $true
120+
$log.MaximumSizeInBytes = $10MB
121+
$log.SaveChanges()
122+
}
123+
----
115124

116-
DHCPv6: `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Dhcpv6-Client/Operational`
125+
You should distribute these commands across your domain according to your company's deployment strategy using elevated privileges. Deployment using configuration management software is preferred. Alternatively you can use something like an apply once scheduled task using group policiesfootnote:[https://www.faqforge.com/windows-server-2016/configure-scheduled-task-item-using-group-policy/].
117126

118-
[cols="1,1,1,1"]
119-
|===
120-
| Value Name | Value Type | Value data | Configure for
121-
122-
| Enabled | REG_DWORD | 1 | All
123-
|===
124127

125128
===== Name Resolution (DNS)
126129
Malware may attempt to resolve domain names for the retrieval of additional files or communicating with Command & Control servers. Collecting DNS queries can be helpful in order to enable the discovery of compromise or intrusion during analysis.
@@ -329,6 +332,10 @@ In addition to the <<Scheduled Tasks, Object Access>> policy, events in the dedi
329332
==== Services
330333
Records failures and crashes of Windows Services. The installation of new services is tracked by <<System Security Extension>>.
331334

335+
==== System Monitor (Sysmon)
336+
Microsoft Sysmon provides additional detection capabilities, based on a user-specified configuration. If you have Sysmon configured in your environment, you should add the events to your collection strategy. If you are using our default subscription file, the events are already included.
337+
338+
Our current advice does not cover the deployment or configuration of Sysmon. If you have deployed Sysmon, you should tweak your configuration for your environment to prevent spamming of events.
332339

333340
==== System Status
334341
Events in this category include: startup and shutdown of a system, application crashes and modifications to the system time. Tracking the startup and shutdown events of a system can provide additional context during analysis. Unstable or crashing applications may be an indication of malicious activity or exploitation attempts.
@@ -398,6 +405,29 @@ This table can be used to configure your central collection.
398405
| Microsoft-Windows-Security-Mitigations/UserMode| Microsoft-Windows-Security-Mitigations | 22 | True
399406
| Microsoft-Windows-Security-Mitigations/UserMode| Microsoft-Windows-Security-Mitigations | 23 | True
400407
| Microsoft-Windows-Security-Mitigations/UserMode| Microsoft-Windows-Security-Mitigations | 24 | True
408+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 0 | True
409+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 1 | True
410+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 2 | True
411+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 3 | True
412+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 4 | True
413+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 5 | True
414+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 6 | True
415+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 7 | True
416+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 8 | True
417+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 9 | True
418+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 10 | True
419+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 11 | True
420+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 14 | True
421+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 15 | True
422+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 16 | True
423+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 18 | True
424+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 21 | True
425+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 22 | True
426+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 23 | True
427+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 24 | True
428+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 25 | True
429+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 26 | True
430+
| Microsoft-Windows-Sysmon/Operational| Microsoft-Windows-Sysmon | 255 | True
401431
| Microsoft-Windows-TaskScheduler/Operational| Microsoft-Windows-TaskScheduler | 200 | True
402432
| Microsoft-Windows-TaskScheduler/Operational| Microsoft-Windows-TaskScheduler | 201 | True
403433
| Microsoft-Windows-TerminalServices-RDPClient/Operational| Microsoft-Windows-TerminalServices-ClientActiveXCore | 1024 | True
@@ -527,3 +557,4 @@ This table can be used to configure your central collection.
527557
|===
528558

529559

560+

0 commit comments

Comments
 (0)