/Posh-Sysmon

PowerShell module for creating and managing Sysinternals Sysmon config files.

Primary LanguagePowerShellBSD 3-Clause "New" or "Revised" LicenseBSD-3-Clause

Posh-Sysmon

PowerShell 3.0 or above module for creating and managing Sysinternals Sysmon v2.0 config files. System Monitor (Sysmon) is a Windows system service and device driver that is part of the SysInternal tools from Microsoft. It is written by Mark Russinovich and Thomas Garnier to monitor a Windows system actions and log such actions in to the Windows Event Log. When the tool is installed on a system it can be given a XML configuration file so as to control what is logged and the same file can be used to update the configuration of a previously installed instance of the tool.

All functions in the PowerShell module include help information and example of usage that can be view using the Get-Help cmdlet.

Installation

For installation it is highly recomended that you install from the PowerShell Gallery using the Install-Module cmdlet.

On PowerShell v5 and above:

Install-Module -Name Posh-Sysmon

If you are running PS 3.0 to 4.0 you can use the PowerShell Gallery also following instruction in PowerShell Gallery Documentation

Change Log

Version 1.2

  • Module only supports the last 2 Schema versions.[Breaking Change]
  • Support for Sysmon 8.0 Schema version 4.1 RuleName
  • Fixed issue when adding a filter for a none existing rule. It will properly error now.

Version 1.0

  • Module only supports the last 2 Schema versions.[Breaking Change]
  • Support for Sysmon 7.0 Schema version 4.0
  • Added new fields for filtering introduced in Sysmon 7.0.
  • Modified organization of functions in to their own files for better management while coding.
  • Fixed typo in the enabling of rules in rule creation.

Version 0.7.6

  • Support for Schema 3.4 of Sysmon v6.2
  • New function New-SysmonWmiEvent.
  • Updated Rule and Filter functions for WmiEvents.
  • Fixed where some functions did not support PipeEvents.

Version 0.7.5

  • Support for Schema 3.3 of Sysmon v6.
  • New function New-SysmonPipeEvent for filtering for named pipeline cration and connection events.
  • Support of PipeEvent in config creation and event type functions.
  • Several bug fixes on filtering functions when give an array of values.

Version 0.7.3

  • Several bug fixes when creating RawAccess and ProcessOpen rules.
  • By default the new schema is 3.2 for the latest version of Sysmon 5.0
  • New-SysmonConfiguration function has options to enable all logging for FileCreate, RegistryEvent and FileCreateStreamHash
  • Get-SysmonEventData can now parse File Create, Registry and File Stream creation events.
  • New function New-SysmonFileCreateFilter for creating file creation filters.
  • New function New-SysmonRegistryEvent for creating registry event filters.
  • New function New-SysmonFileCreateStreamHash for creating file stream hash event filters.
  • Updated Get-SysmonRule, Set-SysmonRule, Remove-SysmonRule and Remove-SysmonRuleFilter for the new event type rules.
  • Added Online Help option for all functions.

Version 0.7.2

  • Added missing Event Types to Get-SysmonEventData.

Version 0.7.1

  • Fixed issue with conditions with filters with space in them.

Version 0.7

  • Added support for ProcessAccess filtering added in Sysmon 4.1
  • Added function New-SysmonProcessAccess for creating ProcessAccess filters.
  • Fixed issue where command was displayed and not ran with New-SysmonDriverLoadFilter.
  • Added ProcessAccess type in Get-SysmonEventData and Get-SysmonRuleFilter.
  • In verbose output it shows with what version of Sysmon the file will be compatible with after creating it.

Version 0.6

  • Added support for Sysmon 4.0 XML schemea (Schema version 3.0)
  • One can select the version of schema to support when creating the configuration file.
  • All functions have been updated to support the use of more than one rule as per Schema 3.0

Version 0.5

  • Added Get-SysmonEventData to get the Event Data information as custom object for selected Event Types.
  • Added Get-SysmonRuleFilter to get all filters under a specific Event Type Rule.

Version 0.4

Version 3.0 is a full re-write om how rules work and new event types. This update is SysMon 3.0 only. If you wish to work on SysMon 2.0 rules I recommend you use version 0.3 version of the module.

