Skip to content

Commit cbc22e8

Browse files
SwiftOnSecuritySwiftOnSecurity
committed
Version 73 - Schema 4.5
Adds extra DNS exclusions and examples of new Sysmon features. This is a benchmark release that's known-working with no serious changes.
1 parent c00581f commit cbc22e8

1 file changed

Lines changed: 96 additions & 12 deletions

File tree

‎sysmonconfig-export.xml‎

Lines changed: 96 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<!--
22
sysmon-config | A Sysmon configuration focused on default high-quality event tracing and easy customization by the community
3-
Source version: 71 | Date: 2020-01-16
3+
Source version: 73 | Date: 2021-02-16
44
Source project: https://github.com/SwiftOnSecurity/sysmon-config
55
Source license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
66
@@ -9,7 +9,7 @@
99
Fork project: <N/A>
1010
Fork license: <N/A>
1111
12-
REQUIRED: Sysmon version 10.0.4.1 or higher (due to changes in syntax and bug-fixes)
12+
REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
1313
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
1414
1515
NOTE: To collect Sysmon logs centrally for free, see https://aka.ms/WEF | Command to allow log access to the Network Service:
@@ -33,13 +33,12 @@
3333
Otherwise, attackers could imitate these common applications, and bypass your logging. Below are silent upgrades you can do, no user impact:
3434
- https://docs.microsoft.com/en-us/onedrive/per-machine-installation
3535
- https://cloud.google.com/chrome-enterprise/browser/download/
36-
- As of 2019-08-25 there is no usermode version of Microsoft Teams.
36+
- As of 2021-02-16 there is no machine-level version of Microsoft Teams. The one provided copies itself to the user profile.
3737
3838
NOTE: Sysmon is not hardened against an attacker with admin rights. Additionally, this configuration offers an attacker, willing
3939
to study it, limited ways to evade some of the logging. If you are in a very high-threat environment, you should consider a broader,
4040
log-most approach. However, in the vast majority of cases, an attacker will bumble through multiple behavioral traps which
41-
this configuration monitors, especially in the first minutes. Even APT do not send their A-team unless they know you're hardened.
42-
5% of the effort gets 95% of the results. APT rely on nobody watching because almost nobody does. Your effort makes the difference.
41+
this configuration monitors, especially in the first minutes.
4342
4443
NOTE: If you encounter unexplainable event inclusion/exclusion, you may have a second Sysmon instance installed under a different exe filename.
4544
To clear this, try downloading the latest version and uninstalling with -u force. If it hangs, kill the processes and run it again to cleanup.
@@ -56,19 +55,20 @@
5655
- "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
5756
- "ProcessGuid" and "LoginGuid" are not random, they contain some embedded information. https://gist.github.com/mattifestation/0102042160c9a60b2b847378c0ef70b4
5857
59-
FILTERING: Filter conditions available for use are: is, is not, contains, excludes, begin with, end with, less than, more than, image
58+
FILTERING: Filter conditions available for use are: is,is not,contains,contains any,contains all,excludes,excludes any,excludes all,begin with,end with,less than,more than,image
6059
- The "image" filter is usable on any field. Same as "is" but can either match entire string, or only the text after last "\". Credit: @mattifestation
6160
6261
-->
6362

64-
<Sysmon schemaversion="4.22">
63+
<Sysmon schemaversion="4.50">
6564
<!--SYSMON META CONFIG-->
66-
<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms> <!-- Both MD5 and SHA256 are the industry-standard algorithms for identifying files -->
65+
<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms> <!-- Both MD5 and SHA256 are the industry-standard algorithms. Remove IMPHASH if you do not use DLL import fingerprinting. -->
6766
<CheckRevocation/> <!-- Check loaded drivers, log if their code-signing certificate has been revoked, in case malware stole one to sign a kernel driver -->
6867

