2026-04-13 08-39-21

0:07

S… Speaker 1 (2026-04-13 08-39-21)

In this video,

0:08

S… Speaker 2 (2026-04-13 08-39-21)

we're going to take a look at Sysmon,

0:10

S… Speaker 2 (2026-04-13 08-39-21)

what Sysmon is,

0:12

S… Speaker 2 (2026-04-13 08-39-21)

and how it is used in threat hunting.

0:16

S… Speaker 2 (2026-04-13 08-39-21)

So first of all,

0:16

S… Speaker 2 (2026-04-13 08-39-21)

let's take a look at really what is Sysmon.

0:19

S… Speaker 2 (2026-04-13 08-39-21)

We've talked about it several times throughout this course.

0:22

S… Speaker 2 (2026-04-13 08-39-21)

Sysmon is part of Microsoft's Sysinternals suite

0:27

S… Speaker 1 (2026-04-13 08-39-21)

of tools,

0:28

S… Speaker 2 (2026-04-13 08-39-21)

and its job is basically to monitor systems.

0:33

S… Speaker 2 (2026-04-13 08-39-21)

and log additional activity into the Windows event

0:37

S… Speaker 2 (2026-04-13 08-39-21)

log for various activities and actions that happen on the system.

0:42

S… Speaker 2 (2026-04-13 08-39-21)

This is done to kind of supplement and complement the logging

0:47

S… Speaker 2 (2026-04-13 08-39-21)

that's built into Windows because it does log additional

0:51

S… Speaker 2 (2026-04-13 08-39-21)

information that's not included in your default Windows event

0:55

S… Speaker 1 (2026-04-13 08-39-21)

logs.

0:55

S… Speaker 2 (2026-04-13 08-39-21)

Things like information about newly created files on a

0:59

S… Speaker 2 (2026-04-13 08-39-21)

system or information about network connections.

1:03

S… Speaker 2 (2026-04-13 08-39-21)

Now, there's a lot more than just these two.

1:05

S… Speaker 2 (2026-04-13 08-39-21)

We'll go over those here in just a minute,

1:07

S… Speaker 2 (2026-04-13 08-39-21)

but those are two very useful examples.

1:10

S… Speaker 2 (2026-04-13 08-39-21)

It operates on a Windows system as a system

1:14

S… Speaker 2 (2026-04-13 08-39-21)

service and a device driver and runs

1:18

S… Speaker 2 (2026-04-13 08-39-21)

as a protected process.

1:21

S… Speaker 2 (2026-04-13 08-39-21)

Now,

1:21

S… Speaker 2 (2026-04-13 08-39-21)

this protected process status is there to kind of disallows

1:26

S… Speaker 2 (2026-04-13 08-39-21)

a large range of interactions with the service

1:30

S… Speaker 2 (2026-04-13 08-39-21)

and the driver itself.

1:32

S… Speaker 2 (2026-04-13 08-39-21)

which kind of helps protect Sysmon from malicious activity.

1:36

S… Speaker 2 (2026-04-13 08-39-21)

It's not going to completely prevent any sort of malicious activity.

1:40

S… Speaker 2 (2026-04-13 08-39-21)

It could still be targeted,

1:41

S… Speaker 2 (2026-04-13 08-39-21)

but it does help protect it a little better as well.

1:44

S… Speaker 1 (2026-04-13 08-39-21)

So Sysmon,

1:46

S… Speaker 2 (2026-04-13 08-39-21)

when we're talking about threat hunting,

1:48

S… Speaker 2 (2026-04-13 08-39-21)

should be installed as on many Windows endpoints as you can,

1:52

S… Speaker 2 (2026-04-13 08-39-21)

as is needed for the organization,

1:54

S… Speaker 2 (2026-04-13 08-39-21)

depending on what your threat hunting activities look like.

1:59

S… Speaker 1 (2026-04-13 08-39-21)

Again,

2:00

S… Speaker 2 (2026-04-13 08-39-21)

some data that is not logged by default

2:04

S… Speaker 2 (2026-04-13 08-39-21)

from your Windows events is important here

2:08

S… Speaker 2 (2026-04-13 08-39-21)

because it's needed for threat hunting.

