Bạn có thể assume nếu chuyện shady xảy ra PC, antivirus sẽ catch. Và có thể — eventually. Nhưng khi traditional security software raise flag, damage có thể đã done. Có gì nếu máy tính keep detailed, running journal mọi thứ under the hood: mọi process launch, mọi network connection mở, mọi lần file creation timestamp bị alter suspicious?
Đó chính xác Sysmon làm. Free, Microsoft-built tool thuộc category rộng hơn Windows Sysinternals tools bắt suspicious behavior. Phần thú vị: dù utilities là gold standard tìm spyware/adware trên PC, hầu hết everyday Windows users chưa nghe về chúng.
Sysmon cho Windows visibility level built-in logging không match
Event Viewer không bao giờ cut it
Windows đã keep event logs, nếu từng mở Event Viewer troubleshoot, notice chaotic chúng cảm thấy. Nhiều noise, không luôn clarity. Sysmon (System Monitor) khác hoàn toàn. Once installed, chạy as persistent system service và device driver, survive reboots, viết richly detailed events Windows event log. Khác biệt giống so sánh security camera grainy với camera đọc biển số xe.
Sysmon event catalog log process creation với full command-line arguments, nên không chỉ thấy program ran, mà thấy how launched. Cũng record network connections: originating process, IP, port, hostname. Trace được application nào contact server nào khi nào. Flag changes file creation timestamps, classic trick malware disguise as legitimate system files. Ngoài ra, Sysmon watch driver loading, registry changes, DNS queries, advanced techniques như process hollowing, logged under Event ID 25, malicious code hide inside essential Windows process.
Draft table most security-relevant event IDs:
| Event ID | Name | Capture gì |
|---|---|---|
| 1 | Process Create | Mọi process launch, full command line, parent process, file hash. Single most useful event spot suspicious executions. |
| 2 | File Creation Time Changed | Flag khi process deliberately alter file creation timestamp, classic malware tactic blend legitimate system files. |
| 3 | Network Connection | Log outbound TCP/UDP connections, link each to process made it. Essential detect beaconing/data exfiltration. |
| 6 | Driver Loaded | Record kernel drivers load, including signature status. Unsigned/unexpected drivers serious red flag. |
| 7 | Image Loaded | Track DLLs load vào processes; disabled by default do volume, powerful detect DLL hijacking khi filter carefully. |
| 8 | Create Remote Thread | Detect khi process inject thread vào process khác, hallmark code injection/process hollowing attacks. |
| 10 | Process Access | Fire khi process mở memory process khác, catch credential theft tools target LSASS (store Windows login secrets). |
| 11 | File Create | Log new files created/overwritten, useful watch Temp, Downloads, Startup folders. |
| 12-14 | Registry Events | Cover registry key creation, deletion, value changes, renames, primary way malware establishes persistence across reboots. |
| 15 | File Create Stream Hash | Catch files downloaded via browser logging Zone Identifier stream attached. Trace origin suspicious executables. |
| 17-18 | Pipe Events | Monitor named pipe creation/connections, common IPC method malware/post-exploitation frameworks như Cobalt Strike. |
| 19-21 | WMI Events | Track WMI filter/consumer registration, favored fileless persistence technique leaves almost no trace without this event. |
| 22 | DNS Query | Log mọi DNS lookup process makes, spot connections known malicious domains trước full TCP connection. |
| 25 | Process Tampering | Detect process hollowing/herpaderping (replace legitimate process memory malicious code evade detection). |
| 29 | File Executable Detected | Flag creation any new executable (PE format) file system, strong early indicator dropper/installer running. |
Cách get Sysmon up and running
Nếu mở terminal được, đã most of the way there
Sysmon free download Microsoft Sysinternals page (version 15.15 writing), install single command. Cần admin privileges và brief detour PowerShell/Command Prompt, whole process under 5 minutes.
Đến official Sysmon page Microsoft Learn, download ZIP (~4.6MB), extract. Mở PowerShell hoặc Command Prompt admin, navigate folder, chạy:
.\sysmon64 -accepteula -i
Basic install: Sysmon install service và driver background. Thực tế không cần reboot. Từ đó, bắt đầu log events tới Applications and Services Logs -> Microsoft -> Windows -> Sysmon -> Operational in Event Viewer. View logs ngay.
Uninstall đơn giản: sysmon64 -u. Tool không try entrench, tác giả respect.
Không phải figure out alone
Default Sysmon install functional, nhưng really comes into own với configuration file. Sysmon accept XML config specify events log, filter out, granular how. Nếu không familiar format, brush up XML file là gì và cách dùng, files define "logic" Sysmon monitor system. Viết từ scratch là project — nhưng không phải.
Cybersecurity community produced outstanding ready-made configs. Widely used: SwiftOnSecurity sysmon-config free GitHub, ~5000 stars, 1700+ forks. Carefully tuned capture security-relevant events filter noise làm logs unreadable. Every line commented, doubles as tutorial. Install với config này:
sysmon64 -accepteula -i sysmonconfig-export.xml
Update existing install với config mới:
sysmon64 -c sysmonconfig-export.xml
Muốn modular hơn, sysmon-modular project by Olaf Hartong (GitHub) composable, community-maintained approach map trực tiếp MITRE ATT&CK framework. Both excellent starting points.
Nó không stop every attack, nhưng bạn sẽ biết one happened
Không cần security engineer run Sysmon well. Cần decent config file, willingness open Event Viewer occasionally, satisfaction biết nếu strange ever happens machine, bạn có record. Peace of mind đó, tác giả thấy, well worth 5 minutes setup.