Hacks Weekly #7: Sysmon - how to set up, update and use?

In this tutorial, I will show you how to set up Sysmon correctly, as well as how to update it with a custom configuration. In addition, I'm super excited to show you tools that our team wrote to support system logging and to extract information about what is happening, for example, with your processes communicating with the network. Let’s dive into Sysmon.

[shanifsalim]

You are simply awesome. No words to say. I have never seen such a video.

[hemav]

Thank you so much of the video :) please share data exfiltration techniques detection using sysmon if possible

[shahg]

Thank you very much Paula, really helped me to understand sysmon in depth. Is it possible to include how much data (in KB or MB) went out on destination port. size of the data. This is the thing lacking in CQSysmonNetAnalyzer tool which is really a great tool. Please reply or if you can guide how to get this also.

[jackhammer]

We got a beautiful instructor and an excellent teacher good stuff you teach my friend good stuff

[fadinoufal]

i'm currently trying to inform myself more in to microsoft security tooling etc, eventually i want to specialise in pentesting, what documentation en certifications do you reccomend. now i'm doing 70-744 which is pretty new

[cruor]

Thank you very much for this useful video, however I have an issue, when i load the configuration file xml, the sysmon service crashed so I need to launch it manually, do you have any idea what is happening? For. Information I'm using windows 7

[Lofote]

So are you always sitting on the floor like this with your computer when you do your IT stuff? :-D very cool video... you present it in much a more "live" way than the usual "we are sitting or standing straight on our desks like in the news shows" way :-D

[ianhj]

All volumes turned to full on my laptop and the video is still too quite and some dialogue is hard to hear

[robivy]

good stuff but not clear...how does config.xml work? i typed the file and saved it to the same folder as sysmon but it doesnt seem to work

[jeliazkozlatev]

cool video, but is it possible to speak little bit louder, because my volume on youtube and my laptop are at full and i still have problems hearing what you are saying :)

[austinmurphy]

CQuire Tools found Skeeya! trojan in your tools and flagged it?

[sriramgiri]

I cant seem to update the config for sysmon. Need help.

[pokusnevidea]

good video, but i was wondering, why are you almost-whispering? i mean, not only in this video, but in almost all of your videos. don't worry, the mic does not bite :) maybe you could perhaps boost volume next time editing videos? peace ;)

[marcus.edmondson]

The schema version it exported was incorrect.