Posh-Sysmon

PowerShell 3.0 or above module for creating and managing Sysinternals Sysmon v2.0 config files. System Monitor (Sysmon) is a Windows system service and device driver that is part of the SysInternal tools from Microsoft. It is written by Mark Russinovich and Thomas Garnier to monitor a Windows system actions and log such actions in to the Windows Event Log. When the tool is installed on a system it can be given a XML configuration file so as to control what is logged and the same file can be used to update the configuration of a previously installed instance of the tool.

All functions in the PowerShell module include help information and example of usage that can be view using the Get-Help cmdlet.

Installation

For installation it is highly recomended that you install from the PowerShell Gallery using the Install-Module cmdlet.

On PowerShell v5 and above:

Install-Module -Name Posh-Sysmon

If you are running PS 3.0 to 4.0 you can use the PowerShell Gallery also following instruction in PowerShell Gallery Documentation

Change Log

Version 1.2

Module only supports the last 2 Schema versions.[Breaking Change]
Support for Sysmon 8.0 Schema version 4.1 RuleName
Fixed issue when adding a filter for a none existing rule. It will properly error now.

Version 1.0

Module only supports the last 2 Schema versions.[Breaking Change]
Support for Sysmon 7.0 Schema version 4.0
Added new fields for filtering introduced in Sysmon 7.0.
Modified organization of functions in to their own files for better management while coding.
Fixed typo in the enabling of rules in rule creation.

Version 0.7.6

Support for Schema 3.4 of Sysmon v6.2
New function New-SysmonWmiEvent.
Updated Rule and Filter functions for WmiEvents.
Fixed where some functions did not support PipeEvents.

Version 0.7.5

Support for Schema 3.3 of Sysmon v6.
New function New-SysmonPipeEvent for filtering for named pipeline cration and connection events.
Support of PipeEvent in config creation and event type functions.
Several bug fixes on filtering functions when give an array of values.

Version 0.7.3

Several bug fixes when creating RawAccess and ProcessOpen rules.
By default the new schema is 3.2 for the latest version of Sysmon 5.0
New-SysmonConfiguration function has options to enable all logging for FileCreate, RegistryEvent and FileCreateStreamHash
Get-SysmonEventData can now parse File Create, Registry and File Stream creation events.
New function New-SysmonFileCreateFilter for creating file creation filters.
New function New-SysmonRegistryEvent for creating registry event filters.
New function New-SysmonFileCreateStreamHash for creating file stream hash event filters.
Updated Get-SysmonRule, Set-SysmonRule, Remove-SysmonRule and Remove-SysmonRuleFilter for the new event type rules.
Added Online Help option for all functions.

Version 0.7.2

Added missing Event Types to Get-SysmonEventData.

Version 0.7.1

Fixed issue with conditions with filters with space in them.

Version 0.7

Added support for ProcessAccess filtering added in Sysmon 4.1
Added function New-SysmonProcessAccess for creating ProcessAccess filters.
Fixed issue where command was displayed and not ran with New-SysmonDriverLoadFilter.
Added ProcessAccess type in Get-SysmonEventData and Get-SysmonRuleFilter.
In verbose output it shows with what version of Sysmon the file will be compatible with after creating it.

Version 0.6

Added support for Sysmon 4.0 XML schemea (Schema version 3.0)
One can select the version of schema to support when creating the configuration file.
All functions have been updated to support the use of more than one rule as per Schema 3.0

Version 0.5

Added Get-SysmonEventData to get the Event Data information as custom object for selected Event Types.
Added Get-SysmonRuleFilter to get all filters under a specific Event Type Rule.

Version 0.4

Version 3.0 is a full re-write om how rules work and new event types. This update is SysMon 3.0 only. If you wish to work on SysMon 2.0 rules I recommend you use version 0.3 version of the module.

