sametsazak/sysmon

Sysmon and wazuh integration with Sigma sysmon rules [updated]

Sysmon - Wazuh Sigma Rules

Sysmon is a command line tool which allows us to monitor and track processes taking place in our computers. With the right configuration, suspicious behaviors can be detected by Sysmon and the detailed information will be stored in the generated log. For instance, the creation of a new process will be detected by Sysmon as “Event number 1”. This event will contain critical information that we could use to configure an active response or adopt other type of security measures.

How to Install?

Client Configuration

First, you should install Sysmon.

Download sysmon : https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

Setup Sysmon: 

Sysmon64.exe -accepteula -i sysconfig.xml

Then, 

Copy below to your client's ossec.conf file

<localfile>
<location>Microsoft-Windows-Sysmon/Operational</location>
<log_format>eventchannel</log_format>
</localfile>

Save it and restart agent.

## Server Configuration

Copy sysmon_rules.xml to /var/ossec/etc/rules/local_rules.xml

Save it restart manager.

Finished!


Rules are generated from Rules from https://github.com/Neo23x0/sigma/tree/master/rules/windows/sysmon

Thanks.

sysmon's Issues

cant see alerts on the wazuh gui

Hi,
i'v tried to configure the sysmon alerts.
i'm working upon the documentation.
everything looks good and still can't get alerts from Sysmon logs.

please help

improvment idea

This project have a great idea,
i have an suggestion to create a script that automatically generates wazuh config based on sigma rules git repo. Something like AtomicThreatCoverage that includes EndPoint Detection using wazuh

Seems this is not compatible with Wazuh 3.9?

Hi,

I am trying to ingest logs from wazuh agent 3.9 and using your rule file but logs are not getting ingested. Did you try this with 3.9?