So we've turned on a lot of the Windows available audit policy stuff,
but we talked about a little bit more we can do to enhance that capability.
So what else is there?
So one of the other programs that I would highly recommend installing is Sysmon.
Sysmon is a Microsoft tool.
It's freely available.
You go out to Microsoft's website to the Sysinternals tools,
and it's going to be there, and you can download it.
And what Sysmon is going to do is just enhance your logging.
It's going to be logging additional things.
You can log WMI command,
and it's just a great tool that you can use in order to just
enhance your logging and find these attacks.
And that runs as a service on the machine and will continually log.
It's not something you run one time.
Once you install it, it's there until you uninstall it.
It'll persist across reboots, and you're good to go.
So let's look at what it's like to install it.
So I'm going to launch Command Prompt and go to Run as administrator.
We need to be an administrator because it does install a service.
We need to have those elevated privileges.
Okay.
And you've already downloaded it.
And I've already downloaded it.
I'm just going to go to the directory where it's at.
And here, you can see I've got the Sysmon executables,
and then I also have a configuration file.
Now you don't need to install it with a configuration file.
By default, it will set up a lot of logging.
But if you have a configuration file,
it just kind of enhances everything that you can do.
And the configuration file that I'm using is from Swift on Security's GitHub.
Swift on Security has created basically like the default Sysmon configuration
file that everybody seems to use and go from their base on.
Yeah, you wouldn't know that Taylor Swift's night job is--- It's amazing.
She can do everything.
---security operations.
She can do everything.
So what we're going, and let me say too, I would recommend just using this.
Install it on your system, let it run for a little while,
like a day or so, and then see what it's logging,
and you may want to whitelist some things in the configuration file.
Every environment is unique,
and so you want to make sure that your configuration
file is tailored for your environment.
Don't just fully trust Taylor.
You've got to implement stuff in on your own as well.
So what I'm going to do is I'm going to run sysmon64.
I'm using sysmon64 because I have a 64-bit system.
If you have a 32-bit system, just use Sysmon.
And because we're initially installing it,
I'll give it the -i option and then the configuration file.
Yeah, and -i installs it as a service.
If you were updating your configuration file,
instead of -i, you would give it -c and then the configuration file.
So I hit Enter.
I get the EULA.
You have to click through the EULA.
If you don't want to click through the EULA if like you're scripting this out,
you can give it the -accept EULA option.
I'm going to click Agree, and you can see it went through, and it installed it.
So it's installed.
It's running.
It's logging things.
So we can see where it is logging things by going back into Event
Viewer and then under Applications and Service Logs,
Microsoft, Windows, and when we start scrolling down,
there should be a Sysmon log in here.
Here it is.
So here we've got Sysmon under Operational,
and you can see that we already have started logging things.
We have Process Creation logs, and I'll just jump into this.
The nice thing about Sysmon is,
not only does it log the process that was running,
it logs the command line automatically, it logs the user that launched it,
it logs a ton of information that you can go through,
it even logs the hash of the file that executed.
So if you were using hashes as an indicator,
now you can essentially log all your Sysmon logs and just
search for that hash and see if it executed.
Yeah,
have that parsed out and in some sort of database that has
the seam of your choice and with the Sysmon Jester and then
search by hash and indicator, maybe even link that to some threat intelligence,
and that's where we start getting some automation that
helps us really find these attacks.
That's awesome.