sysmonForLinux

0x01 安装

• 源码github地址

• 安装文档

• 示例

  • Ubuntu 18.04, 20.04 & 21.04

    wget -q https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
    sudo dpkg -i packages-microsoft-prod.deb
    sudo apt-get update
    sudo apt-get install sysmonforlinux
    

0x02 配置启动

• package安装方式，可以执行sysmon命令
• 配置 启动：sysmon -c config.xml
• 配置文件config.xml示例

<Sysmon schemaversion="4.81">
  <EventFiltering>
    <!-- Event ID 1 == ProcessCreate. Log all newly created processes -->
    <RuleGroup name="" groupRelation="or">
      <ProcessCreate onmatch="exclude"/>
    </RuleGroup>
    <!-- Event ID 3 == NetworkConnect Detected. Log all network connections -->
    <RuleGroup name="" groupRelation="or">
      <NetworkConnect onmatch="exclude"/>
    </RuleGroup>
    <!-- Event ID 5 == ProcessTerminate. Log all processes terminated -->
    <RuleGroup name="" groupRelation="or">
      <ProcessTerminate onmatch="exclude"/>
    </RuleGroup>
    <!-- Event ID 9 == RawAccessRead. Log all raw access read -->
    <RuleGroup name="" groupRelation="or">
      <RawAccessRead onmatch="exclude"/>
    </RuleGroup>
    <!-- Event ID 10 == ProcessAccess. Log all open process operations -->
    <RuleGroup name="" groupRelation="or">
      <ProcessAccess onmatch="exclude"/>
    </RuleGroup>
    <!-- Event ID 11 == FileCreate. Log every file creation -->
    <RuleGroup name="" groupRelation="or">
      <FileCreate onmatch="exclude"/>
    </RuleGroup>
    <!--Event ID 23 == FileDelete. Log all files being deleted -->
    <RuleGroup name="" groupRelation="or">
      <FileDelete onmatch="exclude"/>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

0x03 日志输出

• 默认会输出到syslog中，
• 在sysmon service 启动后，可以通过sysmon提供的查看工具进行查看
• sudo tail -f /var/log/syslog | /opt/sysmon/sysmonLogView

0x04 参考

1. https://github.com/Sysinternals/SysmonForLinux
2. https://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054
3. https://github.com/OTRF/OSSEM-DD/tree/main/linux/sysmon
4. https://gist.github.com/Cyb3rWard0g/bcf1514cc340197f0076bf1da8954077
5. https://github.com/microsoft/MSTIC-Sysmon