diff --git a/Build/Sysmon.md b/Build/Sysmon.md
new file mode 100644
index 0000000..c4c63f0
--- /dev/null
+++ b/Build/Sysmon.md
@@ -0,0 +1,2389 @@
+
+
+# What is Sysmon
+
+Sysmon is a free tool initially developed by Mark Russinovich and has contributions by Tomas Garnier, David Magnotti, Mark Cook, Rob Mead, Giulia Biagini, and others at Microsoft. The tool is designed to extend the current logging capabilities in Windows to aid in understanding and detecting attackers by behavior. It was developed originally for internal use at Microsoft. (Note: There are still two versions of the tool—internal and external.) Currently, the tool supports 64-bit and 32-bit systems and uses a single command line tool for installation and configuration management.
+
+All of the events generated by Sysmon are saved in Microsoft-Windows-Sysmon/Operational EventLog in order to accomodate security products that already leverage the EventLog, and to make the events easier to view and collect.
+
+Sysmon is able to monitor for a series of actions on a Windows host that relate to existing behavior that is abused by threat actors. With this view on the actions, defenders are able to better detect abnormal behavior and abuses on a system.
+
+The table below shows the event types and event ID for each.
+
+| EventType| EventId|
+|---|---|
+|Sysmon Service Status Changed|0
+|ProcessCreate|1
+|FileCreateTime|2
+|NetworkConnect|3
+|Service State Change|4
+|ProcessTerminate|5
+|DriverLoad|6
+|ImageLoad|7
+|CreateRemoteThread| 8
+|RawAccessRead| 9
+|ProcessAccess| 10
+|FileCreate| 11
+|Registry object added or deleted | 12
+|Registry Create| 13
+|Registry Rename| 14
+|FileCreateStreamHash | 15
+|Sysmon Config Change| 16
+|Named Pipe Create| 17
+|Named Pipe Connected|18
+|WMI Event Filter|19
+|WMI Event Consumer|20
+|WMI Consumer to Filter|21
+|DNS Query|22
+|File Delete|23
+|Error|255
+
+
+## The Sysmon Driver
+
+All of the monitoring is performed thanks to a driver that Sysmon installs called SysmonDrv. The driver will hook into Windows APIs and leverage Event Tracing for Windows (ETW) to capture the information on the actions it wants to monitor.
+
+This Sysmon Driver has a unique altitude number of 385201 that determines the order of loading of the driver in comparison to other drivers on the system. Some blog posts recommend changing this number in the registry for obfuscation, but this may cause a conflict with another driver and prevent Sysmon from working or cause other errors on the system.
+
+The driver is loaded by a service at system startup and a secondary service then queries the cached information.
+
+
+
+For all file system operations, the driver registers as a Minifilter driver that is attached to volumes allowing it to see all actions taken by APIs before they are processed by the file system.
+
+
+
+Sysmon sets multiple callbacks on kernel objects in addition to using telemetry APIs and ETW.
+
+
+
+
+
+When the tool is downloaded from the Microsoft Sysinternals website it is important to save and identify previous versions since Microsoft does not provide older versions and the release notes do not detail what has been fixed. Microsoft has a fast release cycle, forcing users to test very carefully and to keep track of versions.
+
+
+
+Another important piece of information is that there is no support from Microsoft on the Sysinternal tools—they are free and provided as is. This means that a testing plan for the environment it is deployed on should be formulated, tested, implemented, and improved upon as new versions of Sysmon are released.
+
+# The Sysmon Command Line
+
+Sysmon installation and configuration can be done via the command line. When Sysmon is downloaded from Microsoft, the zip file will contain two command line versions of the tool:
+
+* **Sysmon.exe** - x86 and x64 version.
+
+* **Sysmon64.exe** - 64bit only version.
+
+When using the tool, any errors will result in an error message and help information with basic switches. To see only the help information for the tool, the **-?** switch parameter is used. This help information will include:
+
+* Parameter sets for installation, configuration, and uninstall
+
+* Common command line parameters.
+
+* General notes on how the tool works and further details on how to get more help informationn.
+
+The parameters of the tool and the structure of the XML configuration file are defined in the tool Schema. This schema can be printed using the **-s "PrintSchema"** parameter; if no schema version is provided, it will print the default schema.
+
+The tool can be run in 4 main modes; 3 of them are shown in the help message:
+
+* **Install** - Install the driver, manifest and service on the host.
+
+* **Configure** - Parses a given configuration file or command line parameters to generate a configuration that is stored in the registry.
+
+* **Uninstall** - Removes the driver and service from the host.
+
+The semi-hidden and undocumented method is Debug, in which a specified configuration is parsed, and live events are shown in the console.
+
+## Install
+
+The key parameter that initiates the installation mode of Sysmon is the **-i** switch. The installation process will be as follows:
+
+* Decompresses and saves driver and copy of itself in to **%systemroot%**
+
+* Registers event log manifest
+
+* Creates a service
+
+* Enables a default configuration (ProcessCreation, ProcessTermination, DriverLoad , FileCreationTimeChanged, SHA1 for Images) if no configuration file is passed using the **-c \** parameter
+
+The Installation process allows for some obfuscation:
+
+* Driver name can be changed
+
+* Service name can be changed
+
+* Sysmon binary name can be renamed.
+
+These obfuscation changes will also affect registry paths for the driver and processes service keys. All of the obfuscation methods are part of the installation option set.
+
+The installation options are:
+
+* Default -- Driver is installed and named SysmonDrv and service Sysmon
+
+```shell
+sysmon.exe --i --accepteula
+
+```
+
+* Renamed Driver -- The driver file and registry entry are renamed. Name has an 8-character limit.
+
+```shell
+sysmon.exe -i -d
+```
+
+* Renamed Service -- The executable name defines the service name.
+
+```shell
+.exe -i -d
+```
+
+The installation process on a x64 system with the binary named sysmon.exe that is intended to work across x64 and x86 architectures is shown below. This is important since some of the actions may cause confusion or trigger alerts on monitoring systems.
+
+One important thing to keep in mind when obfuscating the driver name and service name is that certain characteristics remain the same.
+
+* Service description remains the same. (This can be modified post-install.)
+
+* Driver Altitude number remains the same.
+
+* The eventlog remains the same so as to not break collection from SIEM products.
+
+***Process for x86***
+
+
+
+
+
+***x64 Process***
+
+
+
+
+
+Sysmon will create 2 registry keys to define the services for its operation under ***HKLM\\SYSTEM\\CurrentControlSet\\Services***
+
+* Sysmon - Service that talks to the driver and performs the filtering action. It is named with the same name as the sysm onexecutable.
+
+* SysmonDrv - Kernel Driver Service, this service loads the Sysmon driver with an altitude number of 385201
+
+The settings for each service are:
+
+Main Service:
+
+* Name: **Name of the executable (default Sysmon or Sysmon64)**
+
+* LogOn: **Local System**
+
+* Description: **System Monitor service**
+
+* Startup: **Automatic**
+
+* ImagePath: **%windir%\\\**
+
+Driver Service:
+
+* Name: **SysmonDrv unless --d \ is**
+
+* LogOn: **Local System**
+
+* Description: **System Monitor driver**
+
+* Startup: **Automatic**
+
+* ImagePath: **\.sys**
+
+## Installation with Configuration
+
+An XML configuration file can be passed during installation if an initial configuration needs to be set. This is the preferred method for production systems since a configuration file can cover all types and logic. The most used method is to pass a configuration file using the **-c \** parameter.
+
+```shell
+sysmon.exe -i --accepteula -c
+```
+
+We can control the hashing algorithm used for events that hash images and we can control checking of revocation of signatures.
+
+The hashing algorithm or combination of them can be specified with the **-h \** The specified algorithms will be used to hash all images.
+
+```shell
+sysmon.exe -i -c -h
+```
+
+We can specify checking to see if certificates are revoked using the -r parameter.
+
+```shell
+sysmon.exe -i -c -r**
+
+```
+
+SSome basic filtering can be done also from the command line. Only filtering by process name can be done for NetworkConnect, ImageLoad, and ProcessAccess via the command line.
+
+* **NetworkConnect** - Track network connections.
+
+```shell
+sysmon.exe -i -c -n []
+```
+
+* **ImageLoad** - DLL loading by processes.
+
+```shell
+sysmon.exe -i -c -l []
+```
+
+* **ProcessAccess** - Processes whose memory is accessed.
+
+```shell
+sysmon.exe -i -c -k []**
+```
+
+## Uninstall
+
+To uninstall Sysmon, a binary with the same name as the main service, if renamed, has to be run with the **-u** switch parameter.
+
+```shell
+sysmon.exe -u
+```
+
+When executed the command will run a series of steps to uninstall the service, driver and remove files for the tool.
+
+
+
+There is an undocumented value that can be passed to the **-u** parameter of **"force"** to force the removal of the services even if a stop was not possible.
+
+```shell
+sysmon.exe -u force
+```
+
+## Installation Best Practice
+
+Installation best practices that can be followed to aid and minimize risk when deploying the Sysmon tool include:
+
+* Keep a repository of Sysmon versions archived; Microsoft does not provide older versions for download.
+
+* Sysmon is very dependent on the version of the binary for its configuration. The install/upgrade script should check the binary version for:
+
+ * Upgrade
+
+ * Version for applying initia config
+
+* If a GPO is used to push scheduled tasks for upgrades or to push configuration, use a WMI filter to target the specific version that was tested. Example:
+
+```sql
+SELECT * FROM CIM_Datafile WHERE (Name="c:\\Windows\\Sysmon64.exe" OR Name="c:\\Windows\\Sysmon.exe") AND version="10.0.4.1"
+```
+
+* Check file versions they don't match release versioning.
+
+* It is better to not push configuration as an XML that gets run from a share or dropped on disk with a scheduled task:
+
+ * Credentials are left that can be recovered via DPAPI for deleted scheduled tasks.
+
+ * The file can be read more easily by an attacker if controls are not properly placed
+
+ * There is a higher chance of human error
+
+ * Better to push values via GPO or other methods with file version checking.
+
+# Configuration
+
+The configuration options of Sysmon and the structure of the configuration file are defined in its schema. Each version of Sysmon that adds capabilities raises the schema version, and this version number is not tied to the binary version number.
+
+To take a look at this schema, we would run the binary with the **-s \[schema version\]** parameter; if no schema version is specified, we would get the latest one for the binary.
+
+When we look at the XML representation of the schema, we see the manifest element has two attributes for versioning:
+
+* **schemaversion** - The version number of the schema
+
+* **binaryversion** - The binary version number of the compiled schema
+
+Under this manifest element are two main elements:
+
+* **configuration** - Command line switches for the executable and the filtering operators
+* **events** - This section defines each event type and field we can filter on
+
+
+
+## Command Line Parameters
+
+Under the configuration element, we have an element called options that contains all the command line parameters. Each of the option elements are broken in to command line and configuration options where each type of the command line switches is identified with a comment in the XML.
