1. Triage Priority Matrix

Priority is based on event combinations, not individual events. Work top to bottom.

P1 — Drop Everything (Active Breach Indicators)

P2 — Investigate Within 1 Hour

P3 — Investigate Same Shift

P4 — Review Next Business Day

2. Log Source Decision Tree

Check log sources in this order based on investigation type.

3. Pivot Field Maps

Chain events using shared fields. Find something suspicious → pivot to the next event.

Authentication Chain

Process Chain

Network Chain

Persistence Chain

4. Investigation Timeline Reconstruction

Build a chronological event chain from anchor to full scope.

Step 1: Identify Your Anchor Event

Start with the anchor event. Extract these fields:

Step 2: Expand Backward (How Did We Get Here?)

# From a suspicious process — walk up the process tree
index=sysmon EventCode=1 Computer="HOST" ProcessId="SUSPECT_PID"
| table _time, Image, CommandLine, ParentImage, ParentProcessId, LogonId, User

# Then find the parent
index=sysmon EventCode=1 Computer="HOST" ProcessId="PARENT_PID"
| table _time, Image, CommandLine, ParentImage, ParentProcessId

# From a LogonId — find the original logon
index=wineventlog EventCode=4624 Computer="HOST" TargetLogonId="0xABC123"
| table _time, TargetUserName, LogonType, IpAddress, AuthenticationPackageName, WorkstationName

Step 3: Expand Forward (What Happened Next?)

# All activity in a logon session
index=wineventlog (TargetLogonId="0xABC123" OR SubjectLogonId="0xABC123") Computer="HOST"
| sort _time
| table _time, EventCode, TargetUserName, SubjectUserName

# All processes spawned by a parent
index=sysmon EventCode=1 Computer="HOST" ParentProcessId="SUSPECT_PID"
| sort _time
| table _time, Image, CommandLine, ProcessId

# All network connections from a process
index=sysmon EventCode=3 Computer="HOST" ProcessId="SUSPECT_PID"
| table _time, DestinationIp, DestinationPort, Initiated

Step 4: Build the Unified Timeline

# Full session reconstruction: logon → activity → logoff
index=wineventlog Computer="HOST"
  (EventCode IN (4624,4634,4672,4688,4698,5140,5145,1102)
   AND (TargetLogonId="0xABC123" OR SubjectLogonId="0xABC123"))
  OR EventCode=7045
# NOTE: 7045 (System log) has no LogonId — included unfiltered, correlate by time
| append
  [search index=sysmon Computer="HOST" LogonId="0xABC123"
   EventCode IN (1,3,7,10,11,13,22)]
| sort _time
| eval event_type=case(
    EventCode=4624, "LOGON",
    EventCode=4634, "LOGOFF",
    EventCode=4688 OR EventCode=1, "PROCESS",
    EventCode=3, "NETWORK",
    EventCode=5140 OR EventCode=5145, "SHARE_ACCESS",
    EventCode=10, "PROCESS_ACCESS",
    EventCode=13, "REGISTRY",
    EventCode=22, "DNS",
    EventCode=7045, "SERVICE_INSTALL",
    EventCode=4698, "SCHED_TASK",
    1=1, "OTHER"
  )
| eval Image=coalesce(Image, NewProcessName)
| table _time, event_type, EventCode, Image, CommandLine, TargetImage,
    DestinationIp, ShareName, RelativeTargetName, TargetObject, QueryName

Step 5: Expand to Other Hosts

# If lateral movement detected — find where they went
index=wineventlog EventCode=4624 LogonType IN (3,10) IpAddress="SOURCE_IP"
| stats count, values(LogonType) as logon_types, earliest(_time) as first_seen, latest(_time) as last_seen by Computer, TargetUserName
| sort first_seen

# Then repeat Steps 2-4 on each target host

5. Playbook: Compromised Account

Phase 1: Scope the Compromise (15 min)

# 1. Find all logon activity for this account (last 7 days)
index=wineventlog EventCode=4624 TargetUserName="SUSPECT_USER"
| stats count by Computer, LogonType, IpAddress, AuthenticationPackageName
| sort - count

# 2. Check for logon failures preceding success (brute force?)
index=wineventlog EventCode IN (4624,4625) TargetUserName="SUSPECT_USER"
| sort _time | table _time, EventCode, IpAddress, LogonType, Status, SubStatus

# 3. Check for explicit credential use (RunAs, credential theft)
index=wineventlog EventCode=4648 SubjectUserName="SUSPECT_USER"
| table _time, TargetUserName, TargetServerName, ProcessName

# 4. Check for Kerberos anomalies
index=wineventlog EventCode IN (4768,4769) TargetUserName="SUSPECT_USER"
| table _time, EventCode, IpAddress, TicketEncryptionType, ServiceName, Status

Phase 2: Assess Impact (30 min)

# 5. What did they access? (shares, files)
index=wineventlog EventCode IN (5140,5145) SubjectUserName="SUSPECT_USER"
| stats count values(RelativeTargetName) as files by ShareName, Computer
| sort - count

# 6. What processes did they run?
index=sysmon EventCode=1 User="*\\SUSPECT_USER"
| table _time, Computer, Image, CommandLine, ParentImage
| sort _time

# 7. Did they create persistence?
# NOTE: 7045 (System log) does not record installing user; correlate with 4697 or Sysmon 1 for attribution
index=wineventlog (EventCode IN (4698,4720) SubjectUserName="SUSPECT_USER") OR (EventCode=7045)
| table _time, EventCode, Computer, TaskName, ServiceName, TargetUserName, ImagePath

# 8. Did they move laterally?
index=wineventlog EventCode=4624 LogonType IN (3,10) TargetUserName="SUSPECT_USER"
| stats count by Computer, IpAddress, LogonType | sort - count

Phase 3: Contain & Remediate

• Reset password + revoke all Kerberos tickets (klist purge or reset krbtgt if domain-wide)
• Disable account if confirmed compromised
• Check for new accounts created (4720) by this user
• Check for group membership changes (4728/4732/4756) by this user
• Review all hosts where LogonType 3/10 was observed

6. Playbook: Malware Execution

Phase 1: Build the Process Tree (10 min)

# 1. Find the suspicious process and its full chain
index=sysmon EventCode=1 Computer="HOST" Image="*\\SUSPECT.exe"
| table _time, ProcessId, Image, CommandLine, ParentImage, ParentProcessId, User, Hashes, LogonId

# 2. Walk up: What launched it?
index=sysmon EventCode=1 Computer="HOST" ProcessId="PARENT_PID"
| table _time, Image, CommandLine, ParentImage, ParentProcessId
# Repeat until you reach explorer.exe, services.exe, or the initial vector

# 3. Walk down: What did it spawn?
index=sysmon EventCode=1 Computer="HOST" ParentProcessId="SUSPECT_PID"
| sort _time | table _time, Image, CommandLine, ProcessId

Phase 2: Assess Behavior (15 min)

# 4. Network connections (C2?)
index=sysmon EventCode=3 Computer="HOST" ProcessId="SUSPECT_PID"
| table _time, DestinationIp, DestinationPort, DestinationHostname

# 5. DNS queries (what did it resolve?)
index=sysmon EventCode=22 Computer="HOST" ProcessId="SUSPECT_PID"
| table _time, QueryName, QueryResults

# 6. Files dropped
index=sysmon EventCode=11 Computer="HOST" ProcessId="SUSPECT_PID"
| table _time, TargetFilename, Hashes

