Skip to content

Commit 72f2256

Browse files
phantinussphantinuss
authored
Merge pull request #7 from phantinuss/master
harmonization of tabs for indentation (is prevalent type) and ProcessAccess rule for CobaltStrike BOF injected AMSI Bypass
2 parents 9af65f5 + 20025a0 commit 72f2256

1 file changed

Lines changed: 66 additions & 61 deletions

File tree

‎sysmonconfig-export.xml‎

Lines changed: 66 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,57 @@
11
<!--
2-
sysmon-config | A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
3-
Source version: 73 | Date: 2021-02-16
4-
Source project: https://github.com/SwiftOnSecurity/sysmon-config
5-
Source license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
6-
7-
REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
8-
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
9-
10-
NOTE: To collect Sysmon logs centrally for free, see https://aka.ms/WEF | Command to allow log access to the Network Service:
11-
wevtutil.exe sl Microsoft-Windows-Sysmon/Operational /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS)
12-
13-
NOTE: Do not let the size and complexity of this configuration discourage you from customizing it or building your own.
14-
This configuration is based around known, high-signal event tracing, and thus appears complicated, but it is only very
15-
detailed. Significant effort over years has been invested in front-loading as much filtering as possible onto the
16-
client. This is to make analysis of intrusions possible by hand, and to try to surface anomalous activity as quickly
17-
as possible to technicians armed only with Event Viewer. Its purpose is to democratize system monitoring for all organizations.
18-
19-
NOTE: Sysmon is NOT a whitelist solution or HIDS correlation engine, it is a computer change logging tool.
20-
Do NOT ignore everything possible. Sysmon's purpose is providing context during a threat or problem investigation. Legitimate
21-
processes are routinely used by threats - do not blindly exclude them. Additionally, be mindful of process-hollowing / imitation.
22-
23-
NOTE: By default this monitors DNS, which is extremely noisy. If you are starting out on your monitoring journey, just remove that section.
24-
You can remove DNS events from Event Viewer screen by applying a 'Filter Current View' for event IDs of: -22
25-
Additionally, if you want to monitor DNS, you should deploy client-side adblocking to reduce lookups. See the DNS section for info.
26-
27-
NOTE: This configuration is designed for PER-MACHINE installs of Chrome and OneDrive. That moves their binaries out of user-controlled folders.
28-
Otherwise, attackers could imitate these common applications, and bypass your logging. Below are silent upgrades you can do, no user impact:
29-
- https://docs.microsoft.com/en-us/onedrive/per-machine-installation
30-
- https://cloud.google.com/chrome-enterprise/browser/download/
31-
- As of 2021-02-16 there is no machine-level version of Microsoft Teams. The one provided copies itself to the user profile.
32-
33-
NOTE: Sysmon is not hardened against an attacker with admin rights. Additionally, this configuration offers an attacker, willing
34-
to study it, limited ways to evade some of the logging. If you are in a very high-threat environment, you should consider a broader,
35-
log-most approach. However, in the vast majority of cases, an attacker will bumble through multiple behavioral traps which
36-
this configuration monitors, especially in the first minutes.
37-
38-
NOTE: If you encounter unexplainable event inclusion/exclusion, you may have a second Sysmon instance installed under a different exe filename.
39-
To clear this, try downloading the latest version and uninstalling with -u force. If it hangs, kill the processes and run it again to cleanup.
40-
41-
TECHNICAL:
42-
- Run sysmon.exe -? for a briefing on Sysmon configuration.
43-
- Sysmon XML cannot use the AMPERSAND sign. Replace it with this: &amp;
44-
- Sysmon 8+ can track which rule caused an event to be logged through the "RuleName" field.
45-
- If you only specify exclude for a filtering subsection, everything in that subsection is logged by default.
46-
- Some Sysmon monitoring abilities are not meant for widely deployed general-purpose use due to performance impact. Depends on environment.
47-
- Duplicate or overlapping "Include" rules do not result in duplicate events being logged.
48-
- All characters enclosed by XML tags are always interpreted literally. Sysmon does not support wildcards (*), alternate characters, or RegEx.
49-
- In registry events, the value name is appended to the full key path with a "\" delimiter. Default key values are named "\(Default)"
50-
- "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
51-
- "ProcessGuid" and "LoginGuid" are not random, they contain some embedded information. https://gist.github.com/mattifestation/0102042160c9a60b2b847378c0ef70b4
52-
53-
FILTERING: Filter conditions available for use are: is,is any,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,not begin with,not end with,less than,more than,image
54-
- The "image" filter is usable on any field. Same as "is" but can either match entire string, or only the text after last "\". Credit: @mattifestation
2+
sysmon-config | A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
3+
Source version: 73 | Date: 2021-02-16
4+
Source project: https://github.com/SwiftOnSecurity/sysmon-config
5+
Source license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
6+
7+
REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
8+
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
9+
10+
NOTE: To collect Sysmon logs centrally for free, see https://aka.ms/WEF | Command to allow log access to the Network Service:
11+
wevtutil.exe sl Microsoft-Windows-Sysmon/Operational /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS)
12+
13+
NOTE: Do not let the size and complexity of this configuration discourage you from customizing it or building your own.
14+
This configuration is based around known, high-signal event tracing, and thus appears complicated, but it is only very
15+
detailed. Significant effort over years has been invested in front-loading as much filtering as possible onto the
16+
client. This is to make analysis of intrusions possible by hand, and to try to surface anomalous activity as quickly
17+
as possible to technicians armed only with Event Viewer. Its purpose is to democratize system monitoring for all organizations.
18+
19+
NOTE: Sysmon is NOT a whitelist solution or HIDS correlation engine, it is a computer change logging tool.
20+
Do NOT ignore everything possible. Sysmon's purpose is providing context during a threat or problem investigation. Legitimate
21+
processes are routinely used by threats - do not blindly exclude them. Additionally, be mindful of process-hollowing / imitation.
22+
23+
NOTE: By default this monitors DNS, which is extremely noisy. If you are starting out on your monitoring journey, just remove that section.
24+
You can remove DNS events from Event Viewer screen by applying a 'Filter Current View' for event IDs of: -22
25+
Additionally, if you want to monitor DNS, you should deploy client-side adblocking to reduce lookups. See the DNS section for info.
26+
27+
NOTE: This configuration is designed for PER-MACHINE installs of Chrome and OneDrive. That moves their binaries out of user-controlled folders.
28+
Otherwise, attackers could imitate these common applications, and bypass your logging. Below are silent upgrades you can do, no user impact:
29+
- https://docs.microsoft.com/en-us/onedrive/per-machine-installation
30+
- https://cloud.google.com/chrome-enterprise/browser/download/
31+
- As of 2021-02-16 there is no machine-level version of Microsoft Teams. The one provided copies itself to the user profile.
32+
33+
NOTE: Sysmon is not hardened against an attacker with admin rights. Additionally, this configuration offers an attacker, willing
34+
to study it, limited ways to evade some of the logging. If you are in a very high-threat environment, you should consider a broader,
35+
log-most approach. However, in the vast majority of cases, an attacker will bumble through multiple behavioral traps which
36+
this configuration monitors, especially in the first minutes.
37+
38+
NOTE: If you encounter unexplainable event inclusion/exclusion, you may have a second Sysmon instance installed under a different exe filename.
39+
To clear this, try downloading the latest version and uninstalling with -u force. If it hangs, kill the processes and run it again to cleanup.
40+
41+
TECHNICAL:
42+
- Run sysmon.exe -? for a briefing on Sysmon configuration.
43+
- Sysmon XML cannot use the AMPERSAND sign. Replace it with this: &amp;
44+
- Sysmon 8+ can track which rule caused an event to be logged through the "RuleName" field.
45+
- If you only specify exclude for a filtering subsection, everything in that subsection is logged by default.
46+
- Some Sysmon monitoring abilities are not meant for widely deployed general-purpose use due to performance impact. Depends on environment.
47+
- Duplicate or overlapping "Include" rules do not result in duplicate events being logged.
48+
- All characters enclosed by XML tags are always interpreted literally. Sysmon does not support wildcards (*), alternate characters, or RegEx.
49+
- In registry events, the value name is appended to the full key path with a "\" delimiter. Default key values are named "\(Default)"
50+
- "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
51+
- "ProcessGuid" and "LoginGuid" are not random, they contain some embedded information. https://gist.github.com/mattifestation/0102042160c9a60b2b847378c0ef70b4
52+
53+
FILTERING: Filter conditions available for use are: is,is any,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,not begin with,not end with,less than,more than,image
54+
- The "image" filter is usable on any field. Same as "is" but can either match entire string, or only the text after last "\". Credit: @mattifestation
5555
5656
-->
5757