+
+The main attributes for each of the command-line options:
+
+* **switch** - the command line switch to use.
+
+* **name** - name of the switch.
+
+* **argument** - is the argument optional or mandatory
+
+
+
+The main arguments that can be passed are:
+
+* **-i** : Install Sysmon
+
+```shell
+sysmon.exe -i [configfile path]
+```
+
+* **-c** : apply config
+
+```shell
+sysmon.exe -c [configfile path]
+```
+
+* **-u** : un-install Sysmon
+
+```shell
+sysmon.exe -u [force]
+```
+
+* **-m** : Install event manifest
+
+```shell
+sysmon.exe -m
+```
+
+* **-t** : Debug mode
+
+```shell
+sysmon.exe -t [configfile path]
+```
+
+* **-s** : Print schema
+
+```shell
+sysmon.exe -s [schema version]
+```
+
+* **-nologo** : don't show sysmon logo
+
+```shell
+sysmon.exe -nologo
+```
+
+* **-accepteula** : Accepts the license agreement
+
+```shell
+ sysmon.exe -accepteula
+```
+
+* **--** : Resets the configuration to the default
+
+```shell
+sysmon.exe --
+```
+
+The option elements under the comment "Configuration file" allow for the configuration of filters and parameters that relate to filters.
+
+* **-h** : Hashing algorithm to has images.
+
+```shell
+sysmon.exe -c -h
+```
+
+* **-r** : Check for signature certificate revocation
+
+```shell
+sysmon.exe -c -r
+```
+
+* **-n** : Track network connections for specified process/processes
+
+```shell
+sysmon.exe -c -n []
+```
+
+* **-k** : Track when a specified process/processes memory are accessed
+
+```shell
+sysmon.exe -c -k []
+```
+
+* **-l** : Track modules (DLLs) loaded by a specified process/processes.
+
+```shell
+sysmon.exe -c -k []
+```
+
+* **-d** : Rename the sysmon driver during install (8 character limit)
+
+```shell
+sysmon.exe -i -c -d
+```
+
+> **-g** and **--dns** switches are listed but as of the current version, they
+> do not update the configuration.
+
+## Filter Operators
+
+In the filters element under configuration is the list of operators that can be used to filter against the fields of each event type.
+
+| **Operator** | **Meaning**
+|------------------|------------------------------------------------------
+| Is| Exact match.
+| IsNot| Negates and exact match
+| Contains| The string is contained in any part of the value of the field.
+| Excludes | Excludes the event from the logic if the event is the value matches
+| Excludes All| Exclude if all values match. (values are separate by ";" )
+| Excludes Any | Excludes if any of the values match. (values are separate by ";" )
+| Image | Name of the image without the full path.
+| BeginsWith | String value starts with.
+| EndsWith | String value ends with
+| LessThan | Numeric value is less than
+| MoreThan | Numeric value is more than
+| Contain Any | Contains any of the values. (values are separate by ";" )
+| Contains All | Contains all of the values. (values are separate by ";" )
+
+Each of these operators execute against the value in a given field for each of the event types.
+
+## Event Schema
+
+Under the events element each event that Sysmon generates is defined as an event element. Each event is defined as shown below:
+
+* **name** : Name of event
+
+* **value** : The EventID for the event
+
+* **level** : Event severity level
+
+* **template** : Event manifest template used for the event
+
+* **ruleName** : Name of rule we filter on
+
+* **ruledefault** : The default action of a rule if not specified
+
+* **version** : The version of the event
+
+
+
+We can filter on the Field Names defined in the data elements. They are defined as:
+
+* **Name** : Name of filed
+
+* **inType** : Type of data received in to the driver
+
+* **outType** : Data type the data is presented as
+
+
+
+As of the latest version we have defined as event types:
+
+* **NetworkConnect** - Network connections made by processes on the system; both TCP and UDP
+
+* **ProcessCreate** - Creation of new processes in the system and information related to the process
+
+* **FileCreateTime** - File creation time modification and what process is responsible for it
+
+* **ProcessTerminate** - The termination of a process
+
+* **ImageLoad** - Loading of any image by another process (OCX, DLL, etc.) with information of the process loading the image and the image itself
+
+* **DriverLoad*** - Loading of a driver by the system and its file information
+
+* **DnsQuery** - DNS query performed by a process using Windows API, includes information on the query and the process that performed it
+
+* **ProcessAccess** - Access to a process memory from another process and information on access permission and the processes involved
+
+* **RawAccessRead** - Raw access to a file by a process bypassing the file system controls
+
+* **FileCreateStreamHash** - An alternate stream was created and the content of the stream is hashed; information on the process that created the stream is logged
+
+* **RegistryEvent** - Logs the creation, deletion, and modification of specific registry keys and values; information on the process that took the action is logged
+
+* **FileCreate** - Information of a file that is created including the process that created the file
+
+* **PipeEvent** - Named Pipe communication between two processes and its relevant information
+
+* **WmiEvent** - Information on the creation, deletion, and modification of WMI permanent event components in the CIM database
+
+## Configuration File
+
+The main method of configuration of Sysmon is through the use of XML configuration files. XML configuration files allow for higher flexibility since more filtering options are possible by applying logical operations to the fields that are defined by the schema version for the event types.
+
+Previous schemas can be used in newer releases of the binary allowing for upgrading of the binary without the need to update the configuration. The schema is defined on the root element (Sysmon) of the configuration file with the attribute schemaversion.
+
+
+
+We can optionally specify a hashing algorithm with the HashAlgorithms elements. More than one can be specified in this element or all of them using the \* symbol.
+The presence of the CheckRevocation element is enough to allow for checking whether a certificate used to sign an image has been revoked. There are three main ways to organize filters with the latest version of Sysmon.
+
+* EventType filters.
+
+* EvenType Filters organized using RuleGroups
+
+* EventType Filters organized in to Rule sets inside RuleGroups.
+
+We can have up to two instances of each EventType (one include and one exclude) for the entire configuration, whether or not RuleGroups are used. On SchemaVersion 4.22 and above, the default relation between filters is AND.
+
+
+
+Below is an example where if the filters match, they are included and placed in the EventLog using an intrinsic AND logic.
+
+
+
+This type of configuration is only good with Schema 4.22 and above. It is recommended that this is used only for quick tests due the limitation of the AND logic for filters.
+
+### RuleGroups
+
+The RuleGroup element allows for the modification of the logic of the filters and also allows for more complex logic since multiple Rule elements with multiple filters can be created and the logic for the filters can be modified in order to capture actions in a more granular way.
+
+
+
+Remember: You can only have one single EventType per RuleGroup. Sysmon will not error if you have more than one, but only the first EventType filters will be loaded.
+
+In a RuleGroup element, the name attribute is not used to populate the RuleName field of an event when one is created. While it may be used for a description, XML comments are a better option. When choosing the name to go in the RuleName field, the order of precedence for RuleName is Filter -> RuleGroup name attributes. It is recommended that names be placed on the individual filters to be able to leverage the field more efficiently when filtering logs on a SIEM platform. One thing to keep in mind is that when multiple filters are in a Rule element, only the first filter name attribute is used.
+
+When using AND in a Rule element, the name used to populate the RuleName will be based on the order of the filters as they appear on the schema where the last matching one is the one used. When using OR in a Rule element, the name used to populate the RuleName will be the filter that matches.
+
+Rules are processed in the order they are placed in the configuration file. This is important because once a Rule matches and the information for that EventType is included in the Windows EventLog, no other rule will be processed against that action. Filters that are not in a Rule element will be processed in the order that they appear in the schema. This also applies to multiple filters inside a Rule where the schema order is used.
+
+
+
+
+
+## Configuration File Best Practices
+
+It is important to track what a configuration does and keep a changelog. For this reason, it is recommended to add headers to track basic information like changelog, version, sysmon version tested against, etc.
+
+
+
+For RuleGroups, Rules and Filters use comments to organize filters and to provide information on what each filter is doing.
+
+
+
+Hash configurations that are deployed and keep a log of them for later
+verification.
+
+Hash configurations that are deployed and keep a log of them for later verification.
+On a system where the Sysmon service process consumes a lot of CPU resources, the number of filters and operators should be reviewed. The operators that use slightly more CPU are:
+
+* contains
+
+* contains all
+
+* contains any
+
+A method for checking applied configuration is hashing the configuration
+in the registry.
+
+
+
+
+Since getting stated can be complex, some great resources that serve as starting points for Rule development and reference include:
+
+* Swift On Security configuration example
+
+
+* Olaf Hartong Sysmon Configuration Modules
+
+
+### Configuration Tampering
+
+One of the actions an attacker takes is the identification of controls and logging on a system.
+
+Due to initial footprint and safety, most advanced attackers limit their actions to enumerate controls to the most common actions that elements that will trigger a monitoring solution. The most common methods used are:
+
+* Service list.
+
+* Process list.
+
+* Listing of installed applications from the registry.
+
+This does not mean that an attacker will not use more advanced methods to enumerate controls and find Sysmon on the system.
+
+Detection of Sysmon is achieved by looking at the areas that cannot be changed.
+
+ **Indicator** | **Can it be Changed**
+ ----------------------------| -----------------------
+ |Driver Name| YES
+ |Service Name| YES
+ |Registry Config Path| YES
+ |Driver altitude Number| NO
+ |EventLog Path and Name| NO
+ |Sysmon Service Description| NO (Manually)
+
+When Sysmon configuration is modified using the Sysmon command line tool, an **EventId 16** is generated. If the registry binary value is modified directly, no event is generated, and configuration is applied as soon as the value is modified.
+
+When a GPO is used to update configuration by default every 90 minutes, the configuration will be updated. A better solution is to use a configuration management solution like DSC that can monitor for changes and update as soon as a change is detected.
+
+Sysmon can be configured to monitor its own configuration to detect whether an attacker deletes or alters it. In the event that it is cleared, this will be the last event logged by Sysmon itself from its configured filters.
+
+
+
+
+
+
+In case the configurations are cleared, the default one will take over:
+
+* **ProcessCreation**
+
+* **ProcessTermination**
+
+* **DriverLoad**
+
+* **FileCreationTimeChanged**
+
+* **SHA1 for Images**
+
+Since any user in the system can read the rule binary data, an attacker can operate around rule configurations once they have read them by:
+
+* Execute tasks not logged.
+
+* Execute tasks that would blend in with normal logged actions
+
+Existing tools for parsing rules out of the registry break often as Sysmon is updated, since the way the information is structured in the binary blob is not documented. However, an attacker can export and import into the test system and use Sysmon to read the configuration.
+
+## Configuration Deployment
+
+Most environments that have the capabilities to leverage Sysmon enhanced log collection also have software deployment systems like Altiris, System Center Configuration Manager, Desired State Configuration, etc. This is why these are just general recommendations.
+
+### Deployment Script
+
+On most of these environments, the deployment of Sysmon is managed by using scripts, with PowerShell being the most flexible one.