2:11

S… Speaker 2 (2026-04-13 08-39-21)

Now, we're not going to get into the process of how

2:15

S… Speaker 2 (2026-04-13 08-39-21)

to install Sysmon in this course or in this video.

2:19

S… Speaker 2 (2026-04-13 08-39-21)

Microsoft has very good documentation on Sysmon.

2:24

S… Speaker 2 (2026-04-13 08-39-21)

The assumption for this course is that we're already past the preparation

2:28

S… Speaker 2 (2026-04-13 08-39-21)

phase for threat hunting and we're into the active threat hunts

2:32

S… Speaker 2 (2026-04-13 08-39-21)

at this point.

2:33

S… Speaker 2 (2026-04-13 08-39-21)

But it's still very important to understand Sysmon to be familiar with

2:37

S… Speaker 2 (2026-04-13 08-39-21)

the event IDs that it creates and what sort of information

2:41

S… Speaker 2 (2026-04-13 08-39-21)

you can get out of Sysmon.

2:43

S… Speaker 1 (2026-04-13 08-39-21)

And then again,

2:44

S… Speaker 2 (2026-04-13 08-39-21)

ideally,

2:45

S… Speaker 2 (2026-04-13 08-39-21)

as with any of your events and logging

2:49

S… Speaker 1 (2026-04-13 08-39-21)

data,

2:50

S… Speaker 2 (2026-04-13 08-39-21)

These should be forwarded to some sort of a centralized logging

2:54

S… Speaker 2 (2026-04-13 08-39-21)

platform, ideally where you're performing your threat hunts.

2:57

S… Speaker 2 (2026-04-13 08-39-21)

Again, that's going to depend on the organizations.

2:59

S… Speaker 2 (2026-04-13 08-39-21)

So let's take a look at some of the things that Sysmon is

3:03

S… Speaker 2 (2026-04-13 08-39-21)

capable of doing.

3:05

S… Speaker 1 (2026-04-13 08-39-21)

Number one,

3:06

S… Speaker 2 (2026-04-13 08-39-21)

it can log information about newly created processes,

3:10

S… Speaker 2 (2026-04-13 08-39-21)

including the full command that was entered to

3:14

S… Speaker 2 (2026-04-13 08-39-21)

start a new process.

3:16

S… Speaker 2 (2026-04-13 08-39-21)

And this includes the process that is run and also the parent

3:20

S… Speaker 2 (2026-04-13 08-39-21)

process that launches it.

3:22

S… Speaker 2 (2026-04-13 08-39-21)

It can record the hash information of any process

3:27

S… Speaker 2 (2026-04-13 08-39-21)

or application that is launched on the system.

3:30

S… Speaker 1 (2026-04-13 08-39-21)

And that does,

3:31

S… Speaker 2 (2026-04-13 08-39-21)

that hash values get recorded in a couple of different algorithms.

3:35

S… Speaker 2 (2026-04-13 08-39-21)

I know it does MD5,

3:37

S… Speaker 1 (2026-04-13 08-39-21)

SHA -256,

3:38

S… Speaker 2 (2026-04-13 08-39-21)

and I believe one or two others that I can't remember off the top of my head.

3:42

S… Speaker 2 (2026-04-13 08-39-21)

But MD5 and SHA -256 being the kind of most

3:46

S… Speaker 2 (2026-04-13 08-39-21)

useful when we're talking about threat hunting and just cybersecurity in general.

3:51

S… Speaker 2 (2026-04-13 08-39-21)

It will also log information about drivers that are loaded into

3:55

S… Speaker 2 (2026-04-13 08-39-21)

the system and DLLs that are loaded into the system,

3:58

S… Speaker 2 (2026-04-13 08-39-21)

including any signature information for those files,

4:02

S… Speaker 2 (2026-04-13 08-39-21)

and then again,

4:02

S… Speaker 2 (2026-04-13 08-39-21)

the file hashes themselves.

