Lion Cipher Lab
Trace a suspicious process with Sysmon: execution, network, file, and persistence (Event IDs 1/3/11/13/22)
- SOC Analyst / Blue Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A SOC analyst's day is not spent running scanners — it is spent reading telemetry and deciding what a machine actually did. Sysmon is the richest Windows telemetry most defenders have: unlike the stock event log, every process-creation record carries the full command line, the file's hashes, and — the star of the show — the parent process that launched it, and every record shares a ProcessGuid you can pivot on. That means a scatter of separate events (a process started, a DNS lookup, a connection out, a file written, a registry key set) can be stitched back into a single, provable story of…
What you'll learn
- reading the core Sysmon event types (1 process create, 3 network connection, 11 file create, 13 registry value set, 22 DNS query)
- using ProcessGuid and the parent/child link to stitch separate events into one process story
- spotting an Office-application-spawns-a-shell parent/child chain as a detection signal
- recognising a Run-key write as persistence and reading which value and path it set
- building the behavioural narrative of an intrusion from raw endpoint telemetry
- mapping observed behaviour to MITRE ATT&CK techniques (T1059.001, T1105, T1547.001)
- judgment: when Sysmon answers the question and when you must correlate across hosts
Steps in this lab
- What Sysmon is, and why it beats the stock Windows log
- The event types you'll follow, by number
- The scenario: an alert lands on your queue
- Start at the parent/child chain (Event ID 1)
- Follow the thread: pivot on the ProcessGuid
- The persistence: read the Run key (Event ID 13)
- When Sysmon answers it, when it doesn't — and how a pro does it better