Sysmon + Nxlog to build simple Windows security monitoring

Tools:

Sysmon (Sysmon 5.0), Nxlog (Nxlog-ce-2.9.1716.msi).

Sysmon monitors the system and generates Windows event log, Nxlog transmits the Windows event log to the Syslog server.

Sysmon can monitor process create, process terminate, Driver loaded, File creation time changed, Rawaccessread, CreateRemoteThread , Sysmon service state changed.

Configuration:

Nxlog configuration:

# # This is a sample configuration file. See the Nxlog Reference manual about the## configuration options. It should be installed locally and was also available## online at http://nxlog.org/docs/## please set the ROOT to the Folde R your Nxlog was installed into,## otherwise it would not start. #define ROOT C:\Program files\nxlogdefine root C:\Program F Iles (x86) \nxlogmoduledir%root%\modulescachedir%root%\datapidfile%root%\data\nxlog.pidspooldir%ROOT%\ Datalogfile%root%\data\nxlog.log<extension _syslog> Module xm_syslog</extension><input in> M Odule im_msvistalog Query <QueryList> <query id= "0" > <select path= "microsoft-windows-sysmon/    Operational ">*</Select> </query></querylist></input><output out> Module om_udp Host security-log.syslogserver.com Port 639 Exec to_syslog_snare (); </output><route 1&    Gt Path in = out</route>

Sysmon Configuration:

<sysmon schemaversion= "3.20" > <!--Capture all hashes--<HashAlgorithms>*</HashAlgorithms> & Lt Eventfiltering> <!--Log All drivers except if the signature-<!--contains Microsoft or Windows--&G    T <driverload onmatch= "Exclude" > <signature condition= "contains" >Microsoft</Signature> <signa Ture condition= "contains" >Windows</Signature> </DriverLoad> <processterminate onmatch= "include" &      Gt  <image condition= "End with" >MsMpEng.exe</Image> </ProcessTerminate> <!--Log network connection If the destination port equal 443-<!--or, and process isn ' t InternetExplorer-<!--Networkcon Nect onmatch= "include" > <DestinationPort>443</DestinationPort> <destinationport>80</dest Inationport > </networkconnect-<filecreatetime onmatch= "exclude" > <image condition= "End With ";chrome.exe</image> </FileCreateTime> <imageload onmatch= "include" > <signed condition= "is" >false</Signed> </ImageLoad> <!--Log access rights for Lsass.exe or Winlogon.exe are not process_q Uery_information--<processaccess onmatch= "exclude" > <grantedaccess condition= "is" >0x1400</gra ntedaccess> </ProcessAccess> <processaccess onmatch= "include" > <targetimage condition= "End WI Th ">lsass.exe</TargetImage> <targetimage condition=" End with ">winlogon.exe</TargetImage> < /processaccess> <networkconnect onmatch= "exclude" > <image condition= "End With" >chrome.exe</image > <sourceport condition= "is" >137</SourcePort> <sourceportname condition= "is" >llmnr</sour Ceportname> <destinationportname condition= "is" >llmnr</DestinationPortName> </networkconnect&gt    ; <createremotethreAd onmatch= "include" > <targetimage condition= "End with" >explorer.exe</TargetImage> <targetimag E condition= "End with" >svchost.exe</TargetImage> <targetimage condition= "End With" >winlogon.exe</ targetimage> <sourceimage condition= "End with" >powershell.exe</SourceImage> </createremotethread > </EventFiltering></Sysmon>

　　

Test Case:

Installation:

-Sysmon-i config.conf.

-Nxlog Double click to run, remember to start the service.

Use Mimikatz to fetch hash:

Reference:

Http://www.freebuf.com/sectool/122779.html

https://technet.microsoft.com/en-us/sysinternals/dn798348

Https://nxlog.co/docs/sysmon/audit-logging-on-windows-with-sysmon-and-nxlog.html

http://www.ilanni.com/?p=595

Sysmon + Nxlog to build simple Windows security monitoring