As network security professionals, we want to protect our organizations against attacks. We have many tools to help us detect and investigate them. But cybercriminals are introducing new types of attacks every day, and it’s an ongoing battle to keep up.

A great new tool to add to your arsenal is the new content pack available in the IBM Security App Exchange, IBM QRadar Content for Sysmon. This content pack will help you detect attacks such as WannaCry and NotPetya as well as older, tried-and-true endpoint attacks.

What Is QRadar Content for Sysmon?

Sysmon is a small, free Windows system service and device driver that monitors system activity and logs events to the Windows event logs. You can install it through Windows group policy, the system center or by using startup scripts.

The QRadar content pack for Sysmon is easy to download and install. It contains great new use cases comprised of new QRadar rules, reference sets, maps and custom functions developed to decipher those nasty hidden attacks.

Our teams are working around the clock to create this exciting new content. We trawl the internet looking at blogs, view best practices from SANS digital forensics and incident response (DFIR) training materials, talk to experts, view white papers and work with our professional services team to find relevant information — and there’s more great content to come.

Sysmon is not demanding on system resources and there is no reason users should even notice it running. When you install Sysmon, you get access to a list of events and detailed information on the endpoint that is not normally available in Windows security logs. The following image shows an example of Sysmon events.

What Do the Sysmon Events Tell Us?

Sysmon events provide you with more detail about what is happening on the endpoint. This gives you greater insight into both recent and older (but still relevant) attacks.

Event ID 1: Process Create

Sysmon provides detailed information about processes, where they run from, the commands they run, their file hashes and any relationship between processes. This enables you to detect activities such as malicious PowerShell usage as well as processes that are disguised as other processes.

The file hash information can be used for a whitelist approach in your environment. It empowers you to compare your list to a list of known file hashes.

Event ID 7: Image Loaded

The solution also allows you to detect fileless memory attacks, Dynamic Link Libraries (DLLs) that are loaded and the signature status.

Event ID 8: CreateRemoteThread

Do you remember Mimikatz? With Sysmon, you can detect such an attack. It helps you see the processes injected into other threads so you can spot attacks such as Pass the Hash.

Event ID 11: File Create

Lets say you have some threat intelligence about an attack campaign and you know that the malware creates a file in a certain directory structure. You can easily create a QRadar rule to detect this with Sysmon logs.

Sysmon can also filter all of the listed events before they reach your QRadar deployment, which gives you a very granular level of control. For example, there might be processes that you know are good, or your organization may be developing DLLs, executables or remote threads on endpoints that you know are safe.

If you prefer not to pass anything signed by Microsoft to QRadar, sysmon.xml allows you to control the level of detail you want and exclude or include these events before they even get to your QRadar deployment. That minimizes unwanted events and reduces false positives.

Tighten Your Security

All these event IDs are great, but the real power of Sysmon happens when this information is sent to the QRadar correlation engine, together with the use cases that are enabled by installing QRadar Content for Sysmon.

Tighten your security with QRadar Content for Sysmon and help us build a more secure network for you.