6968
<!-- <ImageLoad/> --> <!-- Would manually force-on ImageLoad monitoring, even without configuration below. Included only documentation. -->
7069
<!-- <ProcessAccessConfig/> --> <!-- Would manually force-on ProcessAccess monitoring, even without configuration below. Included only documentation. -->
7170
<!-- <PipeMonitoringConfig/> --> <!-- Would manually force-on PipeCreated / PipeConnected events, even without configuration below. Included only documentation. -->
71+
<!-- <ArchiveDirectory> -->
7272

7373
<EventFiltering>
7474

@@ -352,6 +352,9 @@
352352
<DestinationHostname condition="end with">.microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
353353
<DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
354354
<DestinationHostname condition="end with">microsoft.com.nsatc.net</DestinationHostname> <!--Microsoft:Update delivery-->
355+
<!--OCSP known addresses-->
356+
<DestinationIp condition="is">23.4.43.27</DestinationIp> <!--Digicert [ https://otx.alienvault.com/indicator/ip/23.4.43.27 ] -->
357+
<DestinationIp condition="is">72.21.91.29</DestinationIp> <!--Digicert [ https://otx.alienvault.com/indicator/ip/72.21.91.29 ] -->
355358
<!--Section: Loopback Addresses-->
356359
<DestinationIp condition="is">127.0.0.1</DestinationIp> <!--Credit @ITProPaul-->
357360
<DestinationIp condition="begin with">fe80:0:0:0</DestinationIp> <!--Credit @ITProPaul-->
@@ -488,8 +491,10 @@
488491
<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting-->
489492
<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
490493
<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
491-
<TargetFilename condition="end with">proj</TargetFilename><!--Microsoft:MSBuild:Script: More information: https://twitter.com/subTee/status/885919612969394177-->
492-
<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: More information: https://twitter.com/subTee/status/885919612969394177-->
494+
<TargetFilename condition="end with">.ocx</TargetFilename> <!--Microsoft:ActiveX-->
495+
<TargetFilename condition="end with">proj</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
496+
<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: [ https://twitter.com/subTee/status/885919612969394177 ] -->
497+
<TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->
493498
<TargetFilename name="DefaultUserModified" condition="begin with">C:\Users\Default</TargetFilename> <!--Windows: Changes to default user profile-->
494499
<TargetFilename condition="begin with">C:\Windows\system32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
495500
<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
@@ -694,6 +699,7 @@
694699
<TargetObject name="InvDB-CompileTimeClaim" condition="end with">\LinkDate</TargetObject> <!-- Compile time of EXE, may not be reliable [ https://en.wikipedia.org/wiki/Link_time ] -->
695700
<TargetObject name="InvDB" condition="contains">Compatibility Assistant\Store\</TargetObject> <!-- Inventory -->
696701
<!--Suspicious sources-->
702+
<Image name="Suspicious,ImageBeginWithBackslash" condition="end with">regedit.exe</Image> <!--Users and helpdesk staff making system modifications -->
697703
<Image name="Suspicious,ImageBeginWithBackslash" condition="begin with">\</Image> <!--Devices and VSC shouldn't be executing changes | Credit: @SBousseaden @ionstorm @neu5ron @PerchedSystems [ https://twitter.com/SwiftOnSecurity/status/1133167323991486464 ] -->
698704
</RegistryEvent>
699705
</RuleGroup>
@@ -907,22 +913,30 @@
907913
<QueryName condition="end with">.aria.microsoft.com</QueryName> <!--Microsoft: OneDrive/SharePoint-->
908914
<QueryName condition="end with">.msauth.net</QueryName>
909915
<QueryName condition="end with">.msftauth.net</QueryName>
916+
<QueryName condition="end with">.office.net</QueryName> <!--Microsoft: Office-->
910917
