Sysmon Monitoring Different Way
summary
A small web UI visualizes Sysmon events as a graph backed by Neo4j backend and populated by a PowerShell collector available in a Docker + PowerShell collector folder on GitHub. Nodes show PID, name, version, hashes and timestamps and are color coded for processes, file creations, DNS and network; controls set maximum nodes and hop depth. Demo traces an mshta -> cmd -> powershell chain and a download that triggers dnscat, letting users spot surprising parent/child links and pivot quickly between process-only and full graphs.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 0:44What is Sysmon
- 1:49Introducing System Graph
- 2:34Live demo first dataset
- 6:09Live demo second dataset
- 10:03Summary and Q&A
related talks
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
44mPowerShell, Graphs, Topology and Real Use Cases
44mGetting The Most Out Of Sysmon
49mMonitoring Using PowerShell
40mAnd You, Sysmon, Against Me?
41mState of the Onion
01h 30mSimple Network Management... PowerShell
46mAn IT Operations Approach to Observability