ADLOG-007: Indicador de despliegue de Sysmon
- Plataforma
- Active Directory
- Categoría
- AD Logging & EDR Posture
- Severidad
- Medium
- Pilar de Zero Trust
- Visibility & Analytics (peso 1)
- Fixtures de referencia
- 1
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Sysmon (System Monitor, de Sysinternals) es la fuente de telemetría de endpoint de referencia para los eventos que el registro nativo de Windows no cubre bien: hash de archivo en la creación de procesos, conexiones de red por proceso, cargas de DLL, supervisión del registro y canalizaciones con nombre. Se ejecuta como un controlador en modo kernel. No hay detección desde el lado de GPO de 'Sysmon está instalado' solo desde SYSVOL: el indicador es la presencia de una GPO de configuración de Sysmon o un script de inicio que lo despliega. Esta comprobación genera una ADVERTENCIA y pide al auditor que lo verifique por otra vía.
Por qué importa
Native Windows auditing has well-known gaps that attackers rely on. Process creation events (4688) carry the command line only when Include command line in process creation events is enabled, do not include the image SHA256, and do not record parent process command line. Native logging records no per-process network connections at all (the closest equivalent is Windows Filtering Platform events 5156/5157, which are noisy and not attributed cleanly). DLL load events do not exist in the Security log. Registry auditing requires SACLs on every key of interest and produces low-fidelity 4657 events. Sysmon fills every one of these gaps: Event ID 1 for process creation with hash and parent context, Event ID 3 for network connections per process, Event ID 7 for image loads, Event ID 10 for process access (credential dumping primitive), Event ID 11 for file creation, Event ID 12/13/14 for registry, Event ID 17/18 for named pipes, Event ID 19/20/21 for WMI subscription, Event ID 22 for DNS queries, and Event ID 25 for process tampering. Without Sysmon (or an EDR that exposes equivalent kernel telemetry), the SOC is structurally blind to LSASS handle opens, process hollowing, named pipe lateral movement, and most living-off-the-land binaries. An attacker who lands on an unmonitored host can stage tooling, dump credentials, and pivot without generating actionable evidence. The presence of Sysmon is a baseline maturity signal; its absence on workstations and member servers is one of the highest-leverage gaps a defender can close.
Ruta de ataque
Sysmon is not a vulnerability and is not directly exploited. The attack path is the absence of telemetry that Sysmon would provide, which enables techniques to proceed undetected. A representative adversary sequence on an un-Sysmoned host: Step 1: Initial access. The attacker executes a payload via phishing macro, ISO+LNK, or HTML smuggling. Native 4688 records the parent process and image path but no hash and no parent command line. The SOC sees winword.exe launching powershell.exe but cannot reconstruct the powershell.exe command line without an additional source. Sysmon Event 1 would record the full command line, image SHA256, parent command line, integrity level, and the user logon GUID. Step 2: Credential access. The attacker opens a handle to LSASS to read memory (Mimikatz, nanodump, comsvcs.dll MiniDump). Native logging produces no event for OpenProcess against LSASS unless object access auditing is enabled on the System ACL of the LSASS process token, which it is not by default. Sysmon Event 10 with rule GrantedAccess 0x1010, 0x1410, or 0x1438 against lsass.exe is the canonical detection. Step 3: Lateral movement. The attacker uses SMB named pipes for PsExec or Impacket-style execution. Native logging records 4624 type 3 logons and 5145 share access events. Sysmon Event 17/18 records the actual pipe name and the process that created or connected to it, which differentiates PsExec from SMBExec from wmiexec. Step 4: Persistence. The attacker installs a WMI event subscription (ActiveScriptEventConsumer or CommandLineEventConsumer). Native logging is silent. Sysmon Event 19/20/21 records the subscription creation with full filter and consumer text. Step 5: Defense evasion. On a host where Sysmon is deployed, the attacker may attempt to disable the service or unload the driver via fltMC unload SysmonDrv or sc stop. This corresponds to T1562.001. ADLOG-007 only catches the deployment indicator; companion checks (and the EDR) should catch the unload.
Cómo lo evalúa Guerrilla
Guerrilla enumerates GPOs via the GroupPolicy module (Get-GPO -All) and downloads the SYSVOL contents for each. For every GPO it parses Machine\Scripts\scripts.ini and grep-scans the referenced script files for the literal strings Sysmon.exe, Sysmon64.exe, SysmonDrv, sysmon -i, sysmon -accepteula, and known config repository URLs (raw.githubusercontent.com/SwiftOnSecurity, github.com/olafhartong/sysmon-modular). It parses Preferences XML for Files (sysmon*.exe in copy operations), Registry (HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv or Sysmon64), and Scheduled Tasks (action invokes a Sysmon binary). It also reads SoftwareInstallation.xml for MSI packages whose ProductName contains Sysmon. If any signal is found, the check returns INFO with the GPO name and the matching artifact path. If no signal is found, the check returns WARN with text instructing the operator to validate at the host layer: Get-CimInstance -ClassName Win32_Service -Filter "Name='Sysmon64' OR Name='Sysmon'" -ComputerName <sample host>, or Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational -MaxEvents 1. The WARN level is intentional because the absence of a GPO signal does not prove the absence of Sysmon (config-management platforms are common and leave no GPO trace).
Valor recomendado
Sysmon está instalado en estaciones de trabajo y servidores mediante una GPO de despliegue o un envío desde la gestión de configuración, con una configuración ajustada al entorno (SwiftOnSecurity, Olaf Hartong o líneas base proporcionadas por el proveedor).
Remediación
Despliega Sysmon (https://download.sysinternals.com/files/Sysmon.zip) mediante un script de inicio de GPO o tu plataforma de gestión de configuración. Usa una línea base de la comunidad como punto de partida (SwiftOnSecurity/sysmon-config u Olaf Hartong/sysmon-modular). Verifica el despliegue mediante Get-CimInstance Win32_Service -Filter "Name='Sysmon64'" en un conjunto representativo de hosts, o consulta al recopilador WEF los eventos de 'Microsoft-Windows-Sysmon/Operational'.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| always-warn | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- AU-2, SI-4
- CIS AD Benchmark
- 9.4.2
- MITRE ATT&CK
- T1562.001