<QueryName condition="end with">.opinsights.azure.com</QueryName> <!--Microsoft: AzureAD/InTune client event monitoring-->
911-
<QueryName condition="end with">osi.office.net</QueryName> <!--Microsoft: Office-->
918+
<QueryName condition="end with">.res.office365.com</QueryName> <!--Microsoft: Office-->
919+
<QueryName condition="is">acdc-direct.office.com</QueryName> <!--Microsoft: Office-->
920+
<QueryName condition="is">atm-fp-direct.office.com</QueryName> <!--Microsoft: Office-->
912921
<QueryName condition="is">loki.delve.office.com</QueryName> <!--Microsoft: Office-->
913922
<QueryName condition="is">management.azure.com</QueryName> <!--Microsoft: AzureAD/InTune-->
914923
<QueryName condition="is">messaging.office.com</QueryName> <!--Microsoft: Office-->
915924
<QueryName condition="is">outlook.office365.com</QueryName> <!--Microsoft: Protected by HSTS-->
916925
<QueryName condition="is">portal.azure.com</QueryName> <!--Microsoft: AzureAD/InTune-->
917926
<QueryName condition="is">protection.outlook.com</QueryName> <!--Microsoft: Office-->
918927
<QueryName condition="is">substrate.office.com</QueryName> <!--Microsoft: Office-->
928+
<QueryName condition="end with">.measure.office.com</QueryName> <!--Microsoft: Office-->
919929
<!--3rd-party applications-->
930+
<QueryName condition="end with">.adobe.com</QueryName> <!--Adobe-->
931+
<QueryName condition="end with">.adobe.io</QueryName> <!--Adobe-->
920932
<QueryName condition="end with">.mozaws.net</QueryName> <!--Mozilla-->
921933
<QueryName condition="end with">.mozilla.com</QueryName> <!--Mozilla-->
922934
<QueryName condition="end with">.mozilla.net</QueryName> <!--Mozilla-->
923935
<QueryName condition="end with">.mozilla.org</QueryName> <!--Mozilla-->
924936
<QueryName condition="end with">.spotify.com</QueryName> <!--Spotify-->
925937
<QueryName condition="end with">.spotify.map.fastly.net</QueryName> <!--Spotify-->
938+
<QueryName condition="end with">.wbx2.com</QueryName> <!--Webex-->
939+
<QueryName condition="end with">.webex.com</QueryName> <!--Webex-->
926940
<QueryName condition="is">clients1.google.com</QueryName> <!--Google-->
927941
<QueryName condition="is">clients2.google.com</QueryName> <!--Google-->
928942
<QueryName condition="is">clients3.google.com</QueryName> <!--Google-->
@@ -941,13 +955,16 @@
941955
<QueryName condition="is">cdnjs.cloudflare.com</QueryName>
942956
<QueryName condition="end with">.stackassets.com</QueryName> <!--Stack Overflow-->
943957
<QueryName condition="end with">.steamcontent.com</QueryName>
958+
<QueryName condition="is">play.google.com</QueryName>
959+
<QueryName condition="is">content-autofill.googleapis.com</QueryName>
944960
<!--Web resources-->
945961
<QueryName condition="end with">.disqus.com</QueryName> <!--Microsoft default exclusion-->
946962
<QueryName condition="end with">.fontawesome.com</QueryName>
947963
<QueryName condition="is">disqus.com</QueryName> <!--Microsoft default exclusion-->
948964
<!--Ads-->
949965
<QueryName condition="end with">.1rx.io</QueryName> <!--Ads-->
950966
<QueryName condition="end with">.2mdn.net</QueryName> <!--Ads: Google | Microsoft default exclusion-->
967+
<QueryName condition="end with">.3lift.com</QueryName> <!--Ads-->
951968
<QueryName condition="end with">.adadvisor.net</QueryName> <!--Ads: Neustar [ https://better.fyi/trackers/adadvisor.net/ ] -->
952969
<QueryName condition="end with">.adap.tv</QueryName> <!--Ads:AOL | Microsoft default exclusion [ https://www.crunchbase.com/organization/adap-tv ] -->
953970
<QueryName condition="end with">.addthis.com</QueryName> <!--Ads:Oracle | Microsoft default exclusion [ https://en.wikipedia.org/wiki/AddThis ] -->
@@ -957,7 +974,9 @@
957974
<QueryName condition="end with">.adrta.com</QueryName> <!--Ads-->
958975
