October 19, 2017 By Shane Lundy 3 min read

As network security professionals, we want to protect our organizations against attacks. We have many tools to help us detect and investigate them. But cybercriminals are introducing new types of attacks every day, and it’s an ongoing battle to keep up.

A great new tool to add to your arsenal is the new content pack available in the IBM Security App Exchange, IBM QRadar Content for Sysmon. This content pack will help you detect attacks such as WannaCry and NotPetya as well as older, tried-and-true endpoint attacks.

What Is QRadar Content for Sysmon?

Sysmon is a small, free Windows system service and device driver that monitors system activity and logs events to the Windows event logs. You can install it through Windows group policy, the system center or by using startup scripts.

The QRadar content pack for Sysmon is easy to download and install. It contains great new use cases comprised of new QRadar rules, reference sets, maps and custom functions developed to decipher those nasty hidden attacks.

Our teams are working around the clock to create this exciting new content. We trawl the internet looking at blogs, view best practices from SANS digital forensics and incident response (DFIR) training materials, talk to experts, view white papers and work with our professional services team to find relevant information — and there’s more great content to come.

Sysmon is not demanding on system resources and there is no reason users should even notice it running. When you install Sysmon, you get access to a list of events and detailed information on the endpoint that is not normally available in Windows security logs. The following image shows an example of Sysmon events.

What Do the Sysmon Events Tell Us?

Sysmon events provide you with more detail about what is happening on the endpoint. This gives you greater insight into both recent and older (but still relevant) attacks.

Event ID 1: Process Create

Sysmon provides detailed information about processes, where they run from, the commands they run, their file hashes and any relationship between processes. This enables you to detect activities such as malicious PowerShell usage as well as processes that are disguised as other processes.

The file hash information can be used for a whitelist approach in your environment. It empowers you to compare your list to a list of known file hashes.

Event ID 7: Image Loaded

The solution also allows you to detect fileless memory attacks, Dynamic Link Libraries (DLLs) that are loaded and the signature status.

Event ID 8: CreateRemoteThread

Do you remember Mimikatz? With Sysmon, you can detect such an attack. It helps you see the processes injected into other threads so you can spot attacks such as Pass the Hash.

Event ID 11: File Create

Lets say you have some threat intelligence about an attack campaign and you know that the malware creates a file in a certain directory structure. You can easily create a QRadar rule to detect this with Sysmon logs.

Sysmon can also filter all of the listed events before they reach your QRadar deployment, which gives you a very granular level of control. For example, there might be processes that you know are good, or your organization may be developing DLLs, executables or remote threads on endpoints that you know are safe.

If you prefer not to pass anything signed by Microsoft to QRadar, sysmon.xml allows you to control the level of detail you want and exclude or include these events before they even get to your QRadar deployment. That minimizes unwanted events and reduces false positives.

Tighten Your Security

All these event IDs are great, but the real power of Sysmon happens when this information is sent to the QRadar correlation engine, together with the use cases that are enabled by installing QRadar Content for Sysmon.

Tighten your security with QRadar Content for Sysmon and help us build a more secure network for you.

More from

CISA releases landmark cyber incident reporting proposal

2 min read - Due to ongoing cyberattacks and threats, critical infrastructure organizations have been on high alert. Now, the Cybersecurity and Infrastructure Security Agency (CISA) has introduced a draft of landmark regulation outlining how organizations will be required to report cyber incidents to the federal government.The 447-page Notice of Proposed Rulemaking (NPRM) has been released and is open for public feedback through the Federal Register. CISA was required to develop this report by the Cyber Incident Reporting for Critical Infrastructure Act of 2022…

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

What should an AI ethics governance framework look like?

4 min read - While the race to achieve generative AI intensifies, the ethical debate surrounding the technology also continues to heat up. And the stakes keep getting higher.As per Gartner, “Organizations are responsible for ensuring that AI projects they develop, deploy or use do not have negative ethical consequences.” Meanwhile, 79% of executives say AI ethics is important to their enterprise-wide AI approach, but less than 25% have operationalized ethics governance principles.AI is also high on the list of United States government concerns.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today