@@ -129,7 +129,7 @@
129129
<CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc</CommandLine>
130130
<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s nsi</CommandLine>
131131
<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s w32Time</CommandLine>
132-
<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Windows: Network services-->
132+
<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Windows: Network services-->
133133
<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p</CommandLine> <!--Windows: Network services-->
134134
<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp</CommandLine> <!--Windows: Network services-->
135135
<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog</CommandLine>
@@ -342,7 +342,7 @@
342342
<Image condition="image">nc64.exe</Image> <!-- 64-bit version of nc that can be used on 64-bit Windows Architectures https://github.com/DarrenRainey/netcat-->
343343
<Image condition="image">ncat.exe</Image> <!-- Nmap's modern version of netcat [ https://nmap.org/ncat/guide/index.html#ncat-overview ] [ https://securityblog.gr/1517/create-backdoor-in-windows-with-ncat/ ] -->
344344
<Image condition="image">procdump.exe</Image> <!-- Sysinternals Suite client side that can be used to dump clear text passwords from memory -->
345-
<Image condition="image">procdump64.exe</Image> <!-- Sysinternals Suite client side 64-bit version that can be used to dump clear text passwords from memory -->
345+
<Image condition="image">procdump64.exe</Image> <!-- Sysinternals Suite client side 64-bit version that can be used to dump clear text passwords from memory -->
346346
<Image condition="image">psexec.exe</Image> <!--Sysinternals:PsExec client side | Credit @Cyb3rOps -->
347347
<Image condition="image">psexec64.exe</Image> <!-- Sysinernals:PsExec64 client side | 64-bit version of psexec.exe -->
348348
<Image condition="image">psexesvc.exe</Image> <!--Sysinternals:PsExec server side | Credit @Cyb3rOps -->
@@ -492,6 +492,11 @@
492492
<CallTrace condition="not begin with">C:\Windows\SYSTEM32\wow64win.dll</CallTrace>
493493
</Rule>
494494
<CallTrace condition="begin with">UNKNOWN</CallTrace>
495+
<!-- Inject AMSI Bypass via CobaltStrike BOF Ref: https://github.com/boku7/injectAmsiBypass -->
496+
<Rule groupRelation="and">
497+
<CallTrace condition="contains">UNKNOWN</CallTrace>
498+
<GrantedAccess condition="contains any">0x1028</GrantedAccess>
499+
</Rule>
495500
<!-- lsass.exe access with critical permission -->
496501
<Rule groupRelation="and">
497502
<TargetImage condition="end with">lsass.exe</TargetImage>
@@ -529,7 +534,7 @@
529534
<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
530535
<TargetFilename name="DLL" condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
531536
<TargetFilename name="EXE" condition="end with">.exe</TargetFilename> <!--Executable-->
532-
<TargetFilename name="ProcessHostingdotNETCode" condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
537+
<TargetFilename name="ProcessHostingdotNETCode" condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ] -->
533538
<TargetFilename condition="end with">.jar</TargetFilename> <!--Java applets-->
534539
<TargetFilename condition="end with">.jnlp</TargetFilename> <!--Java applets-->
535540
<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
@@ -634,7 +639,7 @@
634639
<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
635640
<!--ADDITIONAL REFERENCE: [ https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2 ] -->
636641
<!--ADDITIONAL REFERENCE: [ https://web.archive.org/web/20200116001643/http://scholarworks.rit.edu/cgi/viewcontent.cgi?article=1533&context=theses | Understanding malware autostart techniques - Matthew Gottlieb ] -->
637-
<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112] -->
642+
<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112] -->
638643
<TargetObject name="T1060,RunKey" condition="contains">CurrentVersion\Run</TargetObject> <!--Windows: Wildcard for Run keys, including RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
639644
<TargetObject name="T1060,RunPolicy" condition="contains">Policies\Explorer\Run</TargetObject> <!--Windows: Alternate runs keys | Credit @ion-storm-->
640645
<TargetObject name="T1484" condition="contains">Group Policy\Scripts</TargetObject> <!--Windows: Group policy scripts-->
@@ -1225,7 +1230,7 @@
12251230
<!--SYSMON EVENT ID 23 : FILE DELETE [FileDelete]-->
12261231
<!--EVENT 23: "File Delete"-->
12271232
<!--COMMENT: Sandbox usage. When a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
1228-
Tries to save a copy of the deleted file in the archivedirectory which defaults to C:\Sysmon (to view uncheck "Hide protected
1233+
Tries to save a copy of the deleted file in the archivedirectory which defaults to C:\Sysmon (to view uncheck "Hide protected
12291234
operating system files (Recommended)" from Folder Options). Can quickly fill the available drive space with copies of files.
12301235
Use EVENT ID 26 if a copy is not needed.
12311236
[ https://isc.sans.edu/forums/diary/Sysmon+and+File+Deletion/26084/ ]
@@ -1242,8 +1247,8 @@
12421247