4:04

S… Speaker 2 (2026-04-13 08-39-21)

It can log information about network connections,

4:07

S… Speaker 2 (2026-04-13 08-39-21)

including the process that initiated the network connection on that

4:11

S… Speaker 2 (2026-04-13 08-39-21)

system, IP address,

4:13

S… Speaker 2 (2026-04-13 08-39-21)

port information,

4:14

S… Speaker 2 (2026-04-13 08-39-21)

hostname information,

4:15

S… Speaker 2 (2026-04-13 08-39-21)

if there is any hostname associated with it.

4:18

S… Speaker 2 (2026-04-13 08-39-21)

Obviously, if the...

4:20

S… Speaker 2 (2026-04-13 08-39-21)

network connection is initiated just to an IP address,

4:23

S… Speaker 2 (2026-04-13 08-39-21)

you're not going to have any hostname information there.

4:25

S… Speaker 2 (2026-04-13 08-39-21)

Any information about when files are created

4:30

S… Speaker 1 (2026-04-13 08-39-21)

or overwritten,

4:31

S… Speaker 2 (2026-04-13 08-39-21)

it will log information about those,

4:33

S… Speaker 2 (2026-04-13 08-39-21)

including any changes to the file creation

4:37

S… Speaker 2 (2026-04-13 08-39-21)

timestamp,

4:38

S… Speaker 2 (2026-04-13 08-39-21)

which is something attackers may commonly abuse as well.

4:42

S… Speaker 2 (2026-04-13 08-39-21)

So that's an overview of what Sysmon is capable

4:47

S… Speaker 1 (2026-04-13 08-39-21)

of doing.

4:47

S… Speaker 2 (2026-04-13 08-39-21)

Let's take a look at the individual events that it

4:51

S… Speaker 2 (2026-04-13 08-39-21)

launches now so you can have a better understanding of what these events are

4:55

S… Speaker 2 (2026-04-13 08-39-21)

when it comes to searching for them in threat hunting.

5:00

S… Speaker 1 (2026-04-13 08-39-21)

Event ID 1,

5:01

S… Speaker 1 (2026-04-13 08-39-21)

and again, these are unique IDs to Sysmon.

5:04

S… Speaker 1 (2026-04-13 08-39-21)

Event ID 1 is logged when a new process

5:09

S… Speaker 1 (2026-04-13 08-39-21)

is created and includes,

5:10

S… Speaker 1 (2026-04-13 08-39-21)

again, the full command line information of the process that

5:14

S… Speaker 2 (2026-04-13 08-39-21)

was launched,

5:15

S… Speaker 1 (2026-04-13 08-39-21)

including the hash of the file when it's launched.

5:19

S… Speaker 1 (2026-04-13 08-39-21)

Event ID 2,

5:21

S… Speaker 1 (2026-04-13 08-39-21)

like I just talked about,

5:22

S… Speaker 1 (2026-04-13 08-39-21)

is logged when a process changes

5:26

S… Speaker 1 (2026-04-13 08-39-21)

the file creation timestamp.

5:29

S… Speaker 1 (2026-04-13 08-39-21)

Now, attackers might change the creation timestamp for various

5:33

S… Speaker 1 (2026-04-13 08-39-21)

different reasons to evade detection,

5:36

S… Speaker 1 (2026-04-13 08-39-21)

but there are processes that will also legitimately do this.

5:40

S… Speaker 1 (2026-04-13 08-39-21)

So the presence of this event does not necessarily mean there's malicious

5:44

S… Speaker 1 (2026-04-13 08-39-21)

activity,

5:45

S… Speaker 1 (2026-04-13 08-39-21)

just like any other indicator.

5:48

S… Speaker 1 (2026-04-13 08-39-21)

But the context does matter there.

5:50

S… Speaker 1 (2026-04-13 08-39-21)

Attackers will do this sometimes.

5:53

S… Speaker 1 (2026-04-13 08-39-21)

So just be aware of that.

5:55

S… Speaker 1 (2026-04-13 08-39-21)

Event ID 3 is logged when a network connection

5:59

S… Speaker 1 (2026-04-13 08-39-21)

is initiated.