# 7. Registry changes (persistence?)
index=sysmon EventCode IN (12,13) Computer="HOST" ProcessId="SUSPECT_PID"
| table _time, EventCode, TargetObject, Details

# 8. Did it access LSASS? (credential theft)
index=sysmon EventCode=10 Computer="HOST" SourceProcessId="SUSPECT_PID" TargetImage="*\\lsass.exe"
| table _time, GrantedAccess, CallTrace

Phase 3: Scope & Contain

# 9. Check hash across environment (did it spread?)
index=sysmon EventCode=1 Hashes="*SUSPECT_HASH*"
| stats count by Computer | sort - count

# 10. Check if the same C2 IPs appear elsewhere
index=sysmon EventCode=3 DestinationIp="C2_IP"
| stats count by Computer, Image | sort - count

7. Playbook: Lateral Movement

Phase 1: Confirm & Identify Source (10 min)

# 1. On the TARGET host — find the inbound logon
index=wineventlog EventCode=4624 Computer="TARGET" LogonType IN (3,10)
  earliest=-1h
| where NOT match(IpAddress, "known_admin_subnet")
| table _time, TargetUserName, IpAddress, WorkstationName, LogonType,
    AuthenticationPackageName, TargetLogonId

# 2. What happened immediately after logon?
# NOTE: 7045 has no SubjectLogonId — search separately or correlate by time
index=wineventlog Computer="TARGET" SubjectLogonId="LOGON_ID"
  EventCode IN (4688,5140,5145,4698)
| sort _time
| table _time, EventCode, NewProcessName, CommandLine, ShareName, RelativeTargetName

# 3. Check for service install or sched task (PsExec signature)
index=wineventlog Computer="TARGET" EventCode IN (7045,4697)
  earliest=-1h
| eval account=coalesce(AccountName, ServiceAccount)
| table _time, EventCode, ServiceName, ImagePath, ServiceFileName, account

Phase 2: Investigate the Source Host (15 min)

# 4. What was happening on the SOURCE at the time?
index=sysmon EventCode=1 Computer="SOURCE" earliest=-30m@m latest=+30m@m
| table _time, Image, CommandLine, User, ParentImage | sort _time

# 5. How did the SOURCE get compromised? (look for inbound lateral movement)
index=wineventlog EventCode=4624 Computer="SOURCE" LogonType IN (3,10)
  earliest=-24h
| table _time, TargetUserName, IpAddress, LogonType | sort _time

# 6. Check for credential dumping on SOURCE
index=sysmon EventCode=10 Computer="SOURCE" TargetImage="*\\lsass.exe"
  earliest=-24h
| table _time, SourceImage, GrantedAccess, CallTrace

Phase 3: Map the Full Lateral Path

# 7. Find ALL hosts this account touched
index=wineventlog EventCode=4624 TargetUserName="SUSPECT_USER" LogonType IN (3,10)
| stats earliest(_time) as first_seen latest(_time) as last_seen count
  by Computer, IpAddress
| sort first_seen

8. Playbook: Credential Dumping

Phase 1: Confirm the Dump (5 min)

# 1. Examine the LSASS access event
index=sysmon EventCode=10 Computer="HOST" TargetImage="*\\lsass.exe"
  earliest=-1h
| table _time, SourceImage, SourceProcessId, GrantedAccess, CallTrace

# 2. Is CallTrace showing UNKNOWN (shellcode)?
#    Is GrantedAccess 0x143A/0x1038/0x1FFFFF?
#    Is SourceImage from a temp/user directory?
#    If YES to any → confirmed credential dump. Go to Phase 2.

# 3. Check the source process
index=sysmon EventCode=1 Computer="HOST" ProcessId="SOURCE_PID"
| table _time, Image, CommandLine, ParentImage, User, Hashes

Phase 2: Assess Blast Radius (15 min)

# 4. What accounts were logged in at the time? (all are potentially compromised)
index=wineventlog EventCode=4624 Computer="HOST"
  earliest=-24h latest=+0h
| dedup TargetUserName
| table TargetUserName, LogonType, IpAddress
# ALL of these accounts should be considered compromised

# 5. Check for DCSync (domain-wide escalation)
index=wineventlog EventCode=4662
| where match(Properties, "1131f6aa|1131f6ad|89e95b76")
| where NOT match(SubjectUserName, "\$$")
| table _time, SubjectUserName, Computer

# 6. Check for Pass-the-Hash activity (using stolen hashes)
index=wineventlog EventCode=4624 LogonType=3 AuthenticationPackageName="NTLM"
  TargetUserName IN ("COMPROMISED_USER1","COMPROMISED_USER2")
  earliest=-1h
| table _time, Computer, IpAddress, TargetUserName

Phase 3: Contain

• Reset passwords for ALL accounts that had active sessions on the compromised host
• If DCSync confirmed: reset krbtgt password TWICE (with 12hr gap)
• If service accounts compromised: rotate all service account passwords
• Monitor for new logons from previously compromised accounts

9. Playbook: Ransomware Precursors

Phase 1: Confirm & Isolate IMMEDIATELY (5 min)

# 1. Confirm ransomware precursors
index=sysmon EventCode=1 Computer="HOST"
| where match(CommandLine, "(?i)vssadmin.*delete|wmic.*shadowcopy.*delete|bcdedit.*recoveryenabled.*no|wbadmin.*delete.*catalog")
| table _time, Image, CommandLine, User, ParentImage

# IF CONFIRMED: ISOLATE THE HOST FROM NETWORK IMMEDIATELY

# 2. Check for encryption activity (mass file operations)
index=sysmon EventCode=11 Computer="HOST" earliest=-30m
| stats count by TargetFilename
| rex field=TargetFilename "(?<ext>\.[^.]+)$"
| stats count by ext | sort - count
# Look for unusual extensions (.encrypted, .locked, .crypt, ransom notes)

Phase 2: Scope the Spread (10 min)

# 3. Did the ransomware spread? Check same indicators on other hosts
index=sysmon EventCode=1
| where match(CommandLine, "(?i)vssadmin.*delete|wmic.*shadowcopy.*delete")
| stats count by Computer | sort - count

# 4. Check lateral movement FROM the infected host
index=wineventlog EventCode=4624 LogonType=3 IpAddress="INFECTED_HOST_IP"
| stats count by Computer, TargetUserName | sort - count

# 5. Check for the deployment mechanism
index=sysmon EventCode=1 Computer="HOST" earliest=-2h
| where match(ParentImage, "(?i)psexec|wmic|powershell|cmd")
| table _time, ParentImage, Image, CommandLine | sort _time

Phase 3: Immediate Actions

• Isolate ALL confirmed and suspected hosts
• Disable the compromised account(s) domain-wide
• Check for Group Policy modification (ransomware deployed via GPO?)
• Preserve evidence: memory dump before reboot
• Check backup integrity BEFORE attempting restoration

10. Playbook: Data Staging & Exfiltration

Phase 1: Identify Staging Activity (15 min)

# 1. Archive tool usage
index=sysmon EventCode=1 Computer="HOST"
| where match(Image, "(?i)rar|7z|zip|tar") OR match(CommandLine, "(?i)Compress-Archive|makecab")
| table _time, User, Image, CommandLine, ParentImage

