Learning Sysmon - Process Tracking (Video 6)

Process Tracking is one of the most important actions in Sysmon. Research Team Lead Carlos Perez goes over why the fields that Sysmon generates in these events are so valuable and how to best leverage this event type in collection. Sysmon Modular: https://github.com/olafhartong/sysmon-modular Sysmon Community Guide: https://github.com/trustedsec/SysmonCommunityGuide 00:00:00 Intro 00:00:58 Importance of Process Tracking 00:02:25 Fields of the Events 00:05:45 What is the ProcessGuid 00:06:30 Where can a ProcessGuid can be leveraged 00:07:16 The LogonGUID 00:07:40 Recommendations 00:09:26 Building an initial baseline exclude 00:11:41 Building the configuration file 00:14:08 Create rules for Process Termination 00:16:28 General Recommendations