detecting-sysmon-on-the-victim-host.md

description
Exploring ways to detect Sysmon presence on the victim system

Detecting Sysmon on the Victim Host

Processes

{% code title="attacker@victim" %}

PS C:\> Get-Process | Where-Object { $_.ProcessName -eq "Sysmon" }

{% endcode %}

{% hint style="warning" %} Note: process name can be changed during installation {% endhint %}

Services

{% code title="attacker@victim" %}

Get-CimInstance win32_service -Filter "Description = 'System Monitor service'"
# or
Get-Service | where-object {$_.DisplayName -like "*sysm*"}

{% endcode %}

{% hint style="warning" %} Note: display names and descriptions can be changed {% endhint %}

Windows Events

{% code title="attacker@victim" %}

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational

{% endcode %}

Filters

{% code title="attacker@victim" %}

PS C:\> fltMC.exe

{% endcode %}

Note how even though you can change the sysmon service and driver names, the sysmon altitude is always the same - 385201

Sysmon Tools + Accepted Eula

{% code title="attacker@victim" %}

ls HKCU:\Software\Sysinternals

{% endcode %}

Sysmon -c

Once symon executable is found, the config file can be checked like so:

sysmon -c

Config File on the Disk

If you are lucky enough, you may be able to find the config file itself on the disk by using native windows utility findstr:

{% code title="attcker@victim" %}

findstr /si '<ProcessCreate onmatch="exclude">' C:\tools\*

{% endcode %}

Get-SysmonConfiguration

A powershell tool by @mattifestation that extracts sysmon rules from the registry:

{% code title="attacker@victim" %}

PS C:\tools> (Get-SysmonConfiguration).Rules

{% endcode %}

As an example, looking a bit deeper into the ProcessCreate rules:

{% code title="attacker@victim" %}

(Get-SysmonConfiguration).Rules[0].Rules

{% endcode %}

We can see the rules almost as they were presented in the sysmon configuration XML file:

A snippet from the actual sysmonconfig-export.xml file:

Bypassing Sysmon

Since Get-SysmonConfiguration gives you the ability to see the rules sysmon is monitoring on, you can play around those.

Another way to bypass the sysmon altogether is explored here:

{% content-ref url="../defense-evasion/unloading-sysmon-driver.md" %} unloading-sysmon-driver.md {% endcontent-ref %}

References

{% embed url="https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon" %}

{% embed url="https://github.com/mattifestation/PSSysmonTools/blob/master/PSSysmonTools/Code/SysmonRuleParser.ps1" %}

{% embed url="https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes" %}

{% embed url="https://github.com/GhostPack/Seatbelt" %}