├── .gitignore ├── LICENSE ├── README.legacy ├── README.md ├── Resources ├── Botconf-2016_Tom-Ueltschi_Sysmon.pdf ├── FIRST-2017_Tom-Ueltschi_Sysmon_FINAL.pdf ├── HTA-T09-How-to-Go-from-Responding-to-Hunting-with-Sysinternals-Sysmon.pptx ├── HTA-W05-Tracking-Hackers-Sysinternals-Sysmon.pptx ├── bsides-athens-sysmon-final.pdf ├── conf2015_Jbrodsky_Splunk_SecurityComplinace_SplunkingTheEndpoint_FINAL.pdf ├── splunking-the-endpoint-files.zip ├── splunking-the-endpoint-hands-on.pdf ├── sysmon-2017-16-1.pdf └── using-sysmon-to-enrich-security-onions-host-level-capabilities6.pdf ├── config ├── StartLogging.xml ├── hunt-naked.xml ├── sysmon-a.cfg ├── sysmon-b.cfg ├── sysmon-c.cfg ├── sysmon-d.cfg ├── sysmon-e.cfg ├── sysmon_config.xml ├── sysmoncfg_v2.xml └── sysmoncfg_v31.xml └── docs ├── .gitignore ├── 404.html ├── Blogs.md ├── Community_Guide.md ├── Deploy_Sysmon.md ├── ELK.md ├── Gemfile ├── Gemfile.lock ├── General.md ├── GravWell.md ├── Graylog.md ├── Microsoft_System_Center.md ├── Presentations.md ├── RSA_Netwitness.md ├── Splunk.md ├── Sysmon_Configuration_Files.md ├── Sysmon_GitHub_Projects.md ├── Utilities.md ├── _config.yml ├── about.markdown ├── assets └── images │ └── sysmondfir.png └── index.markdown /.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/.gitignore -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/LICENSE -------------------------------------------------------------------------------- /README.legacy: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/README.legacy -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/README.md -------------------------------------------------------------------------------- /Resources/Botconf-2016_Tom-Ueltschi_Sysmon.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/Botconf-2016_Tom-Ueltschi_Sysmon.pdf -------------------------------------------------------------------------------- /Resources/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL.pdf -------------------------------------------------------------------------------- /Resources/HTA-T09-How-to-Go-from-Responding-to-Hunting-with-Sysinternals-Sysmon.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/HTA-T09-How-to-Go-from-Responding-to-Hunting-with-Sysinternals-Sysmon.pptx -------------------------------------------------------------------------------- /Resources/HTA-W05-Tracking-Hackers-Sysinternals-Sysmon.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/HTA-W05-Tracking-Hackers-Sysinternals-Sysmon.pptx -------------------------------------------------------------------------------- /Resources/bsides-athens-sysmon-final.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/bsides-athens-sysmon-final.pdf -------------------------------------------------------------------------------- /Resources/conf2015_Jbrodsky_Splunk_SecurityComplinace_SplunkingTheEndpoint_FINAL.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/conf2015_Jbrodsky_Splunk_SecurityComplinace_SplunkingTheEndpoint_FINAL.pdf -------------------------------------------------------------------------------- /Resources/splunking-the-endpoint-files.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/splunking-the-endpoint-files.zip -------------------------------------------------------------------------------- /Resources/splunking-the-endpoint-hands-on.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/splunking-the-endpoint-hands-on.pdf -------------------------------------------------------------------------------- /Resources/sysmon-2017-16-1.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/sysmon-2017-16-1.pdf -------------------------------------------------------------------------------- /Resources/using-sysmon-to-enrich-security-onions-host-level-capabilities6.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/Resources/using-sysmon-to-enrich-security-onions-host-level-capabilities6.pdf -------------------------------------------------------------------------------- /config/StartLogging.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/StartLogging.xml -------------------------------------------------------------------------------- /config/hunt-naked.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/hunt-naked.xml -------------------------------------------------------------------------------- /config/sysmon-a.cfg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/sysmon-a.cfg -------------------------------------------------------------------------------- /config/sysmon-b.cfg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/sysmon-b.cfg -------------------------------------------------------------------------------- /config/sysmon-c.cfg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/sysmon-c.cfg -------------------------------------------------------------------------------- /config/sysmon-d.cfg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/sysmon-d.cfg -------------------------------------------------------------------------------- /config/sysmon-e.cfg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/sysmon-e.cfg -------------------------------------------------------------------------------- /config/sysmon_config.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/sysmon_config.xml -------------------------------------------------------------------------------- /config/sysmoncfg_v2.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/sysmoncfg_v2.xml -------------------------------------------------------------------------------- /config/sysmoncfg_v31.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/config/sysmoncfg_v31.xml -------------------------------------------------------------------------------- /docs/.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/.gitignore -------------------------------------------------------------------------------- /docs/404.html: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/404.html -------------------------------------------------------------------------------- /docs/Blogs.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Blogs.md -------------------------------------------------------------------------------- /docs/Community_Guide.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Community_Guide.md -------------------------------------------------------------------------------- /docs/Deploy_Sysmon.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Deploy_Sysmon.md -------------------------------------------------------------------------------- /docs/ELK.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/ELK.md -------------------------------------------------------------------------------- /docs/Gemfile: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Gemfile -------------------------------------------------------------------------------- /docs/Gemfile.lock: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Gemfile.lock -------------------------------------------------------------------------------- /docs/General.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/General.md -------------------------------------------------------------------------------- /docs/GravWell.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/GravWell.md -------------------------------------------------------------------------------- /docs/Graylog.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Graylog.md -------------------------------------------------------------------------------- /docs/Microsoft_System_Center.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Microsoft_System_Center.md -------------------------------------------------------------------------------- /docs/Presentations.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Presentations.md -------------------------------------------------------------------------------- /docs/RSA_Netwitness.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/RSA_Netwitness.md -------------------------------------------------------------------------------- /docs/Splunk.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Splunk.md -------------------------------------------------------------------------------- /docs/Sysmon_Configuration_Files.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Sysmon_Configuration_Files.md -------------------------------------------------------------------------------- /docs/Sysmon_GitHub_Projects.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Sysmon_GitHub_Projects.md -------------------------------------------------------------------------------- /docs/Utilities.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/Utilities.md -------------------------------------------------------------------------------- /docs/_config.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/_config.yml -------------------------------------------------------------------------------- /docs/about.markdown: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/about.markdown -------------------------------------------------------------------------------- /docs/assets/images/sysmondfir.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/assets/images/sysmondfir.png -------------------------------------------------------------------------------- /docs/index.markdown: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MHaggis/sysmon-dfir/HEAD/docs/index.markdown --------------------------------------------------------------------------------