6:00

S… Speaker 1 (2026-04-13 08-39-21)

And again, this includes the process information that initiated the network

6:04

S… Speaker 1 (2026-04-13 08-39-21)

connection, the source and destination IP addresses,

6:07

S… Speaker 1 (2026-04-13 08-39-21)

the destination port,

6:09

S… Speaker 1 (2026-04-13 08-39-21)

and again, the host name if that is relevant to the connection

6:13

S… Speaker 2 (2026-04-13 08-39-21)

request.

6:14

S… Speaker 1 (2026-04-13 08-39-21)

Event ID 6 is logged when new drivers are loaded and again includes

6:18

S… Speaker 1 (2026-04-13 08-39-21)

the signature of the driver and hash information for that file.

6:23

S… Speaker 1 (2026-04-13 08-39-21)

Event ID 8 is technically called the create remote

6:27

S… Speaker 1 (2026-04-13 08-39-21)

thread event ID.

6:29

S… Speaker 1 (2026-04-13 08-39-21)

This is logged when a thread is created inside

6:33

S… Speaker 1 (2026-04-13 08-39-21)

another process.

6:35

S… Speaker 1 (2026-04-13 08-39-21)

Basically, you'll have a process that creates a thread inside

6:39

S… Speaker 1 (2026-04-13 08-39-21)

another process,

6:40

S… Speaker 1 (2026-04-13 08-39-21)

and this is very frequently used by malware as a form

6:44

S… Speaker 1 (2026-04-13 08-39-21)

of code injection and to be able to hide from detection.

6:49

S… Speaker 1 (2026-04-13 08-39-21)

This event will include information on the source and target processes

6:53

S… Speaker 1 (2026-04-13 08-39-21)

and information on the code that is being

6:57

S… Speaker 1 (2026-04-13 08-39-21)

run in that new thread as well.

7:01

S… Speaker 2 (2026-04-13 08-39-21)

So it includes information on the source,

7:04

S… Speaker 1 (2026-04-13 08-39-21)

target process,

7:05

S… Speaker 1 (2026-04-13 08-39-21)

and the injected code as well.

7:07

S… Speaker 1 (2026-04-13 08-39-21)

Event ID 9 is logged when there is a raw

7:11

S… Speaker 1 (2026-04-13 08-39-21)

access to disk request.

7:14

S… Speaker 1 (2026-04-13 08-39-21)

This will include information about the source process that

7:18

S… Speaker 1 (2026-04-13 08-39-21)

initiated the request and the disk device that it's requesting access

7:22

S… Speaker 2 (2026-04-13 08-39-21)

to as well.

7:24

S… Speaker 1 (2026-04-13 08-39-21)

This is very frequently used by malware for reading data,

7:28

S… Speaker 1 (2026-04-13 08-39-21)

exfiltrating data that might otherwise be locked through regular

7:32

S… Speaker 1 (2026-04-13 08-39-21)

disk access.

7:33

S… Speaker 1 (2026-04-13 08-39-21)

This is also a way that attackers can access information and

7:37

S… Speaker 1 (2026-04-13 08-39-21)

files while attempting to evade file access

7:41

S… Speaker 1 (2026-04-13 08-39-21)

auditing utilities.

7:43

S… Speaker 1 (2026-04-13 08-39-21)

So any utilities or tools that might be monitoring file access on

7:47

S… Speaker 1 (2026-04-13 08-39-21)

drives, this can potentially be a way to

7:51

S… Speaker 1 (2026-04-13 08-39-21)

evade that detection by an attacker.

7:53

S… Speaker 1 (2026-04-13 08-39-21)

Then you have event ID number 10.

7:57

S… Speaker 1 (2026-04-13 08-39-21)

This is when a process opens another process.

8:01

S… Speaker 1 (2026-04-13 08-39-21)

Usually this is going to be followed by reading

8:05

S… Speaker 1 (2026-04-13 08-39-21)

or writing of the address space inside that second

8:09

S… Speaker 1 (2026-04-13 08-39-21)

target process.