+
+An install script should
+
+* Check if Sysmon is installed; if not, Install.
+
+* If Sysmon is installed, check the version and upgrade if needed.
+
+* After an uninstall, ensure the registry key and files are removed before upgrading. (There have been issues in the past.)
+
+```PowerShell
+$DriverName = 'SysmonDrv.sys'
+$CurrentVersion = '10.41'
+# Check if the driver if present
+$Present = Test-Path -Path "C:\Windows\$($DriverName)" -PathType Leaf
+if ($Present) {
+ Write-Host -Object "[+] Sysmon was found." -ForegroundColor Green
+ # Check if the version on host is the approved one.
+ $HostVersion = (Get-Item "C:\Windows\$($DriverName)").VersionInfo.FileVersion
+ if ($CurrentVersion -eq $HostVersion) {
+ Write-Host -Object "[+] Sysmon is current approved version." -ForegroundColor Green
+ } else {
+ # Execute upgrade process.
+ Write-Host -Object "[-] Sysmon needs upgrade." -ForegroundColor Red
+ -U
+ -I
+ }
+} else {
+ # Execute install process.
+}
+```
+
+### GPO Configuration Deployment
+
+Group Policy remains one of the most used methods in the enterprise network for the control of configuration setting.
+
+The following are instructions on how to create a GPO for an existing applied configuration.
+
+1. In the Group Policy Management Console (**gpmc.msc**)
+
+2. Create a new (or edit an existing) GPO and assign it to the appropriate Active Directory Organizational Unit.
+
+3. Right click on the GPO and select **Edit**
+
+4. Expand **Configuration -\> Preferences -\>Windows Settings -\> Registry**
+
+5. Right Click on Registry **New -\> Registry Wizard**
+
+ {width="6.5in" height="3.3125in"}
+
+6. Select if local or remote machine.
+
+7. Navigate and select the key **HKLM\\SYSTEM\\CurrentControlSet\\Services\\SysmonDrv\\Parameters** and all parameters under it.
+
+ 
+
+A WMI filter will ensure only machines with the proper version of Sysmon installed will receive the configuration.
+
+# Sysmon Events Types
+
+Sysmon extends the collection capabilities of defenders by allowing the collection of specific types of behaviours in to the eventlog so existing solutions that already collect information from the eventlog can easily ingest this new information.
+
+The table below shows the evet types and event ID for each.
+
+| EventType| EventId|
+|---|---|
+|Sysmon Service Status Changed|0
+|ProcessCreate|1
+|FileCreateTime|2
+|NetworkConnect|3
+|Service State Change|4
+|ProcessTerminate|5
+|DriverLoad|6
+|ImageLoad|7
+|CreateRemoteThread| 8
+|RawAccessRead| 9
+|ProcessAccess| 10
+|FileCreate| 11
+|Registry object added or deleted | 12
+|Registry Create| 13
+|Registry Rename| 14
+|FileCreateStreamHash | 15
+|Sysmon Config Change| 16
+|Named Pipe Create| 17
+|Named Pipe Connected|18
+|WMI Event Filter|19
+|WMI Event Consumer|20
+|WMI Consumer to Filter|21
+|DNS Query|22
+|File Delete|23
+|Error|255
+
+## Sysmon Operational Events
+
+Sysmon will generate events for monitoring:
+
+* Configuration Changes
+
+* Service State Changes
+
+* Sysmon Errors
+
+These events cannot be filtered using Sysmon configuration and will be generated by the sysmon.exe (Default Install) process.
+
+### Sysmon Config Change
+
+Sysmon will log an EventID 16 when it updates its configuration. The event will only be generated if the configuration is changed with the Sysmon binary and not a direct change to the registry key. It is recommended that Windows Auditing be configured for the configuration key and a Sysmon filter to capture any attempt at modification outside of the use of the Sysmon binary.
+
+Fields for the Event:
+
+* **UtcTime**: Time the configuration was modified.
+
+* **Configuration**: Path to configuration file or command line of
+ command used to modify the config.
+
+* **ConfigurationFileHash**: If a configuration file was used, the
+ hash of the file.
+
+Example: Configuration using a XML file.
+
+
+
+Example: Configuration via Command Line resetting configuration to
+default using the \-- switch.
+
+
+
+Example: Configuration via Command Line. Set to monitor module loading
+by powershell.exe
+
+
+
+### Sysmon Error Event
+
+If the Sysmon binary running as a service encounters any error in its operation, it will generate an EventID 255. Some of the cases where this event may be generated are when:
+
+* The driver fails to load, or an attacker may have unloaded the driver
+
+* An application or attacker has modified the configuration in a way that cannot be parsed by the service
+
+Fields for the Event:
+#### Known errors
+
+|ID |Description |
+|---------------|-------------------------------|
+| DriverCommunication |Failed to retrieve events|
+| DriverCommunication |Incorrect event size [value]|
+| DriverCommunication |Failed to access the driver|
+| ServiceThread |Failed to initialize event for dispatch|
+| ServiceThread |Failed to initialize the rule engine with data|
+| ServiceThread |Failed to initialize signature verification|
+| ServiceThread |Failed to allocate [value] bytes|
+
+Example:
+
+
+
+
+### Service State Change
+
+EventID 4 is generated for Service State Changes. This event logs Start and Stop events when the Sysmon service is controlled via the Service Control Manager API (Services.mmc, sc.exe, net.exe, etc.). To better detect any manipulation of the service, Windows Auditing should be enabled for the service registry key and a Sysmon Registry filter for the service.
+
+Fields for the event are:
+
+* **UtcTime**: Time the service state changed.
+
+* **State**: Started or Stopped
+
+* **Version**: Version of the Sysmon binary
+
+* **SchemaVersion**: Schema Version of the Sysmon binary.
+
+Example:
+
+
+
+
+
+## Process Events
+
+Sysmon can log process creation, process termination and process access events. The process events are captured via ObjRegisterCallbacks at the kernel level using its driver, and contain a unique, deterministically generated ProcessGuid and LogonGuid that are unique to their process instance and LSA logon session respectively.
+
+The ProcessGuid and LoginGuid make tracking individual process and users much easier. The ProcessGuid attribute is used in all events associated with its process, and, unlike a ProcessID, will not be reused by the host system later. The LogonGuid attirbute similarly is assigned to a login session of a particular user, and will not be reused later as a LoginID would.
+
+
+
+When a user logs onto on a modern version of Windows (Windows 2016/10)
+they will have 2 Logon IDs assigned if:
+
+* User is a member of local Administrator Group.
+
+* UAC (User Access Control) is enabled.
+
+These sessions will be linked by a Linked Login ID in Successful Logon
+Event ID 4624, making the logging of this event important.
+
+The ProcessGUID depending on the event and where in the process tree it
+is, it will also be known by other names by its relation to the action
+monitored.
+
+ProcessGUID is generated by Sysmon when Sysmon logs the event. ProcessGUID
+specifically is not an attribute of the internal Windows process data structs
+(EPROCESS). Sysmon keeps track of the GUID until the process exits.
+
+
+
+The only Event Types that will not reference a ProcessGuid or one of its
+derived names are
+
+* WMI events
+
+* Kernel Driver Load
+
+The image of the process is also related in other processes and can be
+used to track all actions related to a specific one.
+
+
+
+
+### Process Creation
+
+Sysmon will log **EventID 1** for the creation of any new process when
+it registers with the kernel.
+
+Sysmon will generate a ProcessGuid and LogonGuid with the information it
+obtains and it will hash the process main image. The command line of the
+process will be parsed and logged in to eventlog. When storage permits a
+common practice is to log all processes and to filter out common day to
+day processes for Windows and Applications after profiling usage.
+
+The fields on a process creation event are:
+
+* **ProcessGuid** -- Unique process GUID generated by Sysmon.
+
+* **ProcessId** -- Process ID represented as a integer number.
+
+* **Image** -- Full path of the executable image that was executed.
+
+* **FileVersion** -- File version filed in the image metadata.
+
+* **Description** -- Description field in the image metadata.
+
+* **Product** -- Product field in the image metadata.
+
+* **Company** - Company field in the image metadata.
+
+* **OriginalFileName** -- Original image name if renamed.
+
+* **CommandLine** -- Command line that executed the image.
+
+* **CurrentDirectory** -- Directory under which the image was
+ executed.
+
+* **User** - Name of the account who created the process (child) . It
+ usually contains domain name and user name
+
+* **LogonGuid** - Logon GUID of the user who created the new process.
+
+* **LogonId** -Login ID of the user who created the new process.
+
+* **TerminalSessionId** - ID of the session the user belongs to
+
+* **IntegrityLevel** - Integrity label assigned to a process
+
+* **Hashes** - Full hash of the file with the algorithms in the
+ HashType field.
+
+* **ParentProcessGuid** - ProcessGUID of the process that
+ spawned/created the main process (child)
+
+* **ParentProcessId** - Process ID of the process that spawned/created
+ the main process (child)
+
+* **ParentImage -** File path that spawned/created the main process.
+
+* **ParentCommandLine -** Arguments which were passed to the
+ executable associated with the parent process
+
+Sysmon offers an advantage over the regular process logging since it not
+only pulls the same information as with **EventID** **4688** but it also
+pulls information from the PE header, hashes the images for correlation
+with IOC databases like Virus Total and it also provides unique fields
+when querying for events.
+
+### Process Termintation
+
+Symon will log an **EventID 5** when a process terminates. By logging
+process termination events allow for calculating duration of operation
+of a process by comparing the times with process creation. Process
+termination also allows when co-related with shutdown and start events
+if a process may have been terminated by an attacker.
+
+The process termination fields are:
+
+* **RuleName** -- Rule name for which the event triggered.
+
+* **UtcTime** - Time in UTC when event was created
+
+* **ProcessGuid** - Process Guid of the process that terminated
+
+* **ProcessId** - Process ID used by the OS to identify the process
+ that terminated
+
+* **Image** - File path of the executable of the process that
+ terminated
+
+### Process Access
+
+When one process opens another, sysmon will log this with an event ID of 10. The access with higher permissions allows for also reading the content of memory, patching memory, process hollowing, creations of threads and other tasks that are abused by attackers. This technique has been used for access to credentials, keys and data that are in the process memory.
+
+This task is also common for benign processes that query information on another process, such as Task Manager, tasklist.exe and others, this requires that a baseline be established and filtered out at a SIEM level taking into consideration other factors like image fullpath, parent process and account used so as to prevent any whitelisted processes from being used as staging for attacks.
+
+Sysmon generates this event using ObRegisterCallbacks leveraging its
+driver. The main 2 filtering fields recommended are:
+
+* **TargetImage** - File path of the executable being accessed by
+ another process.
