다음은 winlogbeat의 sysmon 이벤트 모듈 설정 내역. dns 관련 정보가 보인다. sysmon이 dns 이벤트를 기록했었나?
C:\Users\Administrator\Downloads\Sysmon>Sysmon64.exe -i
System Monitor v13.01 - System activity monitorCopyright (C) 2014-2021 Mark Russinovich and Thomas GarnierSysinternals - www.sysinternals.com
Sysmon64 installed.SysmonDrv installed.Starting SysmonDrv.SysmonDrv started.Starting Sysmon64..Sysmon64 started.설정 내역을 확인해보면 DNS lookup 기능이 활성화되어 있다.
C:\Users\Administrator\Downloads\Sysmon>Sysmon64.exe -c
System Monitor v13.01 - System activity monitorCopyright (C) 2014-2021 Mark Russinovich and Thomas GarnierSysinternals - www.sysinternals.com
Current configuration: - Service name: Sysmon64 - Driver name: SysmonDrv - Config file: "C:\Users\Administrator\Downloads\Sysmon\Sysmon64.exe" -i
- HashingAlgorithms: SHA256 - Network connection: disabled - Archive Directory: - - Image loading: disabled - CRL checking: enabled - DNS lookup: enabled
No rules installed하지만 실제 기록되는 이벤트는 프로세스 관련 뿐.
정책 적용
이벤트 유형별 정책(sysmon.xml)을 만들었다. include 정책은 지정된 조건만을 기록, exclude는 지정된 조건만을 기록하지 않기 때문에 조건을 지정하지 않으면 include는 아무것도 기록하지 않고, exclude는 모든 이벤트를 기록한다.
<Sysmon schemaversion="4.50"> <!-- Capture all hashes --> <HashAlgorithms>*</HashAlgorithms> <EventFiltering> <FileDelete onmatch="include"/> <ClipboardChange onmatch="include"/> <ProcessCreate onmatch="exclude"/> <ProcessTerminate onmatch="exclude"/> <ProcessTampering onmatch="exclude"/> <ProcessAccess onmatch="exclude"/> <FileCreateTime onmatch="exclude"/> <FileCreate onmatch="exclude"/> <FileCreateStreamHash onmatch="exclude"/> <NetworkConnect onmatch="exclude"/> <DriverLoad onmatch="exclude"/> <ImageLoad onmatch="exclude"/> <CreateRemoteThread onmatch="exclude"/> <RawAccessRead onmatch="exclude"/> <RegistryEvent onmatch="exclude"/> <PipeEvent onmatch="exclude"/> <WmiEvent onmatch="exclude"/> <DnsQuery onmatch="exclude"> <Image condition="is">C:\Windows\Sysmon64.exe</Image> </DnsQuery> </EventFiltering></Sysmon>FileDelete, ClipboardChange 이벤트는 좀 귀찮아질 듯해서 기록하지 않기로 했고, DnsQuery는 PTR 조회를 남발하는 sysmon 프로세스만 제외시켰다. 다음은 적용 과정.
C:\Users\Administrator\Downloads\Sysmon>Sysmon64.exe -c .\sysmon.xml
System Monitor v13.01 - System activity monitorCopyright (C) 2014-2021 Mark Russinovich and Thomas GarnierSysinternals - www.sysinternals.com
Loading configuration file with schema version 4.50Configuration file validated.Configuration updated.적용 결과는 다음과 같다.
C:\Users\Administrator>sysmon64.exe -c
System Monitor v13.01 - System activity monitorCopyright (C) 2014-2021 Mark Russinovich and Thomas GarnierSysinternals - www.sysinternals.com
Current configuration: - Service name: Sysmon64 - Driver name: SysmonDrv - Config file: C:\Users\Administrator\Downloads\Sysmon\sysmon.xml - Config hash: SHA256=511B3312F334D15395FDD58F77EF801EFFA70A2C5299DE6D71B4F1A256A48FBE
- HashingAlgorithms: SHA1,MD5,SHA256,IMPHASH - Network connection: enabled - Archive Directory: - - Image loading: disabled - CRL checking: enabled - DNS lookup: enabled
Rule configuration (version 4.50): - FileDelete onmatch: include combine rules using 'And' - ClipboardChange onmatch: include combine rules using 'And' - ProcessCreate onmatch: exclude combine rules using 'And' - ProcessTerminate onmatch: exclude combine rules using 'And' - ProcessTampering onmatch: exclude combine rules using 'And' - ProcessAccess onmatch: exclude combine rules using 'And' - FileCreateTime onmatch: exclude combine rules using 'And' - FileCreate onmatch: exclude combine rules using 'And' - FileCreateStreamHash onmatch: exclude combine rules using 'And' - NetworkConnect onmatch: exclude combine rules using 'And' - DriverLoad onmatch: exclude combine rules using 'And' - ImageLoad onmatch: exclude combine rules using 'And' - CreateRemoteThread onmatch: exclude combine rules using 'And' - RawAccessRead onmatch: exclude combine rules using 'And' - RegistryEvent onmatch: exclude combine rules using 'And' - PipeEvent onmatch: exclude combine rules using 'And' - WmiEvent onmatch: exclude combine rules using 'And' - DnsQuery onmatch: exclude combine rules using 'And' Image filter: is value: 'C:\Windows\Sysmon64.exe'이제 다양한 이벤트들이 기록되기 시작.
dns 이벤트도 잘 기록된다.
3006 이벤트는 pid만 기록하는데, sysmon(22 이벤트)은 프로세스 이름까지 잘 가져온다. 그동안 dns 요청 프로세스 내역은 packetbeat에서 뽑았는데 이제 그럴 필요 없겠네. 근데 같은 회사에서 왜 서로 따로 놀지? 이벤트 로그랑 Sysinternals 두 팀 사이 별론가?
댓글 없음:
댓글 쓰기