# 2. Large files created (staging archives)
index=sysmon EventCode=11 Computer="HOST"
| where match(TargetFilename, "(?i)\\.rar$|\\.7z$|\\.zip$|\\.tar$|\\.gz$")
| table _time, Image, TargetFilename

# 3. Sensitive file access
index=wineventlog EventCode=5145 SubjectUserName="SUSPECT"
| where match(RelativeTargetName, "(?i)confidential|sensitive|finance|hr|legal|password|secret")
| table _time, Computer, ShareName, RelativeTargetName

Phase 2: Identify Exfil Channel (15 min)

# 4. Unusual outbound connections from staging host
index=sysmon EventCode=3 Computer="HOST" Initiated=true
| where NOT match(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)")
| stats count as connections values(DestinationPort) as ports by Image, DestinationIp
| sort - connections

# 5. BITS transfers (common exfil mechanism)
index=wineventlog source="*BITS*" EventCode IN (3,4,59) Computer="HOST"
| table _time, EventCode, Computer

# 6. DNS exfil check (high volume of DNS queries from single process)
index=sysmon EventCode=22 Computer="HOST"
| stats count dc(QueryName) as unique_domains by Image
| where unique_domains > 100 | sort - unique_domains

11. Playbook: Insider Threat

# 1. Off-hours activity
index=wineventlog EventCode IN (4624,4688,5145) (TargetUserName="SUSPECT" OR SubjectUserName="SUSPECT")
| eval hour=tonumber(strftime(_time, "%H"))
| where hour >= 20 OR hour <= 5
| stats count by EventCode, hour, Computer | sort hour

# 2. Print volume (data exfil via paper)
index=wineventlog source="*PrintService*" EventCode=307
# NOTE: param2 = user who printed, param1 = document name
| where match(param2, "(?i)SUSPECT")
| stats count by param2, param1, Computer | sort - count

# 3. USB device connections
index=wineventlog EventCode=6416 Computer="SUSPECTS_WORKSTATION"
| table _time, SubjectUserName, DeviceDescription, ClassName

# 4. Abnormal share access patterns
index=wineventlog EventCode=5145 SubjectUserName="SUSPECT"
| stats count dc(RelativeTargetName) as unique_files by ShareName, Computer
| sort - unique_files

# 5. Email attachment volume (if Exchange/O365 logs available)
# Check for large attachment sends, forwarding rules, mailbox exports

# 6. Cloud upload activity (if proxy/CASB logs available)
# Check for uploads to personal cloud storage (Dropbox, GDrive, OneDrive personal)

12. Common False Positive Guide

Known-good patterns. Verify before closing — don't burn hours on these.

Event 10 (LSASS ProcessAccess) — Known Good

Event 4624 (Logon) — Known Good

Event 7045 (New Service) — Known Good

Red flags even in "known" services: ImagePath pointing to \Temp\, \Users\, or containing cmd.exe /c, powershell -enc, or pipe characters.

Event 4688/Sysmon 1 (Process Creation) — Known Good

Event 4698 (Scheduled Task) — Known Good

Sysmon Event 3 (NetworkConnect) — Noisy but Normal

13. MITRE ATT&CK Event Mapping

Event IDs mapped to ATT&CK techniques by tactic.

Initial Access (TA0001)

Execution (TA0002)

Persistence (TA0003)

Privilege Escalation (TA0004)

Defense Evasion (TA0005)

Credential Access (TA0006)

Discovery (TA0007)

Lateral Movement (TA0008)

Exfiltration (TA0010)

14. Quick Triage Checklists

Work top to bottom. Check the box, move on.

Checklist: Suspicious Logon

[ ] Identify the logon: EventCode=4624, note TargetUserName, LogonType, IpAddress, TargetLogonId
[ ] Check LogonType: Type 3 (network) or 10 (RDP) from unexpected source?
[ ] Check AuthenticationPackageName: NTLM where Kerberos expected?
[ ] Check IpAddress: Known asset? Expected subnet? VPN or external?
[ ] Check time: Business hours? Expected for this user?
[ ] Check for preceding 4625 failures from same IP (brute force?)
[ ] Pivot on TargetLogonId: What did this session do? (4688, 5140, 5145)
[ ] Pivot on IpAddress: Any other accounts from this source?
[ ] Check source host: Was it recently compromised?
[ ] VERDICT: Legitimate / Suspicious / Confirmed Malicious
[ ] ACTIONS: Document / Escalate / Contain

Checklist: Suspicious Process

[ ] Identify process: Sysmon 1, note Image, CommandLine, ParentImage, ProcessId, User
[ ] Check parent: Is this parent-child relationship normal? (e.g., winword → cmd = BAD)
[ ] Check path: Is the executable running from expected location?
[ ] Check command line: Encoded? Unusually long? Contains URLs or UNC paths?
[ ] Check OriginalFileName: Does it match the actual filename? (masquerading?)
[ ] Check Hashes: Run through VT/threat intel
[ ] Check children: Did this process spawn anything? (Sysmon 1, ParentProcessId=this PID)
[ ] Check network: Did this process connect out? (Sysmon 3, ProcessId=this PID)
[ ] Check file drops: Did this process create files? (Sysmon 11, ProcessId=this PID)
[ ] Check registry: Did this process modify persistence keys? (Sysmon 13)
[ ] Check LSASS: Did this process access LSASS? (Sysmon 10)
[ ] VERDICT: Legitimate / Suspicious / Malicious
[ ] ACTIONS: Document / Kill process / Isolate host / Scope to other hosts via hash

Checklist: New Service / Scheduled Task

[ ] Identify: Event 7045/4697 (service) or 4698 (task). Note name, path/command, account
[ ] Check ImagePath/Command: Points to Windows/Program Files (normal) or Temp/Users (suspicious)?
[ ] Check for obfuscation: Does the path contain cmd /c, powershell -enc, pipe characters?
[ ] Check the account: LocalSystem for a non-Microsoft service? Non-admin creating the task?
[ ] Check the creator: Who/what created it? (SubjectUserName for 4697/4698; 7045 does NOT record creator — correlate with Sysmon 1 or Security 4697)
[ ] For tasks: Is it Hidden? RegistrationTrigger (immediate)? BootTrigger/LogonTrigger?
[ ] Check timing: Was this during a change window? Does a change ticket exist?
[ ] Check the binary: Hash lookup, signature check, file path analysis
[ ] Check if the service/task already executed (Task Scheduler 200, Sysmon 1 matching command)
[ ] VERDICT: Legitimate / Suspicious / Malicious
[ ] ACTIONS: Document / Disable service/task / Investigate binary / Scope

Checklist: LSASS Access Alert

[ ] Identify: Sysmon 10, note SourceImage, GrantedAccess, CallTrace
[ ] Check SourceImage: Is it a known security product? (see False Positive Guide)
[ ] Check GrantedAccess: 0x1000/0x0400 = likely benign. 0x143A/0x1038/0x1FFFFF = investigate
[ ] Check CallTrace: Contains "UNKNOWN"? → HIGH CONFIDENCE MALICIOUS (injected code)
[ ] Check CallTrace: Contains comsvcs.dll? → MiniDump technique
[ ] Check CallTrace: Contains dbghelp.dll? → Debug/dump technique
[ ] If suspicious: Examine the source process (Sysmon 1, same ProcessId)
[ ] Check source process parent chain (walk up the tree)
[ ] Check source process network activity (Sysmon 3)
[ ] Determine accounts at risk: All sessions active on this host at time of dump
[ ] VERDICT: False Positive / Confirmed Credential Dump
[ ] ACTIONS: If confirmed → isolate host, reset ALL active session passwords, check for lateral movement

15. Windows Process Baseline

Know normal to find evil. If any of these deviate, investigate immediately.