+
+* **GrantedAccess** - The access flags (bitmask) associated with the
+ process rights requested for the target process
+
+As a minimum it is recommended to filter including critical processes,
+as a minimum:
+
+* C:\\Windows\\system32\\lsass.exe
+
+* C:\\Windows\\system32\\csrss.exe
+
+* C:\\Windows\\system32\\wininit.exe
+
+* C:\\Windows\\system32\\winlogon.exe
+
+* C:\\Windows\\system32\\services.exe
+
+Check for masks of known tools for credential dumping, process injection
+and process hollowing. Great care should be taken when setting masks
+since Sysmon does a literal comparison of the mask string provided
+against the one returned. It is not a bitwise operation, care should be
+taken to track the proper combinations.
+
+|Access | Mask |
+|--------------------------------------|------------
+| PROCESS\_CREATE\_PROCESS |0x0080|
+| PROCESS\_CREATE\_THREAD |0x0002|
+| PROCESS\_DUP\_HANDLE |0x0040|
+| PROCESS\_SET\_INFORMATION |0x0200|
+| PROCESS\_SET\_QUOTA |0x0100|
+| PROCESS\_QUERY\_LIMITED\_INFORMATION |0x1000|
+| SYNCHRONIZE |0x00100000|
+| PROCESS\_QUERY\_INFORMATION |0x0400|
+| PROCESS\_SUSPEND\_RESUME |0x0800|
+| PROCESS\_TERMINATE |0x0001|
+| PROCESS\_VM\_OPERATION |0x0008|
+| PROCESS\_VM\_READ |0x0010|
+| PROCESS\_VM\_WRITE |0x0020|
+
+The PSGumshoe PowerShell module has a function for creating and parsing
+mask strings.
+
+
+The fields for the even are:
+
+* **RuleName**: Rule that triggered the event
+
+* **UtcTime**: Time in UTC when event was created
+
+* **SourceProcessGUID**: Process Guid of the source process that
+ opened another process.
+
+* **SourceProcessId**: Process ID used by the OS to identify the
+ source process that opened another process.
+
+* **SourceThreadId**: ID of the specific thread inside of the source
+ process that opened another process
+
+* **SourceImage**: File path of the source process that created a
+ thread in another process
+
+* **TargetProcessGUID**: Process Guid of the target process
+
+* **TargetProcessId**: Process ID used by the OS to identify the
+ target process
+
+* **TargetImage**: File path of the executable of the target process
+
+* **GrantedAccess**: The access flags (bitmask) associated with the
+ process rights requested for the target process
+
+* **CallTrace**: Stack trace of where open process is called. Included
+ is the DLL and the relative virtual address of the functions in the
+ call stack right before the open process call
+
+Example:
+
+```xml
+
+
+
+
+
+
+
+ C:\Windows\system32\lsass.exe
+
+ 0x1FFFFF
+
+
+
+ C:\Windows\system32\lsass.exe
+
+ 0x1F1FFF
+
+
+
+ C:\Windows\system32\lsass.exe
+
+ 0x1010
+
+
+
+ C:\Windows\system32\lsass.exe
+
+ 0x143A
+
+
+
+
+
+ C:\Windows\system32\csrss.exe
+ 0x1F1FFF
+
+
+
+ C:\Windows\system32\wininit.exe
+ 0x1F1FFF
+
+
+
+ C:\Windows\system32\winlogon.exe
+ 0x1F1FFF
+
+
+
+ 0x1F1FFF
+ C:\Windows\system32\services.exe
+
+
+ 0x0810
+
+
+
+
+ 0x0800
+ 0x800
+
+
+
+ 0x0820
+ 0x820
+
+
+
+
+
+```
+
+Some examples of actions from security tools like Mimikatz and their
+access masks
+
+ |Command |Sysmon 10 |Security 4663 Kernel Object
+ |-----------------------|---------------------------------------------------|-----------------------------
+ |lsadump::lsa /patch |GrantedAccess 0x1438 |AccessMask 0x10
+ |lsadump::lsa /inject |rantedAccess 0x143a |AccessMask 0x10
+ |lsadump::trust /patch |GrantedAccess 0x1438 |AccessMask 0x10
+ |misc:memssp |GrantedAccess 0x1438 |AccessMask 0x10
+ |Procdump mimidump |GrantedAccess 0x1fffff |AccessMask 0x10
+ |Task Manage minidump |GrantedAccess 0x1400, 0x1000, 0x1410 and 0x1fffff |AccessMask 0x10
+ |sekurlsa::\* |GrantedAccess 0x1010 |AccessMask 0x10
+
+## File Events
+
+### File Create
+
+Via its filter driver, Sysmon can log the creation of files and information on what process is creating the file using **EventID 11**. This allows defender to filter for:
+
+* Dropping of files for later execution (PowerShell, Office Apps, certutil.exe)
+
+* Modification of system configurations (Scheduled Tasks, WMI)
+
+* Detection of malicious behaviors that create temporary or log files (.Net compile and run, DotNet2JS)
+
+Since AV minifilter loads before Sysmon (due to the lower altitude number range), if an AV or EDR minifilter driver detects a malicious file and blocks it writing to disk, Sysmon will not see the event.
+
+
+
+The file creation event fields are:
+
+* **RuleName**: Name of rule that triggered the event
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ProcessGuid**: Process Guid of the process that created the file
+
+* **ProcessId**: Process ID used by the OS to identify the process that created the file (child)
+
+* **Image**: File path of the process that created the file
+
+* **TargetFilename**: Name of the file that was created
+
+* **CreationUtcTime**: File creation time
+
+Example monitoring for script file creation by extension:
+
+```XML
+
+
+
+
+
+
+ .hta
+
+
+
+
+ .bat
+ .cmd
+ .ps1
+ .ps2
+ .jse
+ .vb
+ .vbe
+ .vbs
+
+
+
+
+ .application .appref-ms
+
+
+
+
+
+ .*proj
+ .sln
+
+
+
+
+ .docm
+ .pptm
+ .xlsm
+ .xlm
+ .dotm
+ .xltm
+ .potm
+ .ppsm
+ .sldm
+ .xlam
+ .xla
+
+
+
+
+
+ AppData\Local\Microsoft\CLR_v2.0\UsageLogs\
+ \UsageLogs\cscript.exe.log
+ \UsageLogs\wscript.exe.log
+ \UsageLogs\wmic.exe.log
+ \UsageLogs\mshta.exe.log
+ \UsageLogs\svchost.exe.log
+ \UsageLogs\regsvr32.exe.log
+ \UsageLogs\rundll32.exe.log
+
+
+
+
+
+```
+
+### File Create Time Change
+
+**EventID 2** is for the technique that modifies the timestamps of a file (the modify, access, create, and change times). This is done often to mimic files that are in the same folder to hide dropped files or accessed files to prevent casual detection. Some applications modify timestamps in their normal operation. A good practice is to exclude those applications that normally change file creation times like setup executables, Chrome, OneDrive, and others. As a minimum, the Users directory should be monitored.
+
+The fields for the event:
+
+* RuleName: Name of rule that triggered the event
+
+* UtcTime: Time in UTC when the event was created
+
+* ProcessGuid: Process GUID of the process that changed the file creation time
+
+* ProcessId: Process ID used by the OS to identify the process changing the file creation time
+
+* Image: File path of the process that changed the file creation time
+
+* TargetFilename: Full path name of the file
+
+* CreationUtcTime: New creation time of the file
+
+* PreviousCreationUtcTime: Previous creation time of the file
+
+Example:
+
+```xml
+
+
+
+
+
+
+ C:\Users
+
+
+
+
+
+
+
+
+
+ OneDrive.exe
+ C:\Windows\system32\backgroundTaskHost.exe
+
+ setup
+ install
+ Update\
+ redist.exe
+ msiexec.exe
+ TrustedInstaller.exe
+
+
+
+
+
+```
+
+### File Stream Creation Hash
+
+Sysmon will log **EventID 15** for the creation of Alternate Data Streams (ADS). This is an old technique where many vendors already monitor for the creation of ADS on files where the alternate stream is a PE executable. Attackers have changed to use alternate streams to hide information and to store other payloads that are not PE executables (DLL, Scripts). Sysmon will also capture the contents of text streams if they are less 1KB for the purpose of capturing Mark Of The Web (MOTW) streams.
+
+Each record in NTFS on a drive is subdivided into a list of variable length attributes:
+
+* \$STANDARD\_INFORMATION
+
+* \$FILE\_NAME
+
+* \$DATA
+
+* \$INDEX\_ROOT
+
+* \$BITMAP
+
+* \$INDEX\_ALLOCATION
+
+* \$ATTRIBUTE\_LIST
+
+Alternate Data Streams (ADS) are implemented by having multiple \$Data
+attributes
+
+* The Default data stream is unnamed
+
+* Alternate streams are named ones.
+
+Since streams that are part of the NTFS structure directories may have an AD, we can use PowerShell to look at a file with the single default unamend :\$DATA stream:
+
+
+
+File with a second named stream:
+
+
+
+Some execution examples:
+
+* Execution Rundll32 example
+
+* Cscript Example
+
+* PowerShell Example
+
+More execution examples at
+ by
+Oddvar Moe
+
+In the case of downloads performed by browsers and email clients in Windows that leveragle the urlmon.dll for downloading files they have al indetifying stream added with information about the download including the URL and Refferer. This information can be used to track the origing of downloaded files by attackers with a console presense or via a phishing attack.
+
+We can use PowerShell Get-Item and Get-Content cmdlets to check is a Zone.Identifier stream exist and show its content.
+
+
+
+
+The fields for the event:
+
+* **RuleName**: Name of rule that triggered the event
+* **UtcTime**: Time in UTC when event was created
+* **ProcessGuid**: Process GUID of the process that created the named file stream
+* **ProcessId**: Process ID used by the OS to identify the process that created the named file stream
+* **Image**: File path of the process that created the named file stream
+* **TargetFilename**: Name of the file
+* **CreationUtcTime**: File download time
+* **Hash**: Full hash of the file with the algorithms in the HashType field
+* **Content**: Contents of text streams.
+
+
+The number of processes that create alternate streams should be low and easily excluded. Mail clients and browsers are the main generators of this event in normal operation to set the Zone attribute; Because of this, a maintenance process is recommended when leveraging these filters.
+
+
+
+Since urlmon.dll sets different parts of the stream as the file is downloaded we see normally a total of 6 events as the data is added to the file. This provides important forensic information to track files that an attacker may have delived and correlated with other networks logs.
+
+Example: Exclude common processes that create alternate data streams.
+
+```xml
+
+
+
+
+
+ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
+
+ C:\Windows\system32\browser_broker.exe
+
+ C:\Program Files\Internet Explorer\iexplore.exe
+
+ OUTLOOK.EXE
+
+
+
+
+```
+### File Delete
+
+Via its filter driver, Sysmon can log the creation of files and information on what process is deleting of overwriting the file using **EventID 23**. This allows a defender to filter for:
+
+* Dropper / stager that removes itself after execution (T1193 or T1064 and loads more) or attackers doing it manually
+
+* Wiper software (T1485 and T1488)
+
+* Ransomware (T1486)
+
+
+
+#### Archive directory
+
+By default this folder is set to Sysmon if no folder is specified during installation and specified either in the configuration either in config file with the `````` setting in XML configurations file or via the registry by setting the registry key value **FilterArchiveDirectory** under the driver registry key paramaters.
