Lion Cipher Lab
Set up Sysmon for endpoint detection on your own Windows machine
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
You cannot detect what you cannot see. On a stock Windows box the built-in logs are surprisingly thin for defenders: Windows will note that a process started, but not the full command line it ran with, not the hash of the file behind it, not which process launched it, and not the network connection it opened. Those are exactly the details that separate 'a program ran' from 'a malicious script launched from Word, hashed to a known-bad file, and phoned home.' Sysmon — System Monitor, a free and Microsoft-signed Sysinternals tool — closes that gap by writing rich telemetry (raw recorded evidence…
What you'll learn
- understanding what endpoint telemetry is and why default Windows logging misses it
- installing Sysmon (Sysinternals) with a curated configuration
- choosing between the SwiftOnSecurity and Olaf Hartong sysmon-modular configs
- reading Sysmon Event ID 1 (process creation) including command line, hashes, and parent process
- understanding process ancestry (parent/child) as a detection signal
- hunting Sysmon events with Get-WinEvent from the Microsoft-Windows-Sysmon/Operational log
- mapping process-creation telemetry to the MITRE ATT&CK Process Creation data source (DS0009)
Steps in this lab
- What Sysmon is, and what 'telemetry' means
- What Sysmon adds that default logging misses
- The config is everything (and how to choose one)
- Download Sysmon and a curated config
- Install Sysmon with the config
- Confirm Sysmon is running and its log exists
- Generate benign activity, then find its Event ID 1 with Get-WinEvent
- The reality: telemetry, not prevention — and map it to ATT&CK