Windows Boot Process Chain

UEFI/BIOS → bootmgr → winload.exe → ntoskrnl.exe
  → smss.exe (Session Manager)
    → csrss.exe (Session 0) + wininit.exe
      wininit.exe → services.exe → svchost.exe (many)
                  → lsass.exe (EXACTLY ONE)
    → csrss.exe (Session 1) + winlogon.exe
      winlogon.exe → userinit.exe → explorer.exe

Any deviation from this tree = suspicious.

svchost.exe Service Groups

16. Suspicious Parent-Child Relationships

Critical — Almost Always Malicious

winword.exe  → cmd.exe → powershell.exe    (macro execution)
winword.exe  → powershell.exe (direct)         (macro execution)
excel.exe    → cmd.exe / powershell.exe / mshta (macro execution)
outlook.exe  → powershell.exe                   (email-based attack)
w3wp.exe     → cmd.exe                          (web shell)
sqlservr.exe → cmd.exe / powershell.exe          (SQL injection)
wmiprvse.exe → powershell.exe                   (WMI lateral movement)
wsmprovhost.exe → powershell.exe                (WinRM lateral movement)

Suspicious — Investigate Arguments

explorer.exe   → cmd.exe → powershell.exe  (check args for -enc, downloads)
svchost.exe    → cmd.exe                       (possible injection into svchost)
services.exe   → cmd.exe                       (service executing shell)
taskhostw.exe  → suspicious child               (scheduled task abuse)
rundll32.exe   → cmd.exe / powershell.exe       (LOLBin chaining)
mshta.exe      → cmd.exe / powershell.exe       (HTA-based attack)
cscript/wscript → cmd.exe / powershell.exe      (script-based attack)
regsvr32.exe   → cmd.exe                        (Squiblydoo / AppLocker bypass)

Expected — Usually Benign

services.exe  → svchost.exe       svchost.exe  → WerFault.exe
explorer.exe  → [user apps]       userinit.exe → explorer.exe
smss.exe      → csrss.exe         wininit.exe  → services.exe
wininit.exe   → lsass.exe         winlogon.exe → userinit.exe

17. LOLBins Detection Reference

Living Off the Land Binaries — legitimate Windows tools abused by attackers.

Detection approach for all LOLBins:
  1. Unusual parent process (who launched it?)
  2. Unusual command-line arguments (what's it doing?)
  3. Network connections (shouldn't phone home)
  4. File writes to unusual locations (dropping payloads?)
  5. Execution from non-standard paths (masquerading?)

SPL (LOLBins with network connections):
  index=sysmon EventCode=3
  | where match(Image, "(?i)\\\\(certutil|mshta|regsvr32|rundll32|bitsadmin|msiexec|wmic|cmstp|msbuild|installutil)\\.exe$")
  | where NOT match(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)")
  | table _time, Computer, Image, DestinationIp, DestinationPort, User

18. Dangerous Privileges Reference

Hunt via Event 4672 (Special Privileges Assigned). Non-SYSTEM accounts with these = investigate.

# Track dangerous privilege usage (non-system accounts)
index=wineventlog EventCode=4672
| where match(PrivilegeList, "SeDebugPrivilege|SeImpersonatePrivilege|SeBackupPrivilege|SeRestorePrivilege|SeTcbPrivilege|SeLoadDriverPrivilege|SeCreateTokenPrivilege")
| where NOT match(SubjectUserName, "(?i)SYSTEM|LOCAL SERVICE|NETWORK SERVICE|DWM-|UMFD-")
| where NOT match(SubjectUserName, "\$$")
| stats count values(PrivilegeList) as privileges by SubjectUserName, Computer
| sort - count

19. Beaconing Interval Reference

# Beaconing detection via Sysmon Event 3
index=sysmon EventCode=3 Initiated=true
| where NOT match(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)")
| bin _time span=5m
| stats count by Image, DestinationIp, DestinationPort, _time, Computer
| streamstats current=f last(_time) as prev_time by Image, DestinationIp, Computer
| eval delta=_time-prev_time
| stats avg(delta) as avg_int, stdev(delta) as stdev_int, count
  by Image, DestinationIp, DestinationPort, Computer
| where count > 20 AND stdev_int < (avg_int * 0.2)
| eval jitter_pct=round((stdev_int/avg_int)*100,2)
| sort jitter_pct

20. Token Manipulation & Privilege Escalation

Token Theft (T1134.001)

Attack: Open high-privilege process → duplicate token → apply to attacker process
Target: winlogon.exe, lsass.exe, services.exe (requires SeDebugPrivilege)

Detection:
  Sysmon Event 10: ProcessAccess targeting winlogon/lsass/services
  Security Event 4696: Primary token assigned to process
  Security Event 4672: SeDebugPrivilege used (prerequisite)

Token Impersonation — Potato Exploits

Juicy/Sweet/Rotten/God Potato abuse SeImpersonatePrivilege
to escalate from service account → SYSTEM.

Detection:
  index=wineventlog EventCode=4672
  | where match(PrivilegeList, "SeImpersonatePrivilege")
  | where NOT match(SubjectUserName, "(?i)SYSTEM|LOCAL SERVICE|NETWORK SERVICE")
  | table _time, Computer, SubjectUserName, PrivilegeList

Make Token (Cobalt Strike)

Creates new logon session with stolen creds. Generates 4624 LogonType=9.

  index=wineventlog EventCode=4624 LogonType=9
  | where NOT match(TargetUserName, "(?i)SYSTEM|DWM-|UMFD-")
  | table _time, Computer, TargetUserName, SubjectUserName, IpAddress

Parent PID Spoofing

Process appears to have a legitimate parent but was actually spawned by attacker.
Detection: Cross-reference Sysmon Event 1 creation times.
  If "parent" started AFTER "child" → spoofed PPID.
ETW: Microsoft-Windows-Kernel-Process catches REAL parent even when PID is spoofed.

21. .NET Assembly / Execute-Assembly Detection

C# attack tools (Rubeus, SharpHound, Seatbelt, Certify, SharpDPAPI) require the .NET CLR. Detect via Sysmon Event 7.