+
+On version 11.0 of Sysmon if the folder is not created during install using the commandline **-a \** parameter Sysmon will use the default **Sysmon** folder name and create that one and not the one specified in the configuration. On version 11.1 of Sysmon the parameter was removed and it is now required to specify the folder in the XML configuration file or the default name will be used.
+
+This folder is protected by a SYSTEM ACL, to access it you can use psexec to spawn a shell to access it via ```PsExec.exe -sid cmd```.
+
+```
+PS C:\> (Get-Acl C:\Sysmon\).access
+
+
+FileSystemRights : FullControl
+AccessControlType : Allow
+IdentityReference : NT AUTHORITY\SYSTEM
+IsInherited : False
+InheritanceFlags : None
+PropagationFlags : None
+```
+
+#### Event information
+
+The file delete event fields are:
+
+* **RuleName**: Name of rule that triggered the event
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ProcessGuid**: Process Guid of the process that deletec the file
+
+* **ProcessId**: Process ID used by the OS to identify the process that deleted the file (child)
+
+* **Image**: File path of the process that deleted the file
+
+* **TargetFilename**: Name of the file that was deleted
+
+**Hashes**: Full hash of the file with the algorithms in the HashType field. This is also the filename of the saved file in the ArchiveDirectory
+
+* **Archived**: States whether the archival action was succesful
+
+Example monitoring for script file creation by extension:
+
+```XML
+
+SysmonIsAwesome
+
+
+
+
+
+ \Downloads\
+
+ \Content.Outlook\
+ \AppData\Local\Temp\
+
+ \AppData\Local\Microsoft\
+ C:\Windows\Temp
+
+
+ .exe;.ps1;.js;.xls;.xlsm;.docm
+
+
+
+
+```
+
+
+## Named Pipes
+
+A named pipe is a named, one-way or duplex pipe for communication
+between the pipe server and one or more pipe clients. Each named pipe
+has a unique name that distinguishes it from other named pipes in the
+system\'s list of named objects. Pipe names are specified as
+\\\\ServerName\\pipe\\PipeName when connection is local a "." would be
+used as ServerName.
+
+Named pipes are used for pivoting in several RATs/Implants to have SMB
+connections between machines. Some tools will use named pipes to talk to
+injected code in other processes.
+
+Sysmon will generate a events
+
+* **EventID 17** when a named pipe server is created.
+
+* **EventID 18** when a client connects to a named piper server.
+
+For named pipes there are 2 approaches that can be taken:
+
+* Include all events and exclude known good.
+
+* Include only known malicious actors.
+
+The first approach requires more maintenance but in case of a breach
+offers more value. The second one would be more targeted but this kind
+of detection is better served with automation in the SIEM. Experienced
+attackers normally avoid known Pipes to prevent breaking normal
+operation of the system applications.
+
+The process for PipeName values should be constant process.
+
+
+
+Initial rule for collecting PipeEvent events
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+Collect unique PipeName field values for building filters
+
+The fields for the Pipe Create Event are:
+
+* **RuleName**: Name of rule that triggered the event.
+
+* **EventType**: ***[CreatePipe]{.underline}***
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ProcessGuid**: Process Guid of the process that created the pipe
+
+* **ProcessId**: Process ID used by the OS to identify the process
+ that created the pipe
+
+* **PipeName**: Name of the pipe created
+
+* **Image**: File path of the process that created the pipe
+
+The fields for the Pipe Connect Event are:
+
+* **RuleName**: Name of rule that triggered the event.
+
+* **EventType**: ***[ConnectPipe]{.underline}***
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ProcessGuid**: Process Guid of the process that connected the pipe
+
+* **ProcessId**: Process ID used by the OS to identify the process
+ that connected the pipe
+
+* **PipeName**: Name of the pipe connected
+
+* **Image**: File path of the process that connected the pipe
+
+Example excluding known good Pipe Names
+
+```XML
+
+
+
+
+
+
+
+ \ntapvsrq
+ \srvsvc
+ \wkssvc
+ \lsass
+ \winreg
+ \spoolss
+ Anonymous Pipe
+ c:\windows\system32\inetsrv\w3wp.exe
+
+
+ \SQLLocal\MSSQLSERVER
+ \SQLLocal\INSTANCE01
+ \SQLLocal\SQLEXPRESS
+ \SQLLocal\COMMVAULT
+ \SQLLocal\RTCLOCAL
+ \SQLLocal\RTC
+ \SQLLocal\TMSM
+ Program Files (x86)\Microsoft SQL Server\110\DTS\binn\dtexec.exe
+
+
+
+
+
+```
+
+One thing to consider is that Sysmon uses a minifilter just like the
+file events. If any AV or EDR with a lower altitude number triggers
+on a named pipe and blocks it, Sysmon will not log the event.
+
+
+## Driver Loading
+
+Sysmon will log EventID 6 for the loading of drivers. Drivers have been used by attackers for the installation of rootkits or to run tooling that needs to run at the kernel level. Mimikatz is known to use a driver to perform tasks to query and modify the UFI to bypass process protections.
+
+Sysmon will provide code signing information allowing filtering on those fields. Sysmon can also check if a certificate the driver signed has been revoked.
+
+A recommended action for this event is to filter on the **Signature** and **SignatureStatus** fields and exclude known drivers. The main reason to filter on both fields is that many of the attacks steal certificates that are later revoked. By confirming that the **SignatureStatus** is valid, we can find easier drivers signed by a vendor who has been forced to revoke that specific signing certificate.
+
+The process for Signature values should be a constant one.
+
+
+
+Initial rule for collecting DriverLoad events
+
+```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+Collect unique Signature field values for building filters
+
+The event fields are:
+
+* **RuleName**: Name of rule that triggered the event.
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ImageLoaded**: File path of the driver loaded
+
+* **Hashes**: Hashes captured by Sysmon driver
+
+* **Signed**: Is the driver loaded signed
+
+* **Signature**: Signer name of the driver
+
+* **SignatureStatus**: Status of the signature
+
+Example filtering out drivers signed by Microsoft, Intel and VMware for
+a VDI environment
+
+```xml
+
+
+
+
+
+
+
+ Microsoft
+ Valid
+
+
+
+ Intel
+ Valid
+
+
+
+ VMware
+ Valid
+
+
+
+
+
+```
+
+## Registry Actions
+
+Sysmon has the capability to monitor for three major actions against the Registry
+
+* **EventID 12** - Registry object added or deleted
+
+* **EventID 13** - Registry value set
+
+* **EventID 14** - Registry object renamed
+The Windows Registry has been a source of information gathering, persistence, storage, and configuration control for attackers since its wider use introduction in Windows NT 4.0/Windows 95.
+
+Sysmon uses abbreviated versions of Registry root key names, with the following mappings:
+
+|**Key name** |**Abbreviation** |
+|---------------------------------------------|---------------------------------
+| HKEY\_LOCAL\_MACHINE |HKLM|
+| HKEY\_USERS |HKU|
+| HKEY\_LOCAL\_MACHINE\\System\\ControlSet00x |HKLM\\System\\CurrentControlSet|
+| HKEY\_LOCAL\_MACHINE\\Classes |HKCR|
+
+Registry Add/Delete Fields:
+
+* **RuleName**: Name of rule that triggered the event
+
+* **UtcTime**: Time in UTC when event was created
+
+* **EventType**: CreateKey or DeleteKey
+
+* **ProcessGuid**: Process GUID of the process that created or deleted a registry key
+
+* **ProcessId**: Process ID used by the OS to identify the process that created or deleted a registry key
+
+* **Image**: File path of the process that created or deleted a registry key
+
+* **TargetObject**: Complete path of the registry key
+
+Registry Set Value Fields:
+
+* **RuleName**: Name of rule that triggered the event
+
+* **UtcTime**: Time in UTC when event was created
+
+* **EventType**: SetValue
+
+* **ProcessGuid**: Process GUID of the process that modified a registry value
+
+* **ProcessId**: Process ID used by the OS to identify the process that modified a registry value
+
+* **Image**: File path of the process that modified a registry value
+
+* **TargetObject**: Complete path of the modified registry key
+
+* **Details**: Details added to the registry key
+
+Registry Rename Fields:
+
+* **RuleName**: Name of rule that triggered the event
+
+* **UtcTime**: Time in UTC when event was created
+
+* **EventType**: RenameKey
+
+* **ProcessGuid**: Process GUID of the process that renamed a registry value and key
+
+* **ProcessId**: Process ID used by the OS to identify the process that renamed a registry value and key
+
+* **Image**: File path of the process that renamed a registry value and key
+
+* **TargetObject**: Complete path of the renamed registry key
+
+* **NewName**: New name of the registry key
+
+This event type is better used in a targeted manner given the size of the registry and how it is used by a multitude of processes on a daily basis in Windows.
+
+In registry events, the value name is appended to the full key path with a \"\\\" delimiter.
+
+Default key values are named \"\\(Default)\"
+
+When filtering for keys or values in HKCU, use **contains** or **ends with** when filtering against **TargetObject** since the SID of the user is appended after the Hive name.
+
+
+
+
+
+Since the value name is appended when specifying a registry path in **TargetObject**, where we also want to catch modification of values under the key, the **contains** operator is better suited than **ends with**. For value events, the **Detail** element of the event will contain the type of value.
+
+Sysmon does not log the actual value being set nor a previous or new one being modified.
+
+
+
+Example of monitoring some AutoRun locations
+
+```xml
+
+
+
+
+
+ \CurrentVersion\Run
+ \Group Policy\Scripts
+ \Windows\System\Scripts
+ \Policies\Explorer\Run
+ \ServiceDll
+ \ImagePath
+ \Start
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
+ HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
+ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
+ \Explorer\FileExts
+ \shell\install\command
+ \shell\open\command
+ \shell\open\ddeexec
+ Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup
+
+
+
+
+```
+
+## Image Loading
+
+Sysmon will log **EventID 7** for the loading of images (Components like DLL, OCX..) by a given process. This filter can cause high CPU usage if filtering is to open on desktop or terminal systems with lots of process starting and stopping, because of this event is best targeted by monitoring for specific libraries or combinations used by attackers.
+
+The event fields are:
+
+* **RuleName**: Name of rule that triggered the event.
