---
title: "Sysmon — Télémétrie Windows Avancée"
domain: security
subdomain: hardening
type: snippet
tags: [sysmon, windows, telemetry, edr, wazuh, detection, endpoint]
difficulty: intermediate
status: stable
updated: "Fri Jun 19 2026 00:00:00 GMT+0000 (Coordinated Universal Time)"
---
## Présentation

Sysmon (System Monitor) de Sysinternals génère des événements Windows détaillés que le journal Windows ne produit pas :
- Création de processus avec ligne de commande complète et hash
- Connexions réseau avec process associé
- Création/modification de fichiers
- Accès à la mémoire d'autres processus (injection)
- Chargement de drivers

---

## Installation

```powershell
# Télécharger depuis Microsoft Sysinternals
# https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

# Installer avec config
.\Sysmon64.exe -accepteula -i sysmonconfig.xml

# Mettre à jour la config
.\Sysmon64.exe -c sysmonconfig.xml

# Vérifier le service
Get-Service Sysmon64
sc.exe qc Sysmon64

# Désinstaller
.\Sysmon64.exe -u force
```

---

## Configuration recommandée — SwiftOnSecurity

```bash
# Télécharger la config SwiftOnSecurity (référence industrie)
# https://github.com/SwiftOnSecurity/sysmon-config

# Config Olaf Hartong (plus complète, MITRE ATT&CK mappée)
# https://github.com/olafhartong/sysmon-modular
```

### Structure du fichier XML
```xml
<Sysmon schemaversion="4.90">
  <HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms>
  <CheckRevocation>False</CheckRevocation>

  <EventFiltering>
    <!-- INCLURE ces événements -->
    <RuleGroup name="" groupRelation="or">

      <!-- EventID 1 : Création de processus -->
      <ProcessCreate onmatch="exclude">
        <!-- Exclure les processus légitimes bruyants -->
        <Image condition="is">C:\Windows\System32\svchost.exe</Image>
        <Image condition="is">C:\Windows\System32\wuauclt.exe</Image>
      </ProcessCreate>

      <!-- EventID 3 : Connexions réseau -->
      <NetworkConnect onmatch="include">
        <!-- Surveiller PowerShell qui se connecte au net -->
        <Image condition="contains">powershell</Image>
        <Image condition="contains">cmd.exe</Image>
        <Image condition="contains">wscript</Image>
        <Image condition="contains">cscript</Image>
      </NetworkConnect>

      <!-- EventID 7 : Chargement de DLL -->
      <ImageLoad onmatch="include">
        <!-- DLL depuis dossiers suspects -->
        <ImageLoaded condition="contains">\Temp\</ImageLoaded>
        <ImageLoaded condition="contains">\AppData\</ImageLoaded>
      </ImageLoad>

      <!-- EventID 8 : CreateRemoteThread (injection) -->
      <CreateRemoteThread onmatch="include">
        <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
        <TargetImage condition="is">C:\Windows\explorer.exe</TargetImage>
      </CreateRemoteThread>

      <!-- EventID 10 : Accès processus (Mimikatz lsass) -->
      <ProcessAccess onmatch="include">
        <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
      </ProcessAccess>

      <!-- EventID 11 : Création fichier -->
      <FileCreate onmatch="include">
        <TargetFilename condition="contains">\Startup\</TargetFilename>
        <TargetFilename condition="contains">\Temp\</TargetFilename>
        <TargetFilename condition="end with">.ps1</TargetFilename>
        <TargetFilename condition="end with">.bat</TargetFilename>
        <TargetFilename condition="end with">.vbs</TargetFilename>
      </FileCreate>

      <!-- EventID 12/13/14 : Registry -->
      <RegistryEvent onmatch="include">
        <!-- Clés de persistance -->
        <TargetObject condition="contains">CurrentVersion\Run</TargetObject>
        <TargetObject condition="contains">CurrentVersion\RunOnce</TargetObject>
        <TargetObject condition="contains">Winlogon\Userinit</TargetObject>
      </RegistryEvent>

      <!-- EventID 22 : Requête DNS -->
      <DnsQuery onmatch="exclude">
        <!-- Exclure domaines Microsoft légitimes -->
        <QueryName condition="end with">.microsoft.com</QueryName>
        <QueryName condition="end with">.windows.com</QueryName>
      </DnsQuery>

    </RuleGroup>
  </EventFiltering>
</Sysmon>
```