CLR DLLs to Monitor

# Non-.NET process loading CLR (high-fidelity detection)
index=sysmon EventCode=7 (ImageLoaded="*\\clr.dll" OR ImageLoaded="*\\clrjit.dll")
| where NOT match(Image, "(?i)powershell|pwsh|csc\\.exe|msbuild\\.exe|w3wp\\.exe|dotnet\\.exe|mmc\\.exe|devenv\\.exe|sqlservr|dns\\.exe|wsmprovhost")
| where NOT match(Image, "(?i)\\\\Microsoft\\\\|\\\\Windows\\\\Microsoft\\.NET|Visual Studio|JetBrains")
| table _time, Computer, Image, ImageLoaded, User

# Classic execute-assembly pattern (rundll32/dllhost loading CLR)
index=sysmon EventCode=7
  (ImageLoaded="*\\clr.dll" OR ImageLoaded="*\\clrjit.dll" OR ImageLoaded="*\\mscoree.dll")
  Image IN ("*\\rundll32.exe", "*\\dllhost.exe", "*\\gpupdate.exe",
            "*\\msiexec.exe", "*\\searchprotocolhost.exe", "*\\svchost.exe")
| table _time, Computer, Image, ImageLoaded, User

# PowerShell engine in non-PowerShell process (unmanaged PS / CLM bypass)
index=sysmon EventCode=7 ImageLoaded="*\\System.Management.Automation.dll"
| where NOT match(Image, "(?i)powershell|pwsh|wsmprovhost|svchost|ConfigRemoting")
| table _time, Computer, Image, ImageLoaded, User

22. Service Abuse Detection

Attack Tool Service Patterns

# Comprehensive suspicious service detection (Event 7045)
index=wineventlog EventCode=7045
| eval suspicious=case(
    match(ImagePath, "(?i)cmd\\.exe|powershell|%COMSPEC%"), "CMD_IN_PATH",
    match(ImagePath, "(?i)\\\\Users\\\\|\\\\Temp\\\\|\\\\tmp\\\\|\\\\Downloads\\\\"), "USER_PATH",
    match(ImagePath, "(?i)-enc|-encoded|base64|hidden"), "ENCODED",
    match(ImagePath, "(?i)\\\\\\\\[0-9]|\\\\\\\\[a-zA-Z]"), "UNC_PATH",
    match(ImagePath, "(?i)rundll32|regsvr32|mshta"), "LOLBIN_SERVICE",
    NOT match(ImagePath, "^\"") AND match(ImagePath, " ") AND NOT match(ImagePath, "(?i)Windows|Program Files"), "UNQUOTED_PATH",
    len(ServiceName) < 4 OR match(ServiceName, "^[a-zA-Z]{7,16}$"), "RANDOM_NAME",
    1=1, "REVIEW"
  )
| where suspicious!="REVIEW"
| table _time, Computer, ServiceName, ImagePath, AccountName, suspicious | sort suspicious

# Unquoted service path (privilege escalation vector)
index=wineventlog EventCode=7045
| where NOT match(ImagePath, "^\"") AND match(ImagePath, " ")
  AND NOT match(ImagePath, "^C:\\\\Windows")
| table _time, Computer, ServiceName, ImagePath

# ServiceDll hijacking (Sysmon 13)
index=sysmon EventCode=13
| where match(TargetObject, "(?i)\\\\Services\\\\.*\\\\Parameters\\\\ServiceDll")
| table _time, Computer, Image, TargetObject, Details

23. COM Object Hijacking

No admin required. HKCU checked before HKLM. Attacker creates HKCU CLSID entry → their DLL loads instead.

Why It's Stealthy

No new process, no service, no scheduled task, no Run key. DLL loads into existing process when COM object is called. Most tools don't monitor HKCU CLSID changes.

Commonly Hijacked CLSIDs

# HKCU CLSID InprocServer32 creation (the attack itself)
index=sysmon EventCode IN (12, 13)
| where match(TargetObject, "(?i)HKU\\\\.*\\\\Classes\\\\CLSID\\\\.*\\\\InprocServer32")
  OR match(TargetObject, "(?i)HKCU\\\\.*\\\\Classes\\\\CLSID\\\\.*\\\\InprocServer32")
| where NOT match(Image, "(?i)msiexec|TiWorker|setup|install|update|DismHost|svchost")
| table _time, Computer, Image, TargetObject, Details

# DLL loaded from user path via COM (the result)
index=sysmon EventCode=7
| where match(ImageLoaded, "(?i)\\\\Users\\\\|\\\\Temp\\\\|\\\\AppData\\\\")
| where match(Image, "(?i)explorer\\.exe|svchost\\.exe|mmc\\.exe|eventvwr\\.exe")
| table _time, Computer, Image, ImageLoaded, Signed

24. DPAPI Backup Key Hunting

Domain Backup Key = master key to ALL DPAPI-protected secrets across the domain. Extractable by Domain Admins.

What It Unlocks

# Detect backup key extraction (Event 4662 targeting LSA secrets)
index=wineventlog EventCode=4662
| where match(Properties, "(?i)BCKUPKEY|currentValue")
| table _time, SubjectUserName, Computer, ObjectName, Properties

# Sysmon: Tools extracting backup key
index=sysmon EventCode=1
| where match(CommandLine, "(?i)backupkeys|lsadump::backupkeys|dpapi\\.py.*backupkey")
| table _time, Computer, User, Image, CommandLine

25. WMI Persistence Forensics

Fileless persistence via WMI event subscriptions. Survives reboots with no files on disk.

WMI Subscription Components

# All three must exist for a working subscription
# Sysmon 19/20/21 fire when each is created

# WMI persistent subscriptions (Sysmon)
index=sysmon EventCode IN (19, 20, 21)
| table _time, Computer, EventCode, Operation, User, Name, Query, Destination

# WMI-Activity operational log
index=wineventlog source="*WMI-Activity*" EventCode=5861
| table _time, Computer, Message

# WMI consumers executing suspicious commands
index=sysmon EventCode=20
| where match(Destination, "(?i)powershell|cmd|script|encoded|http|rundll32")
| table _time, Computer, Name, Destination

26. BITS Abuse Detection

Background Intelligent Transfer Service — used for downloads, exfil, and persistence.

# BITS persistence via NotifyCmdLine (runs command after transfer)
index=sysmon EventCode=1 Image="*\\bitsadmin.exe"
| where match(CommandLine, "(?i)SetNotifyCmdLine|/transfer.*http|addfile.*http")
| table _time, Computer, User, CommandLine

# BITS-Client events
index=wineventlog source="*BITS*" EventCode IN (3,4,59)
| table _time, Computer, EventCode, Message

27. Active Directory Attack Patterns

Kerberos Attacks Summary

AD Persistence Mechanisms

AD Enumeration Detection

# BloodHound-style LDAP enumeration
# High volume of LDAP queries for users, groups, computers, SPNs
index=wineventlog EventCode=4662
| where match(Properties, "bf967aba|bf967a86|bf967a9c")
| bin _time span=5m
| stats count dc(ObjectName) as objects by SubjectUserName, _time
| where objects > 50

# Sensitive LDAP query patterns
# (userAccountControl:1.2.840.113556.1.4.803:=4194304) = DONT_REQ_PREAUTH (AS-REP roastable)
# (servicePrincipalName=*) = Kerberoastable accounts
# (adminCount=1) = Admin accounts
# (msDS-AllowedToDelegateTo=*) = Delegation-enabled accounts

28. Scheduled Task Forensics — Beyond Event 4698

Task Scheduler artifacts exist in multiple locations. Cross-reference for complete coverage.

Hidden Task Discovery

# Compare tasks on disk vs visible via schtasks
# Hidden tasks exist on disk but don't show in Task Scheduler UI

# Event 200 (Action Started) shows the ACTUAL command executed
# This is more reliable than 4698's TaskContent XML for confirming execution
index=wineventlog source="*TaskScheduler*" EventCode=200
| table _time, Computer, TaskName, ActionName, Message

29. Incident Severity Matrix

30. Registry Persistence — Top Keys

Monitor via Sysmon Event 12 (key create/delete) and 13 (value set).