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ProcessGuid**: Process Guid of the process that loaded the image
+
+* **ProcessId**: Process ID used by the OS to identify the process that loaded the image
+
+* **Image**: File path of the process that loaded the image
+
+* **ImageLoaded**: Path of the image loaded
+
+* **FileVersion**: Version of the image loaded
+
+* **Description**: Description of the image loaded
+
+* **Product**: Product name the image loaded belongs to
+
+* **Company**: Company name the image loaded belongs to
+
+* **OriginalFileName**: OriginalFileName from the PE header, added on compilation
+
+* **Hashes**: Full hash of the file with the algorithms in the HashType field
+
+* **Signed**: State whether the image loaded is signed
+
+* **Signature**: The signer name
+
+* **SignatureStatus**: status of the signature
+
+Example of libraries leveraged by attackers
+
+```xml
+
+
+
+
+
+
+
+ jscript9.dll
+ mshta.exe
+
+
+
+ wshom.ocx
+ scrrun.dll
+ vbscript.dll
+
+
+
+ System.Management.Automation.ni.dll
+ System.Management.Automation.dll
+
+
+
+ scrobj.dll
+
+
+
+
+
+```
+
+## Network Connections
+
+Sysmon will log **EventID 3** for all TCP and UDP network connections. This event will generate a large number of entries and filtering should be tuned for specific processes and ports.
+
+For the DestinationHostname, the GetNameInfo API is used and it will often not have any information and may just be a CDN, making it NOT reliable for filtering since it uses a reverse DNS Lookup to get this information, in Sysmon v11.0 this behaviour can be disabled by using the ```True``` at the root of the confifuration file.
+
+For the DestinationPortName, the GetNameInfo API is used for the friendly name of ports. In the case of services doing connections on some systems due to memory use, they are hosted under svchost.exe and most connections will originate from this process.
+
+The fields for the event are:
+
+* **RuleName**: Name of rule that triggered the event
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ProcessGuid**: Process GUID of the process that made the network connection
+
+* **ProcessId**: Process ID used by the OS to identify the process that made the network connection
+
+* **Image**: File path of the process that made the network connection
+
+* **User**: Name of the account who made the network connection
+
+* **Protocol**: Protocol being used for the network connection
+
+* **Initiated**: Indicated process-initiated TCP connection
+
+* **SourceIsIpv6**: Is the source IP an Ipv6
+
+* **SourceIp**: Source IP address that made the network connection
+
+* **SourceHostname**: DNS name of the host that made the network connection
+
+* **SourcePort**: Source port number
+
+* **SourcePortName**: Name of the source port being used
+
+* **DestinationIsIpv6**: Is the destination IP an Ipv6
+
+* **DestinationIp**: IP address destination
+
+* **DestinationHostname**: DNS name of the host that is contacted
+
+* **DestinationPort**: Destination port number
+
+* **DestinationPortName**: Name of the destination port
+
+
+Example tracking connections for attacker "Living off the land"
+
+```xml
+
+
+
+
+
+
+ at.exe
+
+ certutil.exe
+
+ cmd.exe
+
+ cscript.exe
+
+ java.exe
+
+ mshta.exe
+
+ msiexec.exe
+
+
+ net.exe
+
+ notepad.exe
+
+ powershell.exe
+
+ reg.exe
+
+ regsvr32.exe
+
+ rundll32.exe
+
+ sc.exe
+
+ wmic.exe
+
+ wscript.exe
+
+ driverquery.exe
+
+ dsquery.exe
+
+ hh.exe
+
+ infDefaultInstall.exe
+
+ javaw.exe
+
+ javaws.exe
+
+ mmc.exe
+
+ msbuild.exe
+
+ nbtstat.exe
+
+
+ net1.exe
+
+ nslookup.exe
+
+ qprocess.exe
+
+ qwinsta.exe
+
+ regsvcs.exe
+
+ rwinsta.exe
+
+ schtasks.exe
+
+ taskkill.exe
+
+ tasklist.exe
+ replace.exe
+
+
+
+
+```
+
+## Create Remote Thread
+
+Sysmon will log **EventID 8** for all processes that use the Win32 API
+[CreateRemoteThread](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread)
+call.
+
+This call is used by some programs, parts of the OS and debuggers making
+the number of events easy to filter out the normal usages to detect the
+outliers.
+
+Process of use/abuse of CreateRemoteThread
+
+* Use **OpenProcess( )** to open a target process.
+
+* Use **VirtualAllocEx( )** allocate a chunk of memory in the process.
+
+* Use **WriteProcessMemory( )** write the payload to the newly
+ allocated section.
+
+* User **CreateRemoteThread( )** to create a new thread in the remote
+ process to execute the shellcode.
+
+There are multiple Process Injection techniques, Sysmon monitors for the
+most common one used. The infographic from
+
+
+Illustrates the different techniques.
+
+
+
+The fields for the event are:
+
+* **RuleName**: Name of rule that triggered the event.
+
+* **UtcTime**: Time in UTC when event was created
+
+* **SourceProcessGuid**: Process Guid of the source process that
+ created a thread in another process
+
+* **SourceProcessId**: Process ID used by the OS to identify the
+ source process that created a thread in another process
+
+* **SourceImage**: File path of the source process that created a
+ thread in another process
+
+* **TargetProcessGuid**: Process Guid of the target process
+
+* **TargetProcessId**: Process ID used by the OS to identify the
+ target process
+
+* **TargetImage**: File path of the target process
+
+* **NewThreadId**: Id of the new thread created in the target process
+
+* **StartAddress**: New thread start address
+
+* **StartModule**: Start module determined from thread start address
+ mapping to PEB loaded module list
+
+* **StartFunction**: Start function is reported if exact match to
+ function in image export tables
+
+Since the number of processes that use the **CreateRemoteThread()** API in a production environment is low, the best approach is to exclude known good processes by their full path. **CreateRemoteThread()** is not the only API call that can be used to create a thread, so it should not be relied on as a definitive guarantee of lack of process injection.
+
+
+
+Example where known processes that use the API call are excluded
+
+```xml
+
+
+
+
+
+
+
+
+ Google\Chrome\Application\chrome.exe
+
+
+ C:\Windows\System32\wbem\WmiPrvSE.exe
+
+
+ C:\Windows\System32\svchost.exe
+
+
+ C:\Windows\System32\wininit.exe
+
+
+ C:\Windows\System32\csrss.exe
+
+
+ C:\Windows\System32\services.exe
+
+
+ C:\Windows\System32\winlogon.exe
+
+
+ C:\Windows\System32\audiodg.exe
+
+
+ C:\windows\system32\kernel32.dll
+
+
+
+
+
+```
+
+
+## Raw Access Read
+
+Sysmon will log **EventID 9** for any process trying to read straight from a storage device by bypassing any filesystem restrictions that may be imposed by it. This information is logged by Sysmon leveraging its minifilter. This type of action is only done by drive imaging software or backup software in a normal operating environment.
+
+Attackers have been known to use this technique to copy NTDS.dit and SAM Registry Hives off host for the purpose of credential harvesting.
+
+The fields for the event are:
+
+* **RuleName**: Name of rule that triggered the event
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ProcessGuid**: Process GUID of the process that conducted reading operations from the drive
+
+* **ProcessId**: Process ID used by the OS to identify the process that conducted reading operations from the drive
+
+* **Image**: File path of the process that conducted reading operations from the drive
+
+* **Device**: Target device
+
+Given that no process should be performing this action normally, it is best to log all instances of it or, even better, to target the NTDS.dit file on domain controllers and SAM hive file on all systems. On systems with many file modifications, slightly higher resource usage may result if monitoring is enabled for all files.
+
+Example that captures all instances of this event
+
+
+
+## DNS Query
+
+Sysmon will log EventID 22 to log all DNS Queries using the Windows DnsQuery_* API calls in **dnsapi.dll**. Logging is supported on Windows 8.1 or above since it leverages new ETW functionality in newer versions of Windows. Programs that do their own DNS resolution and do not use the Windows API calls will not be logged
+
+The fields for the event are:
+
+* **RuleName**: Name of rule that triggered the event.
+
+* **UtcTime**: Time in UTC when event was created
+
+* **ProcessGuid**: Process Guid of the process that made the DNS query
+
+* **ProcessId**: Process ID of the process that made the DNS query
+
+* **QueryName**: DNS name that was queries
+
+* **QueryStatus**: Query result status code
+
+* **QueryResults**: Query results
+
+* **Image**: File path of the process that made the DNS query
+Exclude known destinations in order to focus on new unknown destinations. This is a high-volume event generation filter, so it is recommended to experiment and build rules with filters for your specific environment if implemented. Some examples can be found in
+
+
+Example that excludes known update and telemetry domains.
+
+```xml
+
+
+ *
+
+
+
+
+
+
+
+
+ .mozaws.net
+
+
+ .mozilla.com
+
+
+ .mozilla.net
+
+
+ .mozilla.org
+
+
+
+
+ clients1.google.com
+
+
+ clients2.google.com
+
+
+ clients3.google.com
+
+
+ clients4.google.com
+
+
+ clients5.google.com
+
+
+ clients6.google.com
+
+
+ safebrowsing.googleapis.com
+
+
+
+
+
+ -pushp.svc.ms
+
+
+ .b-msedge.net
+
+
+
+ .bing.com
+
+
+ .hotmail.com
+
+
+ .live.com
+
+
+ .live.net
+
+
+ .s-microsoft.com
+
+
+ .microsoft.com
+
+
+ .microsoftonline.com
+
+
+ .microsoftstore.com
+
+
+ .ms-acdc.office.com
+
+
+ .msedge.net
+
+
+ .msn.com
+
+
+ .msocdn.com
+
+
+ .skype.com
+
+
+ .skype.net
+
+
+ .windows.com
+
+
+ .windows.net.nsatc.net
+
+
+ .windowsupdate.com
+
+
+ .xboxlive.com
+
+
+ login.windows.net
+
+
+
+
+
+```
+
+
+## WMI Events
+
+WMI events, both temporary and permanent (survive a reboot), have been used for
+over a decade by vendors and enterprise users to automate actions on systems.
+Attackers leverage events in the same manner for automating actions and for
+persistence. Attackers will create or modify existing event components (APT 28,
+29) on systems for which they gain administrator privilege. WMI events are those
+events that happen when a specific Event Class instance is created or they are
+modified in the WMI Model.
+
+An attacker can monitor (and take certain actions) when these events occur by
+using subscriptions that monitor for them.
+
+There are two types of WMI Event Subscriptions:
+
+* **Temporary** - Subscription is active as long as the process that created the subscription is active (They run under the privilege of the process)
+
+* **Permanent** - Subscription is stored in the CIM Database and is active until removed from it (They always run as SYSTEM)
+
+All event subscriptions have three components:
+
+* **Filter** - WQL Query for the events we want
+
+* **Consumer** - An action to take upon triggering the filter
+
+* **Binding** - Registers a filter to a consumer
+
+The filter and consumer are created individually and then registered together.
+The actions that Sysmon filters on are those for permanent events. Sysmon will
+only log **ActiveScript** and **CommandLine** consumers since these are the ones
+abused by attackers.
