🧰 Sysmon

The items that name it 18

• Field Notes: Reconstructing an Attacker’s Workflow
  writeupas classification.technologies2026-10-22
• lee1981 (@lee1981b) on X
  articleas classification.technologies2026-10-21
• lee1981 (@lee1981b) on X
  advisoryas classification.technologies2026-10-19
• M-med/Active-Directory-Simulation-Attack-
  repoas classification.technologies2026-10-04
• Field Notes: Reconstructing the Attacker's LSASS Dump
  writeupas tools2026-09-30

  Used for detection via Event ID 10 (ProcessAccess) to identify unexpected processes obtaining handles to lsass.exe

• OAuth Token Theft Through Microsoft's Front Door | Huntress
  writeupas tools2026-09-23

  Endpoint telemetry (Event IDs 1, 3, 7) suggested for detecting AppxPackage registration, outbound connections, and DLL loads from AppX package paths

• Defence Impairment Olympics
  writeupas affected products2026-06-29

  Logging tool whose processes (sysmon.exe, sysmon64.exe) were killed, services stopped/deleted, and later frozen via IFEO debugger settings

• Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
  writeupas tools2026-06-28

  Endpoint monitoring; Event ID 13 for registry modification detection (WDigest, SSP, Password Filter, NetworkProvider keys), Event ID 11 for file creation detection of new DLLs in System32.

• Trial, Error & Typos: Malware Isn't Always 'Sophisticated' | Huntress
  writeupas classification.technologies2025-12-22
• Oh my .. ! - Suspicious network traffic detected including Ransomware
  writeupas tools2025-01-22

  Endpoint telemetry tool compared against MDE telemetry (via Olaf Hartong's Sysmon vs MDE overview)

• EDR: The Great Escape - RomHack Training Review
  writeupas tools2024-09-30

  Cited as a tool that adopted ETW as a tracing source

• Today I Learned - WebDAV Cache
  writeupas tools2024-08-08

  Logging tool used to observe file creation events revealing the TfsStore\Tfs_DAV cache directory

• Abusing the “search-ms” URI protocol handler
  writeupas tools2024-08-04

  Used by the author to capture Process Create and File Create events showing the infection chain (command lines, parent command lines)

• Two in a row - You mitigated wrong (Kentico CMS RCE)
  writeupas tools2024-03-06It is written here as Sysmon (SwiftOnSecurity config).

  Installed to determine execution vector of malicious code, capturing process creation and parent-child relationships

• N-IOCs to Rule Them All
  writeupas tools2023-12-31

  SysInternals tool for monitoring registry key creation (event ID 13, e.g. Run keys), file write events in AppData, and network connections with destination/port/application

• Cobalt Strike and Tradecraft
  writeupas tools2021-07-26

  Endpoint logging tool used to capture process creation and other events (e.g., Event Code 1) for detection of Cobalt Strike activity

• Creating a Red & Blue Team Homelab
  writeupas tools2021-03-04

  Recommended install on Windows hosts to generate detailed events for detection

• Sigma r2026-07-01 — 20 new detection rules
  repoas classification.technologies