8:10

S… Speaker 1 (2026-04-13 08-39-21)

This can be very helpful trying to detect malware that's

8:15

S… Speaker 1 (2026-04-13 08-39-21)

designed to do things like steal credentials and various other

8:19

S… Speaker 1 (2026-04-13 08-39-21)

malicious activities.

8:21

S… Speaker 1 (2026-04-13 08-39-21)

Few more events we'll look at.

8:23

S… Speaker 1 (2026-04-13 08-39-21)

Event ID 11 is when a file is created or a file is

8:27

S… Speaker 2 (2026-04-13 08-39-21)

overwritten.

8:28

S… Speaker 1 (2026-04-13 08-39-21)

This is a very useful event ID when it comes to threat hunting,

8:32

S… Speaker 1 (2026-04-13 08-39-21)

especially when you're looking at trying to detect any sort of

8:36

S… Speaker 2 (2026-04-13 08-39-21)

payload downloads,

8:38

S… Speaker 1 (2026-04-13 08-39-21)

because as a file is downloaded and saved to disk,

8:41

S… Speaker 1 (2026-04-13 08-39-21)

the file is created and would be logged here.

8:44

S… Speaker 1 (2026-04-13 08-39-21)

This can also help detect and

8:48

S… Speaker 1 (2026-04-13 08-39-21)

find

8:51

S… Speaker 1 (2026-04-13 08-39-21)

modifications to auto run and auto start locations,

8:54

S… Speaker 1 (2026-04-13 08-39-21)

because this can be done through new files created in

8:58

S… Speaker 1 (2026-04-13 08-39-21)

specific locations,

9:00

S… Speaker 1 (2026-04-13 08-39-21)

like the auto run location or auto start location for Windows.

9:03

S… Speaker 1 (2026-04-13 08-39-21)

That can also be done in the registry,

9:05

S… Speaker 1 (2026-04-13 08-39-21)

which is separate.

9:06

S… Speaker 1 (2026-04-13 08-39-21)

We'll get to that here in just a second.

9:07

S… Speaker 1 (2026-04-13 08-39-21)

And it can also,

9:09

S… Speaker 1 (2026-04-13 08-39-21)

like I said,

9:09

S… Speaker 1 (2026-04-13 08-39-21)

monitor locations like temp folders and other common

9:14

S… Speaker 1 (2026-04-13 08-39-21)

download locations,

9:15

S… Speaker 1 (2026-04-13 08-39-21)

very common places for malware or for attackers to download malware.

9:20

S… Speaker 1 (2026-04-13 08-39-21)

And you have three event IDs for registry changes,

9:24

S… Speaker 2 (2026-04-13 08-39-21)

event ID 12,

9:25

S… Speaker 1 (2026-04-13 08-39-21)

13, and 14.

9:26

S… Speaker 1 (2026-04-13 08-39-21)

12 being logged when any registry object is

9:30

S… Speaker 1 (2026-04-13 08-39-21)

created or deleted.

9:32

S… Speaker 1 (2026-04-13 08-39-21)

13 being when a registry value is modified

9:36

S… Speaker 2 (2026-04-13 08-39-21)

or set.

9:36

S… Speaker 1 (2026-04-13 08-39-21)

And 14 being when a key or value is renamed.

9:41

S… Speaker 1 (2026-04-13 08-39-21)

Again,

9:42

S… Speaker 1 (2026-04-13 08-39-21)

this can be useful for detecting modifications for

9:48

S… Speaker 1 (2026-04-13 08-39-21)

services on the system or for,

9:51

S… Speaker 1 (2026-04-13 08-39-21)

again, auto -run purposes because those can both be done within the

9:56

S… Speaker 2 (2026-04-13 08-39-21)

registry.

9:57

S… Speaker 1 (2026-04-13 08-39-21)

You have events IDs number 19,

9:59

S… Speaker 1 (2026-04-13 08-39-21)

20, and 21 that are all related to various different WMI

10:04

S… Speaker 2 (2026-04-13 08-39-21)

events.