  • When creating a new sysmon rule it will allow you to enable logging of event types supported.
  • Checks that it is only working with the proper XML schema for the rules.
  • Can now create specific filter for CreateRemoteThread event type.
  • Since Rules and Config got merger config functions (Get-SysmonConfigOptio, Set-SysmonConfigOption) where removed and replaced with Get-SysmonHashingAlgorithm and Set-SysmonHashingAlgorithm

Version 0.3

  • Tons of fixes do to a bad re-facor.
  • Filter creation is now done by specific funtions per event type.
  • Filter creation functions are now in their own sub-module.

Version 0.2

  • Validate that the file is an XML file and a valid Sysmon configuration file.
  • Change option ConfigFile to Path and LiteralPath so as to match other cmdlets that work with files.
  • Fixed typos on verbose messages and examples.
  • Functions should work better now when passing files through the pipeline using Get-ChildItem.

Version 0.1

  • Initial version for Sysmon 2.0 with XML Schema 1.0

Examples

Create a XML Configuration File

PS C:\> New-SysmonConfiguration -Path .\pc_marketing.xml -HashingAlgorithm IMPHASH,SHA1 -Network -Comment "Sysmon config for deployment in the Marketing PC OU" -Verbose
VERBOSE: Enabling hashing algorithms : IMPHASH,SHA1
VERBOSE: Enabling network connection logging.
VERBOSE: Config file created as C:\pc_marketing.xml

Get configured Rules and Filters

PS C:\> Get-SysmonRule -Path .\pc_marketing.xml


EventType     : NetworkConnect
Scope         : Filtered
DefaultAction : Exclude
Filters       : {@{EventField=Image; Condition=Image; Value=C:\Windows\System32\svchost.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Internet Explorer\iexplore.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files\Internet Explorer\iexplore.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe}...}



PS C:\> Get-SysmonRules -Path .\pc_marketing.xml | select -ExpandProperty Filters

EventField   Condition    Value
----------   ---------    -----
Image        Image        C:\Windows\System32\svchost.exe
Image        Image        C:\Program Files (x86)\Internet Explorer\iexplo...
Image        Image        C:\Program Files\Internet Explorer\iexplore.exe
Image        Image        C:\Program Files (x86)\Google\Chrome\Applicatio...
Image        Image        C:\Program Files (x86)\PuTTY\putty.exe
Image        Image        C:\Program Files (x86)\PuTTY\plink.exe
Image        Image        C:\Program Files (x86)\PuTTY\pscp.exe
Image        Image        C:\Program Files (x86)\PuTTY\psftp.exe

Create or Update a Rule and its Default Action

PS C:\> Set-SysmonRule -Path .\pc_marketing.xml -EventType ImageLoad -Verbose
VERBOSE: No rule for ImageLoad was found.
VERBOSE: Creating rule for event type with action of Exclude
VERBOSE: Action has been set.

EventType     : ImageLoad
Scope         : All Events
DefaultAction : Exclude
Filters       :

Remove One or More Filters

PS C:\> Get-SysmonRule -Path .\pc_marketing.xml -EventType NetworkConnect

EventType     : NetworkConnect
Scope         : Filtered
DefaultAction : Exclude
Filters       : {@{EventField=Image; Condition=Image; Value=C:\Windows\System32\svchost.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Internet Explorer\iexplore.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files\Internet Explorer\iexplore.exe},
                @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe}...}


PS C:\> Remove-SysmonRuleFilter -Path .\pc_marketing.xml -EventType NetworkConnect -Condition Image -EventField Image -Value $images -Verbose
VERBOSE: Filter for field Image with condition Image and value of C:\Windows\System32\svchost.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\Internet Explorer\iexplore.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files\Internet Explorer\iexplore.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\Google\Chrome\Application\chrome.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\putty.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\plink.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\pscp.exe removed.
VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\psftp.exe removed.


EventType     : NetworkConnect
Scope         : All Events
DefaultAction : Exclude
Filters       :

Remove Rule

PS C:\> Remove-SysmonRule -Path .\pc_marketing.xml -EventType ImageLoad,NetworkConnect -Verbose
VERBOSE: Removed rule for ImageLoad.
VERBOSE: Removed rule for NetworkConnect.