Persistence Keys

Defense Evasion Keys

# Comprehensive registry persistence sweep (Sysmon 12/13)
index=sysmon EventCode IN (12, 13)
| where match(TargetObject, "(?i)\\\\Run\\\\|\\\\RunOnce\\\\|\\\\Winlogon\\\\(Shell|Userinit)|Image File Execution Options.*Debugger|AppInit_DLLs|\\\\Print\\\\Monitors.*Driver|\\\\Lsa\\\\(Security|Authentication) Packages|\\\\Classes\\\\CLSID.*InprocServer32|BootExecute")
| table _time, Computer, EventCode, Image, TargetObject, Details | sort - _time

31. ShimDB Persistence

Application Compatibility shims inject DLLs or redirect execution. No Run keys, no services, no tasks — invisible to most tools.

Locations:
  C:\Windows\AppPatch\Custom\*.sdb
  C:\Windows\AppPatch\Custom\Custom64\*.sdb
  HKLM\...\AppCompatFlags\Custom
  HKLM\...\AppCompatFlags\InstalledSDB

# sdbinst.exe execution (shim installation)
index=sysmon EventCode=1 Image="*\\sdbinst.exe"
| table _time, Computer, User, CommandLine

# New .sdb files
index=sysmon EventCode=11
| where match(TargetFilename, "(?i)\\\\AppPatch\\\\Custom.*\\.sdb")
| table _time, Computer, Image, TargetFilename

# AppCompatFlags registry changes
index=sysmon EventCode IN (12, 13)
| where match(TargetObject, "(?i)AppCompatFlags\\\\(Custom|InstalledSDB)")
| table _time, Computer, Image, TargetObject, Details

32. Code Signing Forensics

Known Stolen Certificate Campaigns

Stuxnet:            Stolen Realtek + JMicron certs
Duqu:               Stolen C-Media cert
Flame:              Forged Microsoft cert (MD5 collision)
ShadowPad/CCleaner: Legitimate Piriform/Avast cert (supply chain)
NVIDIA leak:        Stolen NVIDIA certs used to sign malware
Various ransomware: Purchased or stolen EV certificates

# Modules loaded with invalid/expired/revoked signatures (Event 7, not Event 1)
index=sysmon EventCode=7
| where SignatureStatus IN ("Expired", "Revoked", "Invalid", "Error")
| table _time, Computer, Image, ImageLoaded, SignatureStatus, Signature

# Unsigned drivers (BYOVD indicator)
index=sysmon EventCode=6
| where Signed="false" OR SignatureStatus!="Valid"
| table _time, Computer, ImageLoaded, Signed, Signature, Hashes

# Certificate serial number as IOC (find other files from same stolen cert)
# PowerShell:
Get-AuthenticodeSignature C:\path\to\file.exe
# Then search: Get-ChildItem -Recurse *.exe | Where { (Get-AuthenticodeSignature $_).SignerCertificate.SerialNumber -eq "TARGET_SERIAL" }

33. WEF Architecture & Blind Spot Detection

If attackers disable WEF, your SIEM goes blind for that host.

How Attackers Disable Forwarding

# Detect hosts that stopped forwarding (blind spot detection)
index=wineventlog
| stats latest(_time) as last_event by Computer
| eval hours_since = round((now() - last_event) / 3600, 1)
| where hours_since > 4
| sort - hours_since
| table Computer, hours_since, last_event

# WinRM service stopped
index=wineventlog EventCode=7036
| where match(Message, "(?i)Windows Remote Management.*stopped")
| table _time, Computer, Message

# WEF manipulation tools
index=sysmon EventCode=1 Image IN ("*\\wecutil.exe", "*\\wevtutil.exe")
| where match(CommandLine, "(?i)/e:false|ds |sl.*ms:")
| table _time, Computer, User, CommandLine

34. Sigma-to-SPL Translation Reference

Convert community Sigma rules to production SPL queries.

Modifier Translation

Logsource Mapping

# Automated conversion
sigma convert -t splunk -p sysmon rules/credential_access/mimikatz.yml

35. AMSI Content & Tool Identification

Windows Defender Events 1116/1117 contain the actual threat name — use it to identify attacker tools.

Threat Name Decoding

Defender threat names follow a pattern:
  [Type]:[Platform]/[Family].[Variant]![Suffix]

Examples:
  HackTool:Win32/Mimikatz.D        = Mimikatz
  HackTool:Win64/Rubeus.A          = Rubeus (Kerberos attacks)
  HackTool:MSIL/SharpHound.A       = SharpHound (BloodHound collector)
  Trojan:Win32/CobaltStrike.B!dha  = Cobalt Strike beacon
  HackTool:Win32/Certify.A         = Certify (AD CS attacks)
  Behavior:Win32/Invoke-Mimikatz.A = PowerShell Mimikatz

Type prefixes: HackTool = offensive tool, Trojan = malware, Behavior = behavioral detection
Platform: Win32/Win64 = native, MSIL = .NET/C#

# Extract tool names from Defender detections
index=wineventlog source="*Windows Defender*" EventCode IN (1116, 1117)
| rex field=Message "Threat Name:\s*(?<threat_name>[^\n]+)"
| eval tool=case(
    match(threat_name, "(?i)Mimikatz"), "MIMIKATZ",
    match(threat_name, "(?i)CobaltStrike|Beacon"), "COBALT_STRIKE",
    match(threat_name, "(?i)Rubeus"), "RUBEUS",
    match(threat_name, "(?i)SharpHound|BloodHound"), "BLOODHOUND",
    match(threat_name, "(?i)Certify"), "CERTIFY_ADCS",
    match(threat_name, "(?i)Seatbelt"), "SEATBELT",
    match(threat_name, "(?i)SharpDPAPI"), "SHARPDPAPI",
    1=1, threat_name
  )
| table _time, Computer, tool, threat_name, EventCode
| sort - _time

# Track attacker response to detection (did they disable Defender after?)
index=wineventlog source="*Windows Defender*" EventCode IN (1116, 5001, 5007) Computer="HOST"
| sort _time
| table _time, EventCode, Message
# Pattern: 1116 (detected) → 5001 (disabled) or 5007 (exclusion added) = attacker adapting

36. ETW (Event Tracing for Windows)

ETW is the underlying telemetry framework. Sysmon, Security logs, and EDR all consume ETW. Understanding it gives access to the raw source.

Architecture

Provider → Session → Consumer

Provider:   Generates events (kernel, applications, services)
Session:    Collects events from one or more providers
Consumer:   Processes/records events (SIEM, EDR, custom tools)

Key ETW Providers for Security

Using ETW for Advanced Detection

# List all active ETW sessions
logman query -ets

# Create a custom ETW session for hunting
logman create trace SecurityHunt -ets -p Microsoft-Windows-Kernel-Process -o C:\hunt\trace.etl

# Start/stop the trace
logman start SecurityHunt -ets
logman stop SecurityHunt -ets

# Convert ETL to readable format
tracerpt C:\hunt\trace.etl -o C:\hunt\output.csv -of CSV

# Real-time ETW monitoring with SilkETW
SilkETW.exe -t user -pn Microsoft-Windows-DotNETRuntime -uk 0x2038 -ot file -p C:\hunt\dotnet.json

ETW-Based Detection Bypasses (What Attackers Do)

# Hunt for ETW tampering
# Suspicious process access with write permissions (potential ntdll patching)
index=sysmon EventCode=10 GrantedAccess IN ("0x1FFFFF","0x1F3FFF","0x001F0FFF")
| where NOT match(SourceImage, "(?i)csrss\\.exe|smss\\.exe|services\\.exe|MsMpEng\\.exe|lsass\\.exe|svchost\\.exe")
| where NOT match(TargetImage, "(?i)\\\\lsass\\.exe")
| table _time, Computer, SourceImage, TargetImage, GrantedAccess

# ETW session modifications
index=sysmon EventCode=1 Image="*\\logman.exe"
| where match(CommandLine, "(?i)update|delete|stop") AND match(CommandLine, "(?i)trace|ets|session")
| table _time, Computer, User, CommandLine

37. EVTX Integrity & Log Manipulation Detection

Sophisticated attackers selectively delete events, not just clear logs.