10:04

S… Speaker 1 (2026-04-13 08-39-21)

Event ID number 22 is logged whenever a process

10:09

S… Speaker 1 (2026-04-13 08-39-21)

is trying to use

10:13

S… Speaker 1 (2026-04-13 08-39-21)

a DNS query,

10:14

S… Speaker 1 (2026-04-13 08-39-21)

and that is logged whether the query is successful or not,

10:19

S… Speaker 1 (2026-04-13 08-39-21)

and whether the request is cached or not.

10:22

S… Speaker 1 (2026-04-13 08-39-21)

And it will log information about the process that requested

10:26

S… Speaker 1 (2026-04-13 08-39-21)

this DNS information as well.

10:29

S… Speaker 1 (2026-04-13 08-39-21)

You have event ID number 23.

10:33

S… Speaker 1 (2026-04-13 08-39-21)

This is logged when any files are deleted on

10:37

S… Speaker 1 (2026-04-13 08-39-21)

the system.

10:38

S… Speaker 1 (2026-04-13 08-39-21)

Now, in addition to logging the information about the

10:42

S… Speaker 1 (2026-04-13 08-39-21)

file that's being deleted,

10:44

S… Speaker 1 (2026-04-13 08-39-21)

It will also archive that deleted file to

10:48

S… Speaker 1 (2026-04-13 08-39-21)

a location on the drive,

10:50

S… Speaker 1 (2026-04-13 08-39-21)

and this is configurable in the Sysmon configuration.

10:53

S… Speaker 1 (2026-04-13 08-39-21)

So you will have a log of

10:57

S… Speaker 1 (2026-04-13 08-39-21)

the file that was deleted.

10:59

S… Speaker 1 (2026-04-13 08-39-21)

Now you also have event ID 26,

11:02

S… Speaker 1 (2026-04-13 08-39-21)

which basically does the same thing.

11:03

S… Speaker 1 (2026-04-13 08-39-21)

It logs the information about a file being deleted,

11:06

S… Speaker 2 (2026-04-13 08-39-21)

but does not archive the file.

11:08

S… Speaker 1 (2026-04-13 08-39-21)

New event ID number 25.

11:10

S… Speaker 1 (2026-04-13 08-39-21)

This is logged when any sort of process tampering is detected.

11:15

S… Speaker 1 (2026-04-13 08-39-21)

This is useful when trying to detect process hiding

11:19

S… Speaker 1 (2026-04-13 08-39-21)

techniques as well.

11:22

S… Speaker 1 (2026-04-13 08-39-21)

There are more events than just these in

11:26

S… Speaker 1 (2026-04-13 08-39-21)

Sysmon.

11:27

S… Speaker 1 (2026-04-13 08-39-21)

Not a whole lot of them,

11:28

S… Speaker 2 (2026-04-13 08-39-21)

but there are more.

11:29

S… Speaker 1 (2026-04-13 08-39-21)

These are the kind of most useful ones when we're talking about

11:33

S… Speaker 2 (2026-04-13 08-39-21)

threat hunting.

11:34

S… Speaker 1 (2026-04-13 08-39-21)

Now, one thing to note here,

11:36

S… Speaker 1 (2026-04-13 08-39-21)

not all of these events are going to be enabled by

11:40

S… Speaker 2 (2026-04-13 08-39-21)

default.

11:41

S… Speaker 1 (2026-04-13 08-39-21)

A good example there is event ID number three.

11:44

S… Speaker 1 (2026-04-13 08-39-21)

for logging network connections that one is not enabled by default it

11:48

S… Speaker 1 (2026-04-13 08-39-21)

needs to be configured to be turned on in the configuration file

11:53

S… Speaker 1 (2026-04-13 08-39-21)

when you are installing and configuring sysmon for

11:57

S… Speaker 1 (2026-04-13 08-39-21)

the first time on a system so a lot of useful information you

12:01

S… Speaker 1 (2026-04-13 08-39-21)

can get out of these events using sysmon but just remember there

12:06

S… Speaker 1 (2026-04-13 08-39-21)

is some configuration that's required to enable some of

12:10

S… Speaker 1 (2026-04-13 08-39-21)

this logging information

2026-04-13 08-39-21

תקציר

שאל את אל על התעתיק הזה.