Home

Awesome

Posh-Sysmon

PowerShell 3.0 or above module for creating and managing Sysinternals Sysmon v2.0 config files. System Monitor (Sysmon) is a Windows system service and device driver that is part of the SysInternal tools from Microsoft. It is written by Mark Russinovich and Thomas Garnier to monitor a Windows system actions and log such actions in to the Windows Event Log. When the tool is installed on a system it can be given a XML configuration file so as to control what is logged and the same file can be used to update the configuration of a previously installed instance of the tool.

All functions in the PowerShell module include help information and example of usage that can be view using the Get-Help cmdlet.

Installation

For installation it is highly recomended that you install from the PowerShell Gallery using the Install-Module cmdlet.

On PowerShell v5 and above:

Install-Module -Name Posh-Sysmon

If you are running PS 3.0 to 4.0 you can use the PowerShell Gallery also following instruction in PowerShell Gallery Documentation

Change Log

Version 1.2

Version 1.0

Version 0.7.6

Version 0.7.5

Version 0.7.3

Version 0.7.2

Version 0.7.1

Version 0.7

Version 0.6

Version 0.5

Version 0.4

Version 3.0 is a full re-write om how rules work and new event types. This update is SysMon 3.0 only. If you wish to work on SysMon 2.0 rules I recommend you use version 0.3 version of the module.

Version 0.3

Version 0.2

Version 0.1

Examples

Create a XML Configuration File

<pre> PS C:\> New-SysmonConfiguration -Path .\pc_marketing.xml -HashingAlgorithm IMPHASH,SHA1 -Network -Comment "Sysmon config for deployment in the Marketing PC OU" -Verbose VERBOSE: Enabling hashing algorithms : IMPHASH,SHA1 VERBOSE: Enabling network connection logging. VERBOSE: Config file created as C:\pc_marketing.xml </pre>

Get configured Rules and Filters

<pre> PS C:\> Get-SysmonRule -Path .\pc_marketing.xml EventType : NetworkConnect Scope : Filtered DefaultAction : Exclude Filters : {@{EventField=Image; Condition=Image; Value=C:\Windows\System32\svchost.exe}, @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Internet Explorer\iexplore.exe}, @{EventField=Image; Condition=Image; Value=C:\Program Files\Internet Explorer\iexplore.exe}, @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe}...} PS C:\> Get-SysmonRules -Path .\pc_marketing.xml | select -ExpandProperty Filters EventField Condition Value ---------- --------- ----- Image Image C:\Windows\System32\svchost.exe Image Image C:\Program Files (x86)\Internet Explorer\iexplo... Image Image C:\Program Files\Internet Explorer\iexplore.exe Image Image C:\Program Files (x86)\Google\Chrome\Applicatio... Image Image C:\Program Files (x86)\PuTTY\putty.exe Image Image C:\Program Files (x86)\PuTTY\plink.exe Image Image C:\Program Files (x86)\PuTTY\pscp.exe Image Image C:\Program Files (x86)\PuTTY\psftp.exe </pre>

Create or Update a Rule and its Default Action

<pre> PS C:\> Set-SysmonRule -Path .\pc_marketing.xml -EventType ImageLoad -Verbose VERBOSE: No rule for ImageLoad was found. VERBOSE: Creating rule for event type with action of Exclude VERBOSE: Action has been set. EventType : ImageLoad Scope : All Events DefaultAction : Exclude Filters : </pre>

Remove One or More Filters

<pre> PS C:\> Get-SysmonRule -Path .\pc_marketing.xml -EventType NetworkConnect EventType : NetworkConnect Scope : Filtered DefaultAction : Exclude Filters : {@{EventField=Image; Condition=Image; Value=C:\Windows\System32\svchost.exe}, @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Internet Explorer\iexplore.exe}, @{EventField=Image; Condition=Image; Value=C:\Program Files\Internet Explorer\iexplore.exe}, @{EventField=Image; Condition=Image; Value=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe}...} PS C:\> Remove-SysmonRuleFilter -Path .\pc_marketing.xml -EventType NetworkConnect -Condition Image -EventField Image -Value $images -Verbose VERBOSE: Filter for field Image with condition Image and value of C:\Windows\System32\svchost.exe removed. VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\Internet Explorer\iexplore.exe removed. VERBOSE: Filter for field Image with condition Image and value of C:\Program Files\Internet Explorer\iexplore.exe removed. VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\Google\Chrome\Application\chrome.exe removed. VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\putty.exe removed. VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\plink.exe removed. VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\pscp.exe removed. VERBOSE: Filter for field Image with condition Image and value of C:\Program Files (x86)\PuTTY\psftp.exe removed. EventType : NetworkConnect Scope : All Events DefaultAction : Exclude Filters : </pre>

Remove Rule

<pre> PS C:\> Remove-SysmonRule -Path .\pc_marketing.xml -EventType ImageLoad,NetworkConnect -Verbose VERBOSE: Removed rule for ImageLoad. VERBOSE: Removed rule for NetworkConnect. </pre>