+
+Fields for the Filter creation, modification, or deletion are:
+
+* **RuleName**: Rule name for filter
+
+* **EventType**: Will always be *WmiFilterEvent*
+
+* **UtcTime**: Time event happened
+
+* **Operation**: Created, modified or deleted
+
+* **User**: User that performed the action
+
+* **EventNamespace**: WMI Namespace where object was created
+
+* **Name**: Name of the filter
+
+* **Query**: Query defined for the filter
+
+The fields for Consumer creation, modification, or deletion are:
+
+* **RuleName**: Rule name for filter
+
+* **EventType**: Will always be *WmiConsumerEvent*
+
+* **UtcTime**: Time event happened
+
+* **Operation**: Created, modified, or deleted
+
+* **User**: User that performed the action
+
+* **Name**: Name of the consumer
+
+* **Type**: Type of consumer
+
+* **Destination**: Command or Script being executed
+
+The fields for filter to consumer binding are:
+
+* **RuleName**: Rule name for filter
+
+* **EventType**: Will always be *WmiBindingEvent*
+
+* **UtcTime**: Time event happened
+
+* **Operation**: Created, modified, or deleted
+
+* **User**: User that performed the action
+
+* **Consumer**: Consumer path in the CIM Database
+
+* **Filter**: Filter path in the CIM Database
+
+When a Permanent Event Subscription is created, an EventID **5861** in
+**Microsoft-Windows-WMI-Activity/Operational** is created in **Windows 2012 R2,
+Windows 2016,** and **Windows 10 Pro/Enterprise**.
+
+The event includes the Query and Consumer object information for the
+subscription in its data.
+
+
+
+It is recommended to log all instances of this event type.
+
+```XML
+
+
+ *
+
+
+
+
+
+
+
+
+```
diff --git a/Build/bullet_style.tex b/Build/bullet_style.tex
new file mode 100644
index 0000000..be0d10a
--- /dev/null
+++ b/Build/bullet_style.tex
@@ -0,0 +1,14 @@
+% https://stackoverflow.com/questions/22156999/how-to-change-the-style-of-bullets-in-pandoc-markdown
+
+\usepackage{enumitem}
+\usepackage{amsfonts}
+
+\setlist[itemize,1]{label=$\bullet$}
+\setlist[itemize,2]{label=$\circ$}
+\setlist[itemize,3]{label=$\star$}
+
+%% \setlist[itemize,2]{label=$\diamond$}
+%% \setlist[itemize,1]{label=$\star$}
+%% \setlist[itemize,1]{label=$\bullet$}
+%% \setlist[itemize,1]{label=$\checkmark$}
+
diff --git a/Build/chapter_break.tex b/Build/chapter_break.tex
new file mode 100644
index 0000000..5954354
--- /dev/null
+++ b/Build/chapter_break.tex
@@ -0,0 +1,10 @@
+%% Adds pagebreak between chapters
+% from comments of accepted answer
+% https://superuser.com/questions/601469/getting-chapters-to-start-on-a-new-page-in-a-pandoc-generated-pdf
+\usepackage{sectsty}
+\sectionfont{\clearpage}
+
+% accepted answer gave error
+%\usepackage{titlesec}
+%\newcommand{\sectionbreak}{\clearpage}
+
diff --git a/Build/inline_code.tex b/Build/inline_code.tex
new file mode 100644
index 0000000..fbb5952
--- /dev/null
+++ b/Build/inline_code.tex
@@ -0,0 +1,13 @@
+%% https://stackoverflow.com/questions/40975004/pandoc-latex-change-backtick-highlight
+\usepackage{fancyvrb,newverbs,xcolor}
+
+%\definecolor{Light}{gray}{.90}
+%% https://martin-thoma.com/colors-in-latex/
+%% https://en.wikibooks.org/wiki/LaTeX/Colors
+\definecolor{Light}{HTML}{F4F4F4}
+
+\let\oldtexttt\texttt
+\renewcommand{\texttt}[1]{
+ \colorbox{Light}{\oldtexttt{#1}}
+}
+
diff --git a/Build/listings-setup.tex b/Build/listings-setup.tex
new file mode 100644
index 0000000..933439f
--- /dev/null
+++ b/Build/listings-setup.tex
@@ -0,0 +1,113 @@
+\lstset{
+ basicstyle=\ttfamily,
+ numbers=left,
+ numberstyle=\footnotesize,
+ stepnumber=1,
+ numbersep=5pt,
+ backgroundcolor=\color[RGB]{248,248,248},
+ showspaces=false,
+ showstringspaces=false,
+ showtabs=false,
+ tabsize=2,
+ captionpos=b,
+ breaklines=true,
+ breakatwhitespace=true,
+ breakautoindent=true,
+ escapeinside={\%*}{*)},
+ linewidth=\textwidth,
+ basewidth=0.5em,
+ postbreak=\mbox{\textcolor{red}{$\hookrightarrow$}\space},
+}
+
+\definecolor{maroon}{rgb}{0.5,0,0}
+\definecolor{darkgreen}{rgb}{0,0.5,0}
+
+\lstdefinelanguage{XML}
+{
+ basicstyle=\ttfamily,
+ morestring=[s]{"}{"},
+ morecomment=[s]{?}{?},
+ morecomment=[s]{!--}{--},
+ commentstyle=\color{darkgreen},
+ moredelim=[s][\color{black}]{>}{<},
+ moredelim=[s][\color{red}]{\ }{=},
+ stringstyle=\color{blue},
+ identifierstyle=\color{maroon}
+}
+
+\definecolor{dkgreen}{rgb}{0,0.6,0}
+\definecolor{ltgray}{rgb}{0.5,0.5,0.5}
+
+\usepackage{listings}
+\lstset{%
+ backgroundcolor=\color{white},
+ basicstyle=\footnotesize,
+ breakatwhitespace=false,
+ breaklines=true,
+ captionpos=b,
+ commentstyle=\color{dkgreen},
+ deletekeywords={...},
+ escapeinside={\%*}{*)},
+ extendedchars=true,
+ frame=single,
+ keepspaces=true,
+ keywordstyle=\color{blue},
+ language=SQL,
+ morekeywords={*,modify,MODIFY,...},
+ numbers=left,
+ numbersep=15pt,
+ numberstyle=\tiny,
+ rulecolor=\color{ltgray},
+ showspaces=false,
+ showstringspaces=false,
+ showtabs=false,
+ stepnumber=1,
+ tabsize=4,
+ title=\lstname
+}
+
+\lstdefinelanguage{powershell}{
+ morekeywords={Add-Content,Add-PSSnapin,Clear-Content,%
+ Clear-History,Clear-Host,Clear-Item,%
+ Clear-ItemProperty,Clear-Variable,%
+ Compare-Object,Connect-PSSession,ConvertFrom-String,%
+ Convert-Path,Copy-Item,Copy-ItemProperty,%
+ Disable-PSBreakpoint,Disconnect-PSSession,%
+ Enable-PSBreakpoint,Enter-PSSession,Exit-PSSession,%
+ Export-Alias,Export-Csv,Export-PSSession,ForEach-Object,%
+ Format-Custom,Format-Hex,Format-List,Format-Table,%
+ Format-Wide,Get-Alias,Get-ChildItem,Get-Clipboard,%
+ Get-Command,Get-ComputerInfo,Get-Content,Get-History,%
+ Get-Item,Get-ItemProperty,Get-ItemPropertyValue,Get-Job,%
+ Get-Location,Get-Member,Get-Module,Get-Process,%
+ Get-PSBreakpoint,Get-PSCallStack,Get-PSDrive,Get-PSSession,%
+ Get-PSSnapin,Get-Service,Get-TimeZone,Get-Unique,Get-Variable,%
+ Get-WmiObject,Group-Object,help,Import-Alias,Import-Csv,%
+ Import-Module,Import-PSSession,Invoke-Command,Invoke-Expression,%
+ Invoke-History,Invoke-Item,Invoke-RestMethod,Invoke-WebRequest,%
+ Invoke-WmiMethod,Measure-Object,mkdir,Move-Item,Move-ItemProperty,%
+ New-object,New-Alias,New-Item,New-Module,New-PSDrive,New-PSSession,%
+ New-PSSessionConfigurationFile,New-Variable,Out-GridView,%
+ Out-Host,Out-Printer,Pop-Location,powershell_ise.exe,%
+ Push-Location,Receive-Job,Receive-PSSession,Remove-Item,%
+ Remove-ItemProperty,Remove-Job,Remove-Module,Remove-PSBreakpoint,%
+ Remove-PSDrive,Remove-PSSession,Remove-PSSnapin,Remove-Variable,%
+ Remove-WmiObject,Rename-Item,Rename-ItemProperty,Resolve-Path,%
+ Resume-Job,Select-Object,Select-String,Set-Alias,Set-Clipboard,%
+ Set-Content,Set-Item,Set-ItemProperty,Set-Location,%
+ Set-PSBreakpoint,Set-TimeZone,Set-Variable,Set-WmiInstance,%
+ Show-Command,Sort-Object,Start-Job,Start-Process,Start-Service,%
+ Start-Sleep,Stop-Job,Stop-Process,Stop-Service,Suspend-Job,%
+ Tee-Object,Trace-Command,Wait-Job,Where-Object,Write-Output%
+ },
+ morekeywords={Do,Else,For,ForEach,Function,If,In,Until,While},
+ alsodigit={-},
+ sensitive=false,
+ morecomment=[l]{\#},
+ morecomment=[n]{<\#}{\#>},
+ morestring=[b]{"},
+ morestring=[b]{'},
+ morestring=[s]{@'}{'@},
+ morestring=[s]{@"}{"@}
+}
+
diff --git a/Build/md2pdf.sh b/Build/md2pdf.sh
new file mode 100644
index 0000000..bb1e95a
--- /dev/null
+++ b/Build/md2pdf.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+# Script based on https://learnbyexample.github.io/tutorial/ebook-generation/customizing-pandoc/
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+pandoc "$tfl" \
+ -f gfm \
+ --toc \
+ --listings \
+ --include-in-header ${SCRIPTPATH}/Build/chapter_break.tex \
+ --include-in-header ${SCRIPTPATH}/Build/inline_code.tex \
+ --include-in-header ${SCRIPTPATH}/Build/bullet_style.tex \
+ --include-in-header ${SCRIPTPATH}/Build/pdf_properties.tex \
+ --include-in-header ${SCRIPTPATH}/Build/listings-setup.tex \
+ --highlight-style ${SCRIPTPATH}/Build/pygments.theme \
+ -V toc-title='Table of contents' \
+ -V linkcolor:blue \
+ -V geometry:a4paper \
+ -V geometry:margin=2cm \
+ -V mainfont="DejaVu Serif" \
+ -V monofont="DejaVu Sans Mono" \
+ --pdf-engine=xelatex \
+ -o temp.tex
+
+fn="${2%.*}"
+
+perl -0777 -pe 's/begin\{document\}\n\n\K(.*?^\}$)(.+?)\n/$2\n\\thispagestyle{empty}\n\n$1\n/ms' temp.tex > ${fn}.tex
+
+xelatex ${SCRIPTPATH}/${fn}.tex &> /dev/null
+xelatex ${SCRIPTPATH}/${fn}.tex &> /dev/null
+
+rm temp.tex "$fn".{tex,toc,aux,log}
+
+
diff --git a/Build/metadata.yml b/Build/metadata.yml
new file mode 100644
index 0000000..87bf745
--- /dev/null
+++ b/Build/metadata.yml
@@ -0,0 +1,13 @@
+---
+title: "Sysmon Missing Manual"
+author: "Carlos Perez"
+rights: "TrustedSec LLC, Creative Commons Non-Commercial Share Alike 4.0"
+language: "en-US"
+subtitle: Open Source Sysinternals Sysmon Community Guide
+date: 28.01.2020
+publisher: TrustedSec Inc.
