Cheat sheet

Sysmon configuration

Installing Sysmon and writing its configuration: what to log and what to leave out. Event numbers are in Windows Event IDs.

CDSA CDEPDetection

Commands

Command	Effect
sysmon64 -accepteula -i config.xml	Install Sysmon with a configuration
sysmon64 -c config.xml	Apply a new configuration
sysmon64 -c	Show the current configuration
sysmon64 -s	Show the configuration schema
sysmon64 -u	Uninstall Sysmon

Events land in the Microsoft-Windows-Sysmon/Operational log.

Configuration structure

Element	Role
<Sysmon schemaversion>	File root, with the schema version
<HashAlgorithms>	Hashes computed: MD5, SHA1, SHA256, IMPHASH
<EventFiltering>	Holds every filtering rule
<RuleGroup>	Group of rules combined with and or or (groupRelation)
onmatch="include"	Log only what matches
onmatch="exclude"	Log everything except what matches
<ProcessCreate>	Filter for event 1 (process creation)
<NetworkConnect>	Filter for event 3 (network connection)
<ProcessAccess>	Filter for event 10 (process access)

<Sysmon schemaversion="4.90">
  <HashAlgorithms>SHA256,IMPHASH</HashAlgorithms>
  <EventFiltering>
    <RuleGroup name="" groupRelation="or">
      <ProcessCreate onmatch="exclude">
        <Image condition="is">C:\Windows\System32\svchost.exe</Image>
      </ProcessCreate>
    </RuleGroup>
    <RuleGroup name="" groupRelation="or">
      <ProcessAccess onmatch="include">
        <TargetImage condition="end with">lsass.exe</TargetImage>
      </ProcessAccess>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

Filtering conditions

Condition	Effect
is	Exact match (default)
is not	Different value
is any	Equal to one of the values separated by ;
contains	Contains the value
contains any	Contains one of the values separated by ;
excludes	Does not contain the value
begin with	Starts with the value
end with	Ends with the value
image	Compares the executable name, with or without path
less than	Lower value (string comparison)

Start from a known baselineThe public SwiftOnSecurity/sysmon-config (simple starting point) and olafhartong/sysmon-modular (modular, mapped to ATT&CK) configurations save writing everything. Then test the volume produced before deploying.