Process Tracking is one of the most important actions in Sysmon. Research Team Lead Carlos Perez goes over why the fields that Sysmon generates in these events are so valuable and how to best leverage this event type in collection.
Sysmon Modular:
https://github.com/olafhartong/sysmon-modular
Sysmon Community Guide:
https://github.com/trustedsec/SysmonCommunityGuide
00:00:00 Intro
00:00:58 Importance of Process Tracking
00:02:25 Fields of the Events
00:05:45 What is the ProcessGuid
00:06:30 Where can a ProcessGuid can be leveraged
00:07:16 The LogonGUID
00:07:40 Recommendations
00:09:26 Building an initial baseline exclude
00:11:41 Building the configuration file
00:14:08 Create rules for Process Termination
00:16:28 General Recommendations
Download
0 formats
No download links available.
Learning Sysmon - Process Tracking (Video 6) | NatokHD