Sysmon Deep Dive: Real Detection Scenarios You Can Reproduce
summary
Sysmon versioned as a low-overhead kernel driver logs hashed process creations, DNS and network connections, DLL injection and session GUIDs, demonstrated with certutil/LOLBin download, CreateRemoteThread injection and suspicious network callback correlation. XML configs let teams switch targeted captures on the fly and push them enterprise-wide; examples show Splunk dashboards, VirusTotal hash checks and alerts for event ID 10 and event 3. Speaker-backed claims note measurable dwell reductions (about 11 days overall, ~5 for ransomware) and practical replacement options where EDR isn’t allowed.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:05Why Sysmon matters
- 6:26What is Sysmon
- 9:55Sysmon vs EDR tools
- 13:27Key Sysmon events
- 20:32Real detection scenarios
- 26:55Deployment best practices
- 28:40Q&A
related talks
40mHunt and Gather: Developing Effective Threat Hunting Techniques
44mGetting The Most Out Of Sysmon
11mSysmon Monitoring Different Way
27mCollect All the Data; Protect All the Things
29mDetection Engineering: Defending Networks with Purpose
58mHunting Malware with Suricata Metadata
40mLeveraging Suricata in the Enterprise: Shifting from Events to Insights
30mSpotting Threats with Elastic SIEM