12431248
<!--SYSMON EVENT ID 24 : CLIPBOARD EVENT MONITORING [ClipboardChange]-->
12441249
<!--EVENT 24: "Clipboard changed"-->
1245-
<!--COMMENT: Sandbox usage. Sysmon can capture the contents of clipboard events.
1246-
An example of what could be a production usage on restricted desktops is provided below, but it is commented-out. -->
1250+
<!--COMMENT: Sandbox usage. Sysmon can capture the contents of clipboard events.
1251+
An example of what could be a production usage on restricted desktops is provided below, but it is commented-out. -->
12471252

12481253
<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, Session, ClientInfo, Hashes, Archived -->
12491254

@@ -1277,7 +1282,7 @@
12771282
<!--SYSMON EVENT ID 26 : FILE DELETE LOGGED [FileDeleteDetected]-->
12781283
<!--EVENT 26: "File Delete logged"-->
12791284
<!--COMMENT: This event is generated when a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
1280-
Unlike event ID 23 it does not archive a copy of the file deleted allowing for more widespread use outside of a sandbox or IR triage without
1285+
Unlike event ID 23 it does not archive a copy of the file deleted allowing for more widespread use outside of a sandbox or IR triage without
12811286
risk of filling up the storage space with deleted archives.
12821287
[ https://medium.com/falconforce/sysmon-13-10-filedeletedetected-fe2475cb419e ]
12831288
-->

0 commit comments

Comments
 (0)