<QueryName condition="end with">.adsafeprotected.com</QueryName> <!--Ads-->
959976
<QueryName condition="end with">.adsrvr.org</QueryName> <!--Ads-->
977+
<QueryName condition="end with">.adsymptotic.com</QueryName> <!--Ads-->
960978
<QueryName condition="end with">.advertising.com</QueryName> <!--Ads | Microsoft default exclusion-->
979+
<QueryName condition="end with">.agkn.com</QueryName> <!--Ads | [ https://www.home.neustar/privacy ] -->
961980
<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
962981
<QueryName condition="end with">.amazon-adsystem.com</QueryName> <!--Ads-->
963982
<QueryName condition="end with">.analytics.yahoo.com</QueryName> <!--Ads:Yahoo-->
@@ -977,6 +996,7 @@
977996
<QueryName condition="end with">.doubleclick.net</QueryName> <!--Ads:Conversant | Microsoft default exclusion [ https://www.crunchbase.com/organization/dotomi ] -->
978997
<QueryName condition="end with">.doubleverify.com</QueryName> <!--Ads: Google-->
979998
<QueryName condition="end with">.emxdgt.com</QueryName> <!--Ads: EMX-->
999+
<QueryName condition="end with">.everesttech.net</QueryName> <!--Ads | [ https://better.fyi/trackers/everesttech.net/ ] -->
9801000
<QueryName condition="end with">.exelator.com</QueryName> <!--Ads:Nielson Marketing Cloud-->
9811001
<QueryName condition="end with">.google-analytics.com</QueryName> <!--Ads:Google | Microsoft default exclusion-->
9821002
<QueryName condition="end with">.googleadservices.com</QueryName> <!--Google-->
@@ -988,6 +1008,8 @@
9881008
<QueryName condition="end with">.gvt2.com</QueryName> <!--Google-->
9891009
<QueryName condition="end with">.ib-ibi.com</QueryName> <!--Ads: Offerpath [ https://better.fyi/trackers/ib-ibi.com/ ] -->
9901010
<QueryName condition="end with">.jivox.com</QueryName> <!--Ads-->
1011+
<QueryName condition="end with">.krxd.net</QueryName> <!--Ads-->
1012+
<QueryName condition="end with">.lijit.com</QueryName> <!--Ads-->
9911013
<QueryName condition="end with">.mathtag.com</QueryName> <!--Microsoft default exclusion-->
9921014
<QueryName condition="end with">.moatads.com</QueryName> <!--Ads | Microsoft default exclusion-->
9931015
<QueryName condition="end with">.moatpixel.com</QueryName> <!--Ads | Microsoft default exclusion-->
@@ -1044,10 +1066,23 @@
10441066
<!--SocialNet-->
10451067
<QueryName condition="end with">.pscp.tv</QueryName> <!--Twitter:Periscope-->
10461068
<!--OSCP/CRL Common-->
1069+
<QueryName condition="end with">.amazontrust.com</QueryName>
10471070
<QueryName condition="end with">.digicert.com</QueryName>
10481071
<QueryName condition="end with">.globalsign.com</QueryName>
10491072
<QueryName condition="end with">.globalsign.net</QueryName>
1073+
<QueryName condition="end with">.intel.com</QueryName>
1074+
<QueryName condition="end with">.symcb.com</QueryName> <!--Digicert-->
1075+
<QueryName condition="end with">.symcd.com</QueryName> <!--Digicert-->
1076+
<QueryName condition="end with">.thawte.com</QueryName>
1077+
<QueryName condition="end with">.usertrust.com</QueryName>
1078+
<QueryName condition="end with">.verisign.com</QueryName>
1079+
<QueryName condition="end with">ocsp.identrust.com</QueryName>
1080+
<QueryName condition="end with">pki.goog</QueryName>
10501081
<QueryName condition="is">msocsp.com</QueryName> <!--Microsoft:OCSP-->
1082+
<QueryName condition="is">ocsp.comodoca.com</QueryName>
1083+
<QueryName condition="is">ocsp.entrust.net</QueryName>
1084+
<QueryName condition="is">ocsp.godaddy.com</QueryName>
1085+
<QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
10511086
<QueryName condition="is">ocsp.msocsp.com</QueryName> <!--Microsoft:OCSP-->
10521087
<QueryName condition="end with">pki.goog</QueryName>
10531088
<QueryName condition="is">ocsp.godaddy.com</QueryName>
@@ -1065,11 +1100,60 @@
10651100
</DnsQuery>
10661101
</RuleGroup>
10671102