+ibooks:
+ version: 1.0
+stylesheet: pandoc.css
+cover-image: media/cover.png
+---
\ No newline at end of file
diff --git a/Build/pandoc.css b/Build/pandoc.css
new file mode 100644
index 0000000..8b9903f
--- /dev/null
+++ b/Build/pandoc.css
@@ -0,0 +1,328 @@
+/*
+ * I add this to html files generated with pandoc.
+ */
+
+html {
+ font-size: 100%;
+ overflow-y: scroll;
+ -webkit-text-size-adjust: 100%;
+ -ms-text-size-adjust: 100%;
+}
+
+body {
+ color: #444;
+ font-family: Georgia, Palatino, 'Palatino Linotype', Times, 'Times New Roman', serif;
+ font-size: 12px;
+ line-height: 1.7;
+ padding: 1em;
+ margin: auto;
+ max-width: 42em;
+ background: #fefefe;
+}
+
+a {
+ color: #0645ad;
+ text-decoration: none;
+}
+
+a:visited {
+ color: #0b0080;
+}
+
+a:hover {
+ color: #06e;
+}
+
+a:active {
+ color: #faa700;
+}
+
+a:focus {
+ outline: thin dotted;
+}
+
+*::-moz-selection {
+ background: rgba(255, 255, 0, 0.3);
+ color: #000;
+}
+
+*::selection {
+ background: rgba(255, 255, 0, 0.3);
+ color: #000;
+}
+
+a::-moz-selection {
+ background: rgba(255, 255, 0, 0.3);
+ color: #0645ad;
+}
+
+a::selection {
+ background: rgba(255, 255, 0, 0.3);
+ color: #0645ad;
+}
+
+p {
+ margin: 1em 0;
+}
+
+img {
+ max-width: 100%;
+}
+
+h1, h2, h3, h4, h5, h6 {
+ color: #111;
+ line-height: 125%;
+ margin-top: 2em;
+ font-weight: normal;
+}
+
+h4, h5, h6 {
+ font-weight: bold;
+}
+
+h1 {
+ font-size: 2.5em;
+}
+
+h2 {
+ font-size: 2em;
+}
+
+h3 {
+ font-size: 1.5em;
+}
+
+h4 {
+ font-size: 1.2em;
+}
+
+h5 {
+ font-size: 1em;
+}
+
+h6 {
+ font-size: 0.9em;
+}
+
+blockquote {
+ color: #666666;
+ margin: 0;
+ padding-left: 3em;
+ border-left: 0.5em #EEE solid;
+}
+
+hr {
+ display: block;
+ height: 2px;
+ border: 0;
+ border-top: 1px solid #aaa;
+ border-bottom: 1px solid #eee;
+ margin: 1em 0;
+ padding: 0;
+}
+
+pre, code, kbd, samp {
+ color: #000;
+ font-family: monospace, monospace;
+ _font-family: 'courier new', monospace;
+ font-size: 0.98em;
+}
+
+pre {
+ white-space: pre;
+ white-space: pre-wrap;
+ word-wrap: break-word;
+}
+
+b, strong {
+ font-weight: bold;
+}
+
+dfn {
+ font-style: italic;
+}
+
+ins {
+ background: #ff9;
+ color: #000;
+ text-decoration: none;
+}
+
+mark {
+ background: #ff0;
+ color: #000;
+ font-style: italic;
+ font-weight: bold;
+}
+
+sub, sup {
+ font-size: 75%;
+ line-height: 0;
+ position: relative;
+ vertical-align: baseline;
+}
+
+sup {
+ top: -0.5em;
+}
+
+sub {
+ bottom: -0.25em;
+}
+
+ul, ol {
+ margin: 1em 0;
+ padding: 0 0 0 2em;
+}
+
+li p:last-child {
+ margin-bottom: 0;
+}
+
+ul ul, ol ol {
+ margin: .3em 0;
+}
+
+dl {
+ margin-bottom: 1em;
+}
+
+dt {
+ font-weight: bold;
+ margin-bottom: .8em;
+}
+
+dd {
+ margin: 0 0 .8em 2em;
+}
+
+dd:last-child {
+ margin-bottom: 0;
+}
+
+img {
+ border: 0;
+ -ms-interpolation-mode: bicubic;
+ vertical-align: middle;
+}
+
+figure {
+ display: block;
+ text-align: center;
+ margin: 1em 0;
+}
+
+figure img {
+ border: none;
+ margin: 0 auto;
+}
+
+figcaption {
+ font-size: 0.8em;
+ font-style: italic;
+ margin: 0 0 .8em;
+}
+
+table {
+ margin-bottom: 2em;
+ border-bottom: 1px solid #ddd;
+ border-right: 1px solid #ddd;
+ border-spacing: 0;
+ border-collapse: collapse;
+}
+
+table th {
+ padding: .2em 1em;
+ background-color: #eee;
+ border-top: 1px solid #ddd;
+ border-left: 1px solid #ddd;
+}
+
+table td {
+ padding: .2em 1em;
+ border-top: 1px solid #ddd;
+ border-left: 1px solid #ddd;
+ vertical-align: top;
+}
+
+.author {
+ font-size: 1.2em;
+ text-align: center;
+}
+
+@media only screen and (min-width: 480px) {
+ body {
+ font-size: 14px;
+ }
+}
+@media only screen and (min-width: 768px) {
+ body {
+ font-size: 16px;
+ }
+}
+@media print {
+ * {
+ background: transparent !important;
+ color: black !important;
+ filter: none !important;
+ -ms-filter: none !important;
+ }
+
+ body {
+ font-size: 12pt;
+ max-width: 100%;
+ }
+
+ a, a:visited {
+ text-decoration: underline;
+ }
+
+ hr {
+ height: 1px;
+ border: 0;
+ border-bottom: 1px solid black;
+ }
+
+ a[href]:after {
+ content: " (" attr(href) ")";
+ }
+
+ abbr[title]:after {
+ content: " (" attr(title) ")";
+ }
+
+ .ir a:after, a[href^="javascript:"]:after, a[href^="#"]:after {
+ content: "";
+ }
+
+ pre, blockquote {
+ border: 1px solid #999;
+ padding-right: 1em;
+ page-break-inside: avoid;
+ }
+
+ tr, img {
+ page-break-inside: avoid;
+ }
+
+ img {
+ max-width: 100% !important;
+ }
+
+ @page :left {
+ margin: 15mm 20mm 15mm 10mm;
+}
+
+ @page :right {
+ margin: 15mm 10mm 15mm 20mm;
+}
+
+ p, h2, h3 {
+ orphans: 3;
+ widows: 3;
+ }
+
+ h2, h3 {
+ page-break-after: avoid;
+ }
+}
diff --git a/Build/pdf_properties.tex b/Build/pdf_properties.tex
new file mode 100644
index 0000000..f27538b
--- /dev/null
+++ b/Build/pdf_properties.tex
@@ -0,0 +1,11 @@
+% https://tex.stackexchange.com/questions/23235/eliminate-edit-pdf-properties-added-by-pdflatex
+
+\usepackage{hyperref}
+
+\hypersetup{
+ pdftitle={Sysmon Community Guide},
+ pdfauthor={Carlo Perez},
+ pdfsubject={Sysinternals Sysmon},
+ pdfkeywords={Sysmon}
+}
+
diff --git a/Build/pygments.theme b/Build/pygments.theme
new file mode 100644
index 0000000..338a12c
--- /dev/null
+++ b/Build/pygments.theme
@@ -0,0 +1,211 @@
+{
+ "text-color": null,
+ "background-color": "#f8f8f8",
+ "line-number-color": "#aaaaaa",
+ "line-number-background-color": null,
+ "text-styles": {
+ "Other": {
+ "text-color": "#007020",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Attribute": {
+ "text-color": "#7d9029",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "SpecialString": {
+ "text-color": "#bb6688",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Annotation": {
+ "text-color": "#60a0b0",
+ "background-color": null,
+ "bold": true,
+ "italic": true,
+ "underline": false
+ },
+ "Function": {
+ "text-color": "#06287e",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "String": {
+ "text-color": "#4070a0",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "ControlFlow": {
+ "text-color": "#007020",
+ "background-color": null,
+ "bold": true,
+ "italic": false,
+ "underline": false
+ },
+ "Operator": {
+ "text-color": "#666666",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Error": {
+ "text-color": "#ff0000",
+ "background-color": null,
+ "bold": true,
+ "italic": false,
+ "underline": false
+ },
+ "BaseN": {
+ "text-color": "#40a070",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Alert": {
+ "text-color": "#ff0000",
+ "background-color": null,
+ "bold": true,
+ "italic": false,
+ "underline": false
+ },
+ "Variable": {
+ "text-color": "#19177c",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "BuiltIn": {
+ "text-color": null,
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Extension": {
+ "text-color": null,
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Preprocessor": {
+ "text-color": "#bc7a00",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Information": {
+ "text-color": "#60a0b0",
+ "background-color": null,
+ "bold": true,
+ "italic": true,
+ "underline": false
+ },
+ "VerbatimString": {
+ "text-color": "#4070a0",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Warning": {
+ "text-color": "#60a0b0",
+ "background-color": null,
+ "bold": true,
+ "italic": true,
+ "underline": false
+ },
+ "Documentation": {
+ "text-color": "#ba2121",
+ "background-color": null,
+ "bold": false,
+ "italic": true,
+ "underline": false
+ },
+ "Import": {
+ "text-color": null,
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Char": {
+ "text-color": "#4070a0",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "DataType": {
+ "text-color": "#902000",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Float": {
+ "text-color": "#40a070",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Comment": {
+ "text-color": "#9c9c9c",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "CommentVar": {
+ "text-color": "#60a0b0",
+ "background-color": null,
+ "bold": true,
+ "italic": true,
+ "underline": false
+ },
+ "Constant": {
+ "text-color": "#880000",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "SpecialChar": {
+ "text-color": "#4070a0",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "DecVal": {
+ "text-color": "#40a070",
+ "background-color": null,
+ "bold": false,
+ "italic": false,
+ "underline": false
+ },
+ "Keyword": {
+ "text-color": "#007020",
+ "background-color": null,
+ "bold": true,
+ "italic": false,
+ "underline": false
+ }
+ }
+}