Sysmon — Télémétrie Windows Avancée

# Télécharger depuis Microsoft Sysinternals
# https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
# Installer avec config
.\Sysmon64.exe -accepteula -i sysmonconfig.xml
# Mettre à jour la config
.\Sysmon64.exe -c sysmonconfig.xml
# Vérifier le service
Get-Service Sysmon64
sc.exe qc Sysmon64
# Désinstaller
.\Sysmon64.exe -u force

# Télécharger la config SwiftOnSecurity (référence industrie)
# https://github.com/SwiftOnSecurity/sysmon-config
# Config Olaf Hartong (plus complète, MITRE ATT&CK mappée)
# https://github.com/olafhartong/sysmon-modular

<Sysmon schemaversion="4.90">
  <HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms>
  <CheckRevocation>False</CheckRevocation>
  <EventFiltering>
    <!-- INCLURE ces événements -->
    <RuleGroup name="" groupRelation="or">
      <!-- EventID 1 : Création de processus -->
      <ProcessCreate onmatch="exclude">
        <!-- Exclure les processus légitimes bruyants -->
        <Image condition="is">C:\Windows\System32\svchost.exe</Image>
        <Image condition="is">C:\Windows\System32\wuauclt.exe</Image>
      </ProcessCreate>
      <!-- EventID 3 : Connexions réseau -->
      <NetworkConnect onmatch="include">
        <!-- Surveiller PowerShell qui se connecte au net -->
        <Image condition="contains">powershell</Image>
        <Image condition="contains">cmd.exe</Image>
        <Image condition="contains">wscript</Image>
        <Image condition="contains">cscript</Image>
      </NetworkConnect>
      <!-- EventID 7 : Chargement de DLL -->
      <ImageLoad onmatch="include">
        <!-- DLL depuis dossiers suspects -->
        <ImageLoaded condition="contains">\Temp\</ImageLoaded>
        <ImageLoaded condition="contains">\AppData\</ImageLoaded>
      </ImageLoad>
      <!-- EventID 8 : CreateRemoteThread (injection) -->
      <CreateRemoteThread onmatch="include">
        <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
        <TargetImage condition="is">C:\Windows\explorer.exe</TargetImage>
      </CreateRemoteThread>
      <!-- EventID 10 : Accès processus (Mimikatz lsass) -->
      <ProcessAccess onmatch="include">
        <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
      </ProcessAccess>
      <!-- EventID 11 : Création fichier -->
      <FileCreate onmatch="include">
        <TargetFilename condition="contains">\Startup\</TargetFilename>
        <TargetFilename condition="contains">\Temp\</TargetFilename>
        <TargetFilename condition="end with">.ps1</TargetFilename>
        <TargetFilename condition="end with">.bat</TargetFilename>
        <TargetFilename condition="end with">.vbs</TargetFilename>
      </FileCreate>
      <!-- EventID 12/13/14 : Registry -->
      <RegistryEvent onmatch="include">
        <!-- Clés de persistance -->
        <TargetObject condition="contains">CurrentVersion\Run</TargetObject>
        <TargetObject condition="contains">CurrentVersion\RunOnce</TargetObject>
        <TargetObject condition="contains">Winlogon\Userinit</TargetObject>
      </RegistryEvent>
      <!-- EventID 22 : Requête DNS -->
      <DnsQuery onmatch="exclude">
        <!-- Exclure domaines Microsoft légitimes -->
        <QueryName condition="end with">.microsoft.com</QueryName>
        <QueryName condition="end with">.windows.com</QueryName>
      </DnsQuery>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

<!-- Détection PowerShell encodé (EventID 1) -->
<ProcessCreate onmatch="include">
  <CommandLine condition="contains">-EncodedCommand</CommandLine>
  <CommandLine condition="contains">-enc </CommandLine>
  <CommandLine condition="contains">-ec </CommandLine>
</ProcessCreate>
<!-- Détection Mimikatz (EventID 10 — accès lsass) -->
<ProcessAccess onmatch="include">
  <TargetImage condition="is">C:\Windows\system32\lsass.exe</TargetImage>
  <GrantedAccess condition="is">0x1010</GrantedAccess>
  <GrantedAccess condition="is">0x1410</GrantedAccess>
</ProcessAccess>
<!-- Détection injection (EventID 8) -->
<CreateRemoteThread onmatch="include">
  <SourceImage condition="is not">C:\Windows\System32\svchost.exe</SourceImage>
  <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
</CreateRemoteThread>
<!-- Macro Office qui lance cmd/powershell (EventID 1) -->
<ProcessCreate onmatch="include">
  <ParentImage condition="contains">WINWORD.EXE</ParentImage>
  <Image condition="contains">cmd.exe</Image>
</ProcessCreate>

<!-- /var/ossec/etc/ossec.conf — Collecte logs Sysmon -->
<localfile>
  <location>Microsoft-Windows-Sysmon/Operational</location>
  <log_format>eventchannel</log_format>
</localfile>

<!-- /var/ossec/etc/rules/sysmon_rules.xml -->
<group name="sysmon,windows">
  <!-- Accès lsass -->
  <rule id="100200" level="12">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^10$</field>
    <field name="win.eventdata.targetImage" type="pcre2">(?i)lsass\.exe</field>
    <description>Sysmon - Suspicious LSASS access (possible credential dumping)</description>
    <mitre>
      <id>T1003</id>
    </mitre>
  </rule>
  <!-- PowerShell encodé -->
  <rule id="100201" level="10">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^1$</field>
    <field name="win.eventdata.commandLine" type="pcre2">(?i)-enc[odedcommand\s]</field>
    <description>Sysmon - PowerShell encoded command execution</description>
    <mitre>
      <id>T1059.001</id>
    </mitre>
  </rule>
  <!-- Remote Thread dans processus sensible -->
  <rule id="100202" level="14">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^8$</field>
    <field name="win.eventdata.targetImage" type="pcre2">(?i)(lsass|winlogon|services)\.exe</field>
    <description>Sysmon - CreateRemoteThread in sensitive process</description>
    <mitre>
      <id>T1055</id>
    </mitre>
  </rule>
</group>

# Lister les événements Sysmon récents
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 50 |
  Select-Object TimeCreated, Id, Message | Format-Table -Wrap
# Filtrer EventID 1 (process creation)
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object { $_.Id -eq 1 } |
  Select-Object -First 10 |
  ForEach-Object { $_.Message }
# Stats par EventID
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Group-Object Id | Sort-Object Count -Descending |
  Select-Object Name, Count