Sysmon-PowerShell
May 9, 2018 ยท View on GitHub
This project demonstrates basic Sysmon usage, the various events associated with sysmon and how to invoke them.
| Event ID | Description |
|---|---|
| 1 | Process Creation |
| 2 | A process changed a file creation time |
| 3 | Network connection |
| 4 | Sysmon service state changed |
| 5 | Process terminated |
| 6 | Driver loaded |
| 7 | Image loaded |
| 8 | CreateRemoteThread |
| 9 | RawAccessRead |
| 10 | ProcessAccess |
| 11 | FileCreate |
| 12 | RegistryEvent (Object create and delete) |
| 13 | RegistryEvent (Value Set) |
| 14 | RegistryEvent (Key and Value Rename) |
| 15 | FileCreateStreamHash |
| 16 | Sysmon configuration change |
| 17 | PipeEvent (Pipe Created) |
| 18 | PipeEvent (Pipe Connected) |
| 19 | WmiEvent (WmiEventFilter activity detected) |
| 20 | WmiEvent (WmiEventConsumer activity detected) |
| 21 | WmiEvent (WmiEventConsumerToFilter activity detected) |
PowerShell is used to walk through the various event invocations.