Sysmon
Deployment
Sysmon provides advanced process auditing for Windows systems, a function that is not provided by default. This is a high value cyber security data source for detections and hunting. The deployment of Sysmon within an organisational environment is strongly recommended.
Sysmon is a Microsoft component that can be implemented as a service. The HyperSec HyperCollector automated integration services provides an automated, auto-update deployment of Sysmon that includes:
- Sysmon itself
- A best practice Sysmon configuration
- Filtering to reduce noise and load
This deployment can be performed using a raised elevation execution of the cmd file or deployment using Microsoft Configuration Manager or similar enterprise configuration manager system.
Deployment of this component should be performed in similar staging to the WEF deployment, implemented as progressively larger groups.
Stage 1 - Initial Group
This deployment is a small group of easily configured systems and is used to validate the group policy deployment. Ideally this is a group of workstations with a small number of servers added once this is successful.
Stage 2 - Wider General Purpose Groups
This deployment expands the deployment to common general purpose systems group by group or by OU. This is often office automation environment and general purpose servers.
Stage 3 - Mission Critical
This deployment expands to domain controllers, database and other mission critical hosts.
Sysmon can introduce a small overhead when processing activity and as heavily loaded systems or systems at the edge of capacity should be monitored after deployment.
Updates
Updates can be performed by cloning the latest version from the repository and then deploying and re-executing the installation.