If you're an IT professional with experience troubleshooting the Windows OS, then you may have used a tool from the Sysinternals suite.
The Sysinternals utilities have been around since 1996 and have been one of the most popular tools to handle various tasks in Windows, from remote execution (PSExec) to looking at software that starts automatically (Autoruns). Of the many tools in the Sysinternals suite, Sysmon is one of the best at providing great insight into what is happening in several areas on Windows. With the addition of the DNS query logging feature, I consider Sysmon an essential tool for administrators to monitor process creations and network connections.
Deploying Sysmon to clients
Chocolatey is the de facto package manager on Windows, due to its immense repository of Windows software and its integration with PowerShell and configuration management applications. Chocolatey has Sysmon and the rest of the Sysinternals suite on its public repository.
Chocolatey doesn't install Sysmon on a machine; it just unzips the files needed to install the Sysmon service. With some modification to the Chocolatey installation script, we can change that.
The last line of the script calls for the execution of sysmon64.exe with the arguments /accepteula /i /h * /n, which accepts the end-user license agreement, installs the Sysmon service on the local system, uses all hash algorithms and sets up logging of network connections.
When I run the command choco install sysmon –y, it installs the Sysmon service when I install the package.
Set up Chocolatey to fetch Sysmon and install the service.
Use configuration files to get what you want
With the addition of the DNS query logging feature, I consider Sysmon an essential tool for administrators to monitor process creations and network connections.
Once you get familiar with using Sysmon, you will want to use it with configuration files, which help filter events that Sysmon logs to weed out unnecessary information.
The IT professional who uses the handle @SwiftOnSecurity on Twitter maintains one of the more popular customized Sysmon configuration files at this repository on GitHub. It contains a lot of valuable inclusions and exclusions for those times when you need a cleaner Sysmon log. For instance, there is a section for monitoring file creation processes that includes important file extensions, such as .ps1, .bat and .vbs.
Displaying the Sysmon event log
One of the great features of Sysmon is that it puts logs in a familiar location: Windows Event Viewer. The exact location is under Applications and Services > Microsoft > Windows > Sysmon. Here, we can search and filter just like any other Windows event log. For instance, to search for a specific IP address for a network connection, users can right-click on the Sysmon log, and choose Find. This opens a dialog to search keywords -- in this case, an IP address.
Logging DNS queries in Sysmon
A recent release of Sysmon added a new feature: logging DNS queries. To test it, after browsing to Google in Chrome, I see it is logged in Sysmon as the following:
This brings in the ability to track if a system attempts to contact malicious sites, which can be helpful when detecting malware.
Search the Sysmon event log with PowerShell
The Get-WinEvent cmdlet is one of the most useful troubleshooting cmdlets in PowerShell for its ability to run a search in the Windows event log. Because Sysmon gets logged to the Windows event log, we can search it with PowerShell.
In the command below, we run Get-WinEvent on a remote computer (WIN10-CBB) and use -FilterHashTable to look in the Sysmon log for DNS queries only. I then pipe that output to Select-Object so that I only retrieve the message in the event. (The Event ID 22 occurs when a process runs a DNS query.)