How EVTX Files Work

.evtx files contain records with sequential Record IDs: 1, 2, 3, 4, 5, 6, 7...
If an attacker deletes records 4 and 5:  1, 2, 3, [GAP], 6, 7...
The gap in Record IDs = evidence of manipulation.

Detection Methods

PowerShell Record ID Gap Detection

$events = Get-WinEvent -Path Security.evtx -Oldest
$prev = 0
foreach ($event in $events) {
    if ($event.RecordId - $prev > 1 -and $prev -gt 0) {
        Write-Host "GAP: Records $prev to $($event.RecordId) missing ($($event.RecordId - $prev - 1) events)"
    }
    $prev = $event.RecordId
}

SPL Detection Queries

# Log cleared events
index=wineventlog EventCode=1102
| table _time, Computer, SubjectUserName

# System log - any log cleared
index=wineventlog source="WinEventLog:System" EventCode=104
| table _time, Computer, Message

# Event log service stopped
index=wineventlog EventCode=7036
| where match(Message, "(?i)Windows Event Log.*stopped")
| table _time, Computer, Message

# Sysmon continuity check (gap = suspicious)
index=sysmon Computer="HOST"
| bin _time span=5m
| timechart span=5m count
| where count < 5

EVTX Analysis Tools

38. Authentication Events (4624, 4625)

4625 Failure Status/SubStatus Codes

Note: Splunk stores these in lowercase (e.g., 0xc000006d). Use lower(Status) or match case when searching.

Logon Type Reference

39. Logon Events Deep Dive (4624/4625)

Most analysts use 30% of Event 4624. These are the fields they miss.

The Full 4624 Field Set

AuthenticationPackageName — Protocol Fingerprinting

Pass-the-Hash Detection via KeyLength

# Detect potential Pass-the-Hash
index=wineventlog EventCode=4624 LogonType=3
  AuthenticationPackageName="NTLM" LogonProcessName="NtLmSsp"
| where TargetUserName!="ANONYMOUS LOGON" AND NOT match(TargetUserName, "\$$")
| stats count dc(Computer) as unique_targets values(Computer) as targets
  by TargetUserName, IpAddress, WorkstationName, KeyLength
| where unique_targets > 2
| sort - unique_targets

# NTLMv1 usage (should be ZERO)
index=wineventlog EventCode=4624 AuthenticationPackageName="NTLM"
| where LmPackageName="NTLM V1" OR KeyLength=56
| stats count by TargetUserName, IpAddress, Computer, LmPackageName

TargetLogonId — Session Tracking

# Everything a user did in one session
index=wineventlog (EventCode=4624 OR EventCode=4634 OR EventCode=4672 OR
  EventCode=4688 OR EventCode=5140 OR EventCode=5145)
  (TargetLogonId="0x12345678" OR SubjectLogonId="0x12345678")
| sort _time
| table _time, EventCode, Computer, TargetUserName, SubjectUserName

# Cross-reference with Sysmon (LogonId links process execution to logon session)
index=sysmon EventCode=1 LogonId="0x12345678"
| table _time, Computer, Image, CommandLine, ParentImage | sort _time

Event 4625 — Failure Analysis Patterns

# Password Spray Detection
index=wineventlog EventCode=4625 Status="0xc000006d" SubStatus="0xc000006a"
| bin _time span=15m
| stats count dc(TargetUserName) as unique_users values(TargetUserName) as users
  by IpAddress, _time
| where unique_users > 10

# User Enumeration (SubStatus=0xC0000064 = user does not exist)
index=wineventlog EventCode=4625 SubStatus="0xc0000064"
| stats count dc(TargetUserName) as tried_names by IpAddress
| where tried_names > 10

# Brute Force Success (multiple failures then success)
index=wineventlog EventCode IN (4625, 4624)
| sort _time
| transaction TargetUserName IpAddress maxspan=30m
  startswith=(EventCode=4625) endswith=(EventCode=4624)
| where eventcount > 5
| table TargetUserName, IpAddress, eventcount, duration

40. Account Management Events

41. Kerberos Events

Kerberos Encryption Types

4768 Kerberos Status Codes

42. Kerberos Deep Dive

Event 4768 (AS-REQ) — TGT Request Analysis

TicketOptions Bitmask

Common values: 0x40810010 = normal workstation TGT. 0x50800000 = Forwardable + Proxiable + Renewable (delegation-capable TGT — investigate if from unexpected account). 0x60810010 = forwarded TGT (Kerberos delegation).

PreAuthType

Kerberos Attack Detection Queries

# Kerberoasting (mass TGS requests with RC4)
index=wineventlog EventCode=4769 TicketEncryptionType="0x17"
| where ServiceName!="krbtgt" AND NOT match(ServiceName, "\$$")
| bin _time span=5m
| stats count dc(ServiceName) as unique_spns values(ServiceName) as services
  by TargetUserName, IpAddress, _time
| where unique_spns > 3

# AS-REP Roasting
index=wineventlog EventCode=4768 PreAuthType="0" Status="0x0"
| stats count by TargetUserName, IpAddress, TicketEncryptionType

# Golden Ticket indicators (TGS without recent TGT)
index=wineventlog EventCode=4769
| eval key=TargetUserName."-".IpAddress
| join type=left key
  [search index=wineventlog EventCode=4768 Status="0x0"
   | eval key=TargetUserName."-".IpAddress
   | stats max(_time) as last_tgt by key]
| eval time_since_tgt = _time - last_tgt
| where isnull(last_tgt) OR time_since_tgt > 43200
| table _time, TargetUserName, ServiceName, IpAddress, time_since_tgt

# Clock skew (possible Golden Ticket)
index=wineventlog EventCode=4768 Status="0x25"
| stats count by IpAddress, TargetUserName

4768 → 4769 → 4624 Correlation Chain

43. Object Access & Audit Events

4662 Key GUIDs for DCSync

DS-Replication-Get-Changes:          {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}
DS-Replication-Get-Changes-All:      {1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}
DS-Replication-Get-Changes-In-Filtered-Set: {89e95b76-444d-4c62-991a-0facbeda640c}

44. Event 4662 — GUID Decoding

Critical GUIDs for Detection

# DCSync detection — the definitive query
index=wineventlog EventCode=4662
| where match(Properties,
    "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2|1131f6ad-9c07-11d1-f79f-00c04fc2dcd2|89e95b76-444d-4c62-991a-0facbeda640c")
| where NOT match(SubjectUserName, "\$$")
| table _time, SubjectUserName, SubjectDomainName, ObjectName

# SPN modification (Kerberoasting setup)
# NOTE: %%14674 = Object Access (includes reads); triage for write operations
index=wineventlog EventCode=4662
| where match(Properties, "f3a64788-5306-11d1-a9c5-0000f80367c1")
| where OperationType="%%14674"
| table _time, SubjectUserName, ObjectName