---

## EventIDs Sysmon — Référence

| EventID | Événement | Cas d'usage détection |
|---------|-----------|----------------------|
| 1 | ProcessCreate | Exécution de malware, LOLBAS |
| 2 | File creation time change | Timestomping |
| 3 | NetworkConnect | C2 beaconing, scan interne |
| 4 | Sysmon status change | Désactivation Sysmon |
| 5 | ProcessTerminate | — |
| 6 | DriverLoad | Rootkit, driver malveillant |
| 7 | ImageLoad | DLL hijacking, injection |
| 8 | CreateRemoteThread | Process injection |
| 9 | RawAccessRead | Lecture disque directe (bypass AV) |
| 10 | ProcessAccess | Dumping lsass (Mimikatz) |
| 11 | FileCreate | Drop de payload |
| 12-14 | Registry | Persistance, modification |
| 15 | FileCreateStreamHash | ADS (Alternate Data Streams) |
| 17-18 | PipeEvent | Lateral movement (PsExec, Cobalt Strike) |
| 22 | DnsQuery | Exfiltration DNS, DGA |
| 23 | FileDelete | Nettoyage de traces |
| 25 | ProcessTampering | Hollowing, doppelganging |
| 29 | FileDeleteDetected | Suppression surveillée |

---

## Détections clés via Sysmon

```xml
<!-- Détection PowerShell encodé (EventID 1) -->
<ProcessCreate onmatch="include">
  <CommandLine condition="contains">-EncodedCommand</CommandLine>
  <CommandLine condition="contains">-enc </CommandLine>
  <CommandLine condition="contains">-ec </CommandLine>
</ProcessCreate>

<!-- Détection Mimikatz (EventID 10 — accès lsass) -->
<ProcessAccess onmatch="include">
  <TargetImage condition="is">C:\Windows\system32\lsass.exe</TargetImage>
  <GrantedAccess condition="is">0x1010</GrantedAccess>
  <GrantedAccess condition="is">0x1410</GrantedAccess>
</ProcessAccess>

<!-- Détection injection (EventID 8) -->
<CreateRemoteThread onmatch="include">
  <SourceImage condition="is not">C:\Windows\System32\svchost.exe</SourceImage>
  <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
</CreateRemoteThread>

<!-- Macro Office qui lance cmd/powershell (EventID 1) -->
<ProcessCreate onmatch="include">
  <ParentImage condition="contains">WINWORD.EXE</ParentImage>
  <Image condition="contains">cmd.exe</Image>
</ProcessCreate>
```

---

## Intégration Wazuh

```xml
<!-- /var/ossec/etc/ossec.conf — Collecte logs Sysmon -->
<localfile>
  <location>Microsoft-Windows-Sysmon/Operational</location>
  <log_format>eventchannel</log_format>
</localfile>
```

### Règles Wazuh pour Sysmon
```xml
<!-- /var/ossec/etc/rules/sysmon_rules.xml -->
<group name="sysmon,windows">

  <!-- Accès lsass -->
  <rule id="100200" level="12">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^10$</field>
    <field name="win.eventdata.targetImage" type="pcre2">(?i)lsass\.exe</field>
    <description>Sysmon - Suspicious LSASS access (possible credential dumping)</description>
    <mitre>
      <id>T1003</id>
    </mitre>
  </rule>

  <!-- PowerShell encodé -->
  <rule id="100201" level="10">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^1$</field>
    <field name="win.eventdata.commandLine" type="pcre2">(?i)-enc[odedcommand\s]</field>
    <description>Sysmon - PowerShell encoded command execution</description>
    <mitre>
      <id>T1059.001</id>
    </mitre>
  </rule>

  <!-- Remote Thread dans processus sensible -->
  <rule id="100202" level="14">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^8$</field>
    <field name="win.eventdata.targetImage" type="pcre2">(?i)(lsass|winlogon|services)\.exe</field>
    <description>Sysmon - CreateRemoteThread in sensitive process</description>
    <mitre>
      <id>T1055</id>
    </mitre>
  </rule>

</group>
```

---

## Vérification et debug

```powershell
# Lister les événements Sysmon récents
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 50 |
  Select-Object TimeCreated, Id, Message | Format-Table -Wrap

# Filtrer EventID 1 (process creation)
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object { $_.Id -eq 1 } |
  Select-Object -First 10 |
  ForEach-Object { $_.Message }

# Stats par EventID
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Group-Object Id | Sort-Object Count -Descending |
  Select-Object Name, Count
```