21 entries

Sysmon

Microsoft's free endpoint logging tool, and the events that make it worth deploying.

1 Sysmon Event 1: Process creation Informational A program started. Sysmon records the full command line, who launched it, what launched it, and the file hash. This is the single most useful event for working out what actually happened on a Windows machine.
2 Sysmon Event 2: A file's creation time was changed Worth a look A program rewrote a file's creation timestamp. Very little legitimate software does this, and altering timestamps to blend into a directory is a well-known anti-forensics move — which makes this a low-volume, high-signal event.
3 Sysmon Event 3: Network connection detected Informational A process made a network connection, and Sysmon recorded which process, which account, and where to. It is the event that ties network activity to the specific program responsible — something a firewall log can never do.
5 Sysmon Event 5: A process ended Informational A process exited. On its own it says almost nothing, but paired with the matching Event 1 it gives you how long a process lived — and very short-lived processes are a pattern worth noticing.
6 Sysmon Event 6: A kernel driver was loaded Investigate A driver was loaded into the kernel. This is one of the lowest-volume, highest-value events Sysmon produces — a healthy machine loads a stable set of drivers and almost never adds to it, which makes anything new immediately worth reading.
7 Sysmon Event 7: A module was loaded into a process Informational A process loaded a DLL or other module. Unfiltered it is the highest-volume event Sysmon produces, but filtered to unsigned modules loading from user-writable directories it catches DLL sideloading, which is otherwise very hard to see.
8 Sysmon Event 8: A thread was created in another process Worth a look One process started a thread inside another — the classic shape of code injection. Legitimate software does this, but rarely, which makes the event unusually low-volume and unusually informative for what it costs.
10 Sysmon Event 10: One process opened another Informational A process requested access to another process's memory. Almost all of it is ordinary system behaviour, but this is the event that catches credential dumping — something opening lsass.exe with read access is one of the highest-value detections in Windows.
11 Sysmon Event 11: A file was created Informational A process created or overwrote a file. It is how you find a dropped payload, how you spot ransomware early, and how you tie a download to the process that fetched it — provided your configuration filters it down to the paths that matter.
12 Sysmon Event 12: A registry key was created or deleted Informational A registry key was created or removed. It pairs with Event 13, which records the values written into those keys, and the deletion half is the more interesting one — removing a key is how evidence and security settings both disappear.
13 Sysmon Event 13: A registry value was set Informational Something wrote a value into the registry. Filtered to the keys that cause code to run at startup, it is one of the most direct persistence detections available — and unlike file-based persistence, there is nothing on disk to notice.
15 Sysmon Event 15: A file was created with an alternate data stream Worth a look A file was written along with an alternate data stream — most often the mark of the web, which records that the file came from the internet. It is how you tie a downloaded file to the site it came from, right on the endpoint.
17 Sysmon Event 17: A named pipe was created Informational A process opened a named pipe — a channel other processes can connect to. Windows uses them constantly for legitimate work, but offensive tooling relies on them too, and several frameworks leave recognisable pipe names behind.
18 Sysmon Event 18: A process connected to a named pipe Informational A process attached to a pipe another process was hosting. Paired with Event 17 it shows both ends of the conversation — which is how you tell what actually talked to a suspicious pipe rather than just that one existed.
19 Sysmon Event 19: A WMI event filter was registered Investigate Something registered a WMI event filter — a rule that watches for a system condition. On its own that is harmless. Combined with events 20 and 21 it forms WMI persistence, which survives reboots, touches no startup folder, and leaves no file on disk.
20 Sysmon Event 20: A WMI event consumer was registered Investigate Something registered what to run when a WMI condition fires. This is the payload half of WMI persistence, and unlike the filter it names the actual command — which makes it the most directly useful of the three WMI events.
21 Sysmon Event 21: A WMI filter was bound to a consumer Investigate The trigger and the payload were linked together. This is the moment WMI persistence actually becomes active — a filter and a consumer sitting unbound do nothing at all.
22 Sysmon Event 22: A DNS query was made Informational A process looked up a hostname, and Sysmon recorded which process asked. That attribution is what DNS server logs cannot give you, and it turns a list of queried domains into a list of programs querying them.
23 Sysmon Event 23: A file was deleted and archived Worth a look A file was deleted, and Sysmon kept a copy. That archiving is what makes it unusual — it can preserve the payload an attacker removed after use, which is often the one artefact that would otherwise be gone for good.
25 Sysmon Event 25: Process tampering detected Investigate A process's image in memory no longer matches the file it was launched from. That is what process hollowing and herpaderping look like, and there is very little legitimate reason for it — which makes this one of the highest-signal, lowest-volume events Sysmon produces.
26 Sysmon Event 26: A file was deleted, but not kept Worth a look Sysmon noticed a file being deleted and recorded the fact. This is the lightweight half of a pair: Event 23 archives a copy of the deleted file, Event 26 only writes a log line. Choosing the wrong one of the two is how people end up with a full disk or no evidence.