1103+
<!--SYSMON EVENT ID 23 : FILE DELETE [FileDelete]-->
1104+
<!--EVENT 22: "File Delete"-->
1105+
<!--COMMENT: Sandbox usage. When a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it.
1106+
[ https://isc.sans.edu/forums/diary/Sysmon+and+File+Deletion/26084/ ]
1107+
-->
1108+
1109+
<!--DATA: RuleName, UtcTime, ProcessGuid, ProcessId, User, Image, TargetFilename, Hashes, IsExecutable, Archived -->
1110+
1111+
<!--
1112+
<RuleGroup name="" groupRelation="or">
1113+
<ClipboardChange onmatch="include">
1114+
</ClipboardChange>
1115+
</RuleGroup>
1116+
-->
1117+
1118+
<!--SYSMON EVENT ID 24 : CLIPBOARD EVENT MONITORING [ClipboardChange]-->
1119+
<!--EVENT 24: "Clipboard changed"-->
1120+
<!--COMMENT: Sandbox usage. Sysmon can capture the contents of clipboard events.
1121+
An example of what could be a production usage on restricted desktops is provided below, but it is commented-out. -->
1122+
1123+
<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, Session, ClientInfo, Hashes, Archived -->
1124+
1125+
<!--
1126+
<RuleGroup name="" groupRelation="or">
1127+
<ClipboardChange onmatch="include">
1128+
<Image condition="end with">wscript.exe</Image>
1129+
<Image condition="end with">cscript.exe</Image>
1130+
<Image condition="end with">powershell.exe</Image>
1131+
<Image condition="end with">rdpclip.exe</Image>
1132+
</ClipboardChange>
1133+
</RuleGroup>
1134+
-->
1135+
1136+
<!--SYSMON EVENT ID 25 : PROCESS TAMPERING [ProcessTampering]-->
1137+
<!--EVENT 25: "Process Tampering"-->
1138+
<!--COMMENT: This event is generated when a process image is changed from an external source, such as a different process.
1139+
This may or may not provide value in your environment as it requires tuning and a SIEM to correlate the ProcessGuids.
1140+
[ https://medium.com/falconforce/sysmon-13-process-tampering-detection-820366138a6c ] -->
1141+
1142+
<!--DATA: EventType, RuleName, UtcTime, ProcessGuid, ProcessId, Image, Type -->
1143+
1144+
<!--
1145+
<RuleGroup name="" groupRelation="or">
1146+
<ProcessTampering onmatch="exclude">
1147+
<Image condition="begin with">C:\Program Files (x86)\Microsoft\Edge\Application\</Image>
1148+
</ProcessTampering>
1149+
</RuleGroup>
1150+
-->
1151+
10681152
<!--SYSMON EVENT ID 255 : ERROR-->
10691153
<!--"This event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load
10701154
and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the
10711155
Sysinternals forum or over Twitter (@markrussinovich)."-->
10721156
<!--Cannot be filtered.-->
10731157

10741158
</EventFiltering>
1075-
</Sysmon>
1159+
</Sysmon>

0 commit comments

Comments
 (0)