<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-sysmon-configuration
description: >-
  Design, deploy, and maintain Sysmon configurations for endpoint visibility.
  Covers event ID selection, filtering strategies, performance tuning,
  XML schema construction, and integration with SIEM pipelines.
domain: cybersecurity
subdomain: blue-team
tags:
  - sysmon
  - endpoint-visibility
  - windows
  - event-logging
  - detection-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562.001"]
---

# Implementing Sysmon Configuration

## Overview

System Monitor (Sysmon) is a Windows system service that logs detailed process,
network, file, registry, and WMI activity to the Windows Event Log. A well-tuned
Sysmon configuration provides the telemetry foundation for endpoint detection. This
skill covers schema design, event filtering, noise reduction, and deployment at scale.

## Prerequisites

| Requirement | Install |
|---|---|
| Sysmon v15+ | `sysmon64.exe -accepteula -i config.xml` |
| PowerShell 5.1+ | Built-in on Windows 10/Server 2016+ |
| SIEM forwarder | Splunk UF, Elastic Agent, or WEF |
| Admin privileges | Required for Sysmon install and config updates |

## Key Concepts

### Sysmon Event IDs

| EID | Category | Detection Value |
|---|---|---|
| 1 | Process Creation | Command-line logging, parent-child relationships |
| 3 | Network Connection | Outbound C2, lateral movement |
| 5 | Process Terminated | Process lifecycle tracking |
| 7 | Image Loaded | DLL sideloading, injection detection |
| 8 | CreateRemoteThread | Process injection (T1055) |
| 10 | Process Access | Credential dumping (LSASS access) |
| 11 | File Create | Payload drops, staging artifacts |
| 12/13/14 | Registry Events | Persistence mechanisms |
| 15 | FileCreateStreamHash | ADS (Alternate Data Streams) abuse |
| 17/18 | Pipe Events | Named pipe pivoting, C2 channels |
| 22 | DNS Query | DNS-based C2, exfiltration |
| 23 | File Delete | Anti-forensics, artifact cleanup |
| 25 | Process Tampering | Image hollowing, herpaderping |

### Configuration Schema

```xml
<Sysmon schemaversion="4.90">
  <HashAlgorithms>sha256,imphash</HashAlgorithms>
  <CheckRevocation>true</CheckRevocation>
  <DnsLookup>false</DnsLookup>

  <EventFiltering>
    <!-- Process Creation — include all, exclude known noise -->
    <RuleGroup name="ProcessCreate" groupRelation="or">
      <ProcessCreate onmatch="exclude">
        <Image condition="is">C:\Windows\System32\svchost.exe</Image>
        <ParentImage condition="is">C:\Windows\System32\services.exe</ParentImage>
      </ProcessCreate>
    </RuleGroup>

    <!-- Network Connection — focus on suspicious ports -->
    <RuleGroup name="NetworkConnect" groupRelation="or">
      <NetworkConnect onmatch="include">
        <DestinationPort condition="is">4444</DestinationPort>
        <DestinationPort condition="is">8080</DestinationPort>
        <DestinationPort condition="is">443</DestinationPort>
      </NetworkConnect>
    </RuleGroup>

    <!-- LSASS Access — critical for credential dumping -->
    <RuleGroup name="ProcessAccess" groupRelation="or">
      <ProcessAccess onmatch="include">
        <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
      </ProcessAccess>
    </RuleGroup>
  </EventFiltering>
</Sysmon>
```

### Filtering Strategy

**Include vs. Exclude approach:**

- **High-value events (EID 8, 10, 25):** Default include all, exclude known-good
- **Noisy events (EID 1, 3, 7, 11):** Default exclude all, include suspicious patterns
- **Critical events (EID 22, 23):** Include all with minimal filtering

```xml
<!-- Exclude-heavy: reduce noise on process creation -->
<ProcessCreate onmatch="exclude">
  <Image condition="is">C:\Windows\System32\backgroundTaskHost.exe</Image>
  <Image condition="is">C:\Windows\System32\RuntimeBroker.exe</Image>
  <Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image>
  <CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine>
</ProcessCreate>

<!-- Include-heavy: targeted network monitoring -->
<NetworkConnect onmatch="include">
  <Image condition="is not">C:\Program Files\Google\Chrome\Application\chrome.exe</Image>
  <DestinationIsIpv6>false</DestinationIsIpv6>
  <Initiated>true</Initiated>
</NetworkConnect>
```

### Performance Tuning

```powershell
# Measure Sysmon event volume per EID
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10000 |
  Group-Object Id | Sort-Object Count -Descending |
  Select-Object Name, Count | Format-Table

# Check Sysmon driver status
fltMC.exe filters | Select-String "SysmonDrv"

# Monitor Sysmon memory and CPU
Get-Process Sysmon64 | Select-Object WorkingSet64, CPU, HandleCount
```

## Workflow

1. **Baseline audit** — Enumerate current Sysmon version and config
   ```powershell
   sysmon64.exe -c
   ```
2. **Select base config** — Start from SwiftOnSecurity or Olaf Hartong modular config
3. **Customize filters** — Add environment-specific exclusions for legitimate software
4. **Validate XML** — Parse config before deployment
   ```powershell
   [xml](Get-Content sysmon-config.xml)
   ```
5. **Deploy config** — Apply to endpoints
   ```powershell
   sysmon64.exe -c sysmon-config.xml
   ```
6. **Verify event flow** — Confirm events reach SIEM
   ```powershell
   Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 5
   ```
7. **Tune iteratively** — Review noisy events and add exclusions weekly
8. **Version control** — Track config changes in Git with change rationale

## Detection

```yaml
title: Sysmon Configuration Detection
id: d3d17476-3ae1-4bf3-84fc-a92a607b9c92
status: experimental
description: Detects suspicious activity related to implementing sysmon configuration techniques in blue team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*sysmon*"
  condition: selection
level: medium
tags:
  - attack.t1562.001
  - attack.defense_evasion
falsepositives:
  - Security team running authorized detection validation tools
```

## Verification

| Check | Method |
|---|---|
| Sysmon installed | `sysmon64.exe -c` returns current config |
| Config applied | Event ID 16 (config change) in Sysmon log |
| Events flowing | `Get-WinEvent` returns recent Sysmon events |
| No excessive noise | EPS (events per second) within SIEM budget |
| Critical EIDs active | EID 1, 8, 10, 22 generating events |

## References

- [Sysmon Documentation](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)
- [SwiftOnSecurity Sysmon Config](https://github.com/SwiftOnSecurity/sysmon-config)
- [Olaf Hartong Sysmon Modular](https://github.com/olafhartong/sysmon-modular)
- [MITRE ATT&CK Data Sources](https://attack.mitre.org/datasources/)