When creating a new sysmon rule it will allow you to enable logging of event types supported.
Checks that it is only working with the proper XML schema for the rules.
Can now create specific filter for CreateRemoteThread event type.
Since Rules and Config got merger config functions (Get-SysmonConfigOptio, Set-SysmonConfigOption) where removed and replaced with Get-SysmonHashingAlgorithm and Set-SysmonHashingAlgorithm

Version 0.3

Tons of fixes do to a bad re-facor.
Filter creation is now done by specific funtions per event type.
Filter creation functions are now in their own sub-module.

Version 0.2

Validate that the file is an XML file and a valid Sysmon configuration file.
Change option ConfigFile to Path and LiteralPath so as to match other cmdlets that work with files.
Fixed typos on verbose messages and examples.
Functions should work better now when passing files through the pipeline using Get-ChildItem.

Version 0.1

Initial version for Sysmon 2.0 with XML Schema 1.0

Examples

Create a XML Configuration File

PS C:\> New-SysmonConfiguration -Path .\pc_marketing.xml -HashingAlgorithm IMPHASH,SHA1 -Network -Comment "Sysmon config for deployment in the Marketing PC OU" -Verbose
VERBOSE: Enabling hashing algorithms : IMPHASH,SHA1
VERBOSE: Enabling network connection logging.
VERBOSE: Config file created as C:\pc_marketing.xml

Get configured Rules and Filters

PS C:\> Get-SysmonRule -Path .\pc_marketing.xml


EventType     : NetworkConnect
Scope         : Filtered
DefaultAction : Exclude
Filters       : {@{EventField=Image; Condition=Image; Value=C:\Windows\System32\svchost.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Internet Explorer\iexplore.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files\Internet Explorer\iexplore.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe}...}



PS C:\> Get-SysmonRules -Path .\pc_marketing.xml | select -ExpandProperty Filters

EventField   Condition    Value
----------   ---------    -----
Image        Image        C:\Windows\System32\svchost.exe
Image        Image        C:\Program Files (x86)\Internet Explorer\iexplo...
Image        Image        C:\Program Files\Internet Explorer\iexplore.exe
Image        Image        C:\Program Files (x86)\Google\Chrome\Applicatio...
Image        Image        C:\Program Files (x86)\PuTTY\putty.exe
Image        Image        C:\Program Files (x86)\PuTTY\plink.exe
Image        Image        C:\Program Files (x86)\PuTTY\pscp.exe
Image        Image        C:\Program Files (x86)\PuTTY\psftp.exe

Create or Update a Rule and its Default Action

PS C:\> Set-SysmonRule -Path .\pc_marketing.xml -EventType ImageLoad -Verbose
VERBOSE: No rule for ImageLoad was found.
VERBOSE: Creating rule for event type with action of Exclude
VERBOSE: Action has been set.

EventType     : ImageLoad
Scope         : All Events
DefaultAction : Exclude
Filters       :

Remove One or More Filters

PS C:\> Get-SysmonRule -Path .\pc_marketing.xml -EventType NetworkConnect

EventType     : NetworkConnect
Scope         : Filtered
DefaultAction : Exclude
Filters       : {@{EventField=Image; Condition=Image; Value=C:\Windows\System32\svchost.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Internet Explorer\iexplore.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files\Internet Explorer\iexplore.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe}...}


PS C:\> Remove-SysmonRuleFilter -Path .\pc_marketing.xml -EventType NetworkConnect -Condition Image -EventField Image -Value $images -Verbose
VERBOSE: Filter for field Image with condition Image and value of C:\Windows\System32\svchost.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\Internet Explorer\iexplore.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files\Internet Explorer\iexplore.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\Google\Chrome\Application\chrome.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\putty.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\plink.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\pscp.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\psftp.exe removed.


EventType     : NetworkConnect
Scope         : All Events
DefaultAction : Exclude
Filters       :

Remove Rule

PS C:\> Remove-SysmonRule -Path .\pc_marketing.xml -EventType ImageLoad,NetworkConnect -Verbose
VERBOSE: Removed rule for ImageLoad.
VERBOSE: Removed rule for NetworkConnect.

darkoperator / posh-sysmon Goto Github PK

posh-sysmon's Introduction