Sysmon

To access material, start machines and answer questions login.

, a tool used to monitor and log events on Windows, is commonly used by enterprises as part of their monitoring and logging solutions. Part of the Windows package, Sysmon is similar to Windows Event Logs with further detail and granular control.

Microsoft Security logo

This room uses a modified version of the Blue and Ice boxes, as well as Sysmon logs from the Hololive network lab.

Before completing this room we recommend completing the Windows Event Log room. It is also recommended to complete the Blue and Ice rooms to get an understanding of vulnerabilities present however is not required to continue.

Answer the questions below

Complete the prerequisites listed above and jump into task 2.

Sysmon

Task 1: Introduction

Task 2: Sysmon Overview

Task 3: Installing and Preparing Sysmon

Task 4: Cutting out the Noise

Task 5: Hunting Metasploit

Task 6: Detecting Mimikatz

Task 7: Hunting Malware

Task 8: Hunting Persistence

Task 9: Detecting Evasion Techniques

Task 10: Practical Investigations

Sysmon

Sysmon

Task 1: Introduction

Task 2: Sysmon Overview

Task 3: Installing and Preparing Sysmon

Task 4: Cutting out the Noise

Task 5: Hunting Metasploit

Task 6: Detecting Mimikatz

Task 7: Hunting Malware

Task 8: Hunting Persistence

Task 9: Detecting Evasion Techniques

Task 10: Practical Investigations

Sysmon

Task 1Introduction

Task 2Sysmon OverviewPremium

Task 3Installing and Preparing SysmonPremium

Task 4Cutting out the NoisePremium

Task 5Hunting MetasploitPremium

Task 6Detecting MimikatzPremium

Task 7Hunting MalwarePremium

Task 8Hunting PersistencePremium

Task 9Detecting Evasion TechniquesPremium

Task 10Practical InvestigationsPremium

Ready to learn Cyber Security?