Sysmon-DFIR
AboutBlogsCommunity GuideDeploy SysmonELKGeneralGravwellGraylogMicrosoft System CenterPresentationsRSA NetwitnessSplunkSysmon Configuration FilesSysmon Github ProjectsUtilities

Sysmon Github Projects

Nov 29, 2023

  • Powershell Sysmon - GitHub - Carlos Perez
  • Sysmon queries - GitHub - James Habben
  • Splunk TA for Sysmon - GitHub - @daveherrald
  • SplunkMon cofiguration - GitHub - The Crypsis Group
  • Desired State Configuration for Deploying/Maintaining Sysmon - GitHub - @AwfulyPrideful
  • SysmonSimulator - Simulate the attacks to generate the Sysmon Event logs @ScarredMonk
  • SysmonParser - Automatically generated Sysmon parser for Azure Sentinel @olafhartong

Sysmon-DFIR

  • Sysmon-DFIR
  • MHaggis
  • M_Haggis

A curated and bespoke list of resources for learning about deploying, managing and hunting with Microsoft Sysmon. Contains presentations, deployment methods, configuration file examples, blogs and additional GitHub repositories.