# Mass AD enumeration (BloodHound)
index=wineventlog EventCode=4662
| where match(Properties, "bf967aba-0de6-11d0-a285-00aa003049e2|bf967a86-0de6-11d0-a285-00aa003049e2")
| bin _time span=5m
| stats count dc(ObjectName) as unique_objects by SubjectUserName, _time
| where unique_objects > 50

45. Policy, System & Process Events

46. Event 4688 Deep Dive — Hunting Without Sysmon

Hidden Fields Most Analysts Miss

TokenElevationType

MandatoryLabel (Integrity Level)

4688 Hunt Queries (Sysmon-Free Environment)

# Suspicious parent-child (Office spawning shells)
index=wineventlog EventCode=4688
| where match(ParentProcessName, "(?i)\\\\(winword|excel|powerpnt|outlook)\\.exe$")
  AND match(NewProcessName, "(?i)\\\\(cmd|powershell|mshta|wscript|cscript|certutil|regsvr32|rundll32)\\.exe$")
| table _time, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine

# Encoded PowerShell
index=wineventlog EventCode=4688 NewProcessName="*\\powershell.exe"
  (CommandLine="*-enc*" OR CommandLine="*-EncodedCommand*")
| table _time, Computer, SubjectUserName, CommandLine

# Processes from temp/user directories
index=wineventlog EventCode=4688
| where match(NewProcessName, "(?i)\\\\(Temp|tmp|Downloads|AppData)\\\\") AND match(NewProcessName, "\\.exe$")
| table _time, Computer, SubjectUserName, NewProcessName, CommandLine

# Shadow copy deletion (pre-ransomware)
index=wineventlog EventCode=4688
  ((NewProcessName="*\\vssadmin.exe" CommandLine="*delete*shadows*")
   OR (NewProcessName="*\\wmic.exe" CommandLine="*shadowcopy*delete*")
   OR (NewProcessName="*\\bcdedit.exe" CommandLine="*recoveryenabled*no*"))
| table _time, Computer, SubjectUserName, NewProcessName, CommandLine

# Privilege escalation — Full token for non-admin
index=wineventlog EventCode=4688 TokenElevationType="%%1936"
| where NOT match(SubjectUserName, "(?i)SYSTEM|LOCAL SERVICE|NETWORK SERVICE|DWM-|UMFD-")
| where NOT match(SubjectUserName, "\$$")
| stats count by SubjectUserName, Computer, NewProcessName

47. Scheduled Task XML Dissection (Event 4698)

Task XML Structure

<Task>
  <RegistrationInfo>   — Who created it, when, description
  <Triggers>           — WHEN it runs (boot, logon, time, event)
  <Principals>         — WHO it runs as (user, privilege level)
  <Settings>           — Execution settings (hidden, run if missed)
  <Actions>            — WHAT it does (execute command)
</Task>

# Parse Command from TaskContent XML
index=wineventlog EventCode=4698
| rex field=TaskContent "<Command>(?<task_command>[^<]+)</Command>"
| rex field=TaskContent "<Arguments>(?<task_args>[^<]+)</Arguments>"
| rex field=TaskContent "<UserId>(?<task_user>[^<]+)</UserId>"
| table _time, Computer, SubjectUserName, TaskName, task_command, task_args, task_user

# Hidden tasks
index=wineventlog EventCode=4698
| where match(TaskContent, "<Hidden>true</Hidden>")
| rex field=TaskContent "<Command>(?<cmd>[^<]+)</Command>"
| table _time, Computer, SubjectUserName, TaskName, cmd

# Tasks with RegistrationTrigger (immediate execution)
index=wineventlog EventCode=4698
| where match(TaskContent, "RegistrationTrigger")
| rex field=TaskContent "<Command>(?<cmd>[^<]+)</Command>"
| table _time, Computer, SubjectUserName, TaskName, cmd

# SYSTEM tasks from non-standard paths
index=wineventlog EventCode=4698
| rex field=TaskContent "<Command>(?<cmd>[^<]+)</Command>"
| rex field=TaskContent "<UserId>(?<uid>[^<]+)</UserId>"
| where (uid="S-1-5-18" OR match(uid, "(?i)SYSTEM"))
  AND NOT match(cmd, "(?i)C:\\\\Windows\\\\|C:\\\\Program Files")
| table _time, Computer, TaskName, cmd, uid

48. Share & Network Events

5145 Access Mask Values

49. Event 5145 Deep Dive — Lateral Movement at File Level

ShareName & RelativeTargetName Patterns

# Comprehensive lateral movement detection via 5145
index=wineventlog EventCode=5145
| eval risk=case(
    match(RelativeTargetName, "(?i)PSEXESVC|RemCom"), "CRITICAL-psexec",
    match(RelativeTargetName, "drsuapi"), "CRITICAL-dcsync",
    RelativeTargetName="svcctl" AND match(ShareName, "\\\\IPC\\$"), "HIGH-service_control",
    RelativeTargetName="atsvc", "HIGH-sched_task",
    match(RelativeTargetName, "(?i)\\.exe$") AND AccessMask="0x2", "HIGH-exe_drop",
    match(ShareName, "\\\\ADMIN\\$") AND AccessMask="0x2", "HIGH-admin_write",
    match(ShareName, "\\\\C\\$"), "MEDIUM-c_drive_access",
    match(RelativeTargetName, "samr|lsarpc|srvsvc"), "MEDIUM-enumeration",
    1=1, "LOW"
  )
| where risk!="LOW"
| table _time, Computer, IpAddress, SubjectUserName, ShareName, RelativeTargetName, risk
| sort risk

50. Directory Service Events

51. Certificate Services & GPO Events

# GPO Modification Hunting
index=wineventlog EventCode=5136
| where match(ObjectDN, "(?i)groupPolicyContainer") OR match(AttributeLDAPDisplayName, "(?i)gPCFileSysPath|gPLink")
| table _time, SubjectUserName, ObjectDN, AttributeLDAPDisplayName, AttributeValue

52. Core System Events

Event 7045 Hunting

High Priority Indicators:
  - ImagePath contains cmd.exe, powershell.exe, or encoded commands
  - ImagePath points to temp directories or user profiles
  - ImagePath contains pipe (|) or redirection (>)
  - Service name is random-looking or very short
  - Account is LocalSystem for a non-Microsoft service
  - ImagePath uses UNC path (\\server\share)

  NOTE: Event 7045 (System log) uses "ImagePath" field.
        Event 4697 (Security log) uses "ServiceFileName" field.

SPL:
  index=wineventlog source="WinEventLog:System" EventCode=7045
  | where NOT match(ImagePath, "(?i)C:\\\\Windows\\\\|C:\\\\Program Files")
  | table _time, Computer, ServiceName, ImagePath, ServiceType, AccountName

Additional System Events

53. NTLM Operational Log

# NTLM field names vary by Splunk TA; 8004 has DomainName, UserName, Workstation
index=wineventlog source="*NTLM*" EventCode IN (8001,8002,8003,8004)
| stats count by EventCode, Computer, DomainName, UserName | sort - count

54. Print Service & PrintNightmare

# PrintNightmare Detection
# Field names depend on Splunk TA — check Message field if DriverName/UserName are blank
index=wineventlog source="*PrintService*" EventCode IN (316, 808, 842)
| table _time, Computer, param1, param2, Message

# Also via Sysmon
index=sysmon EventCode=11 TargetFilename="*\\spool\\drivers\\*"
| where NOT match(Image, "(?i)spoolsv\\.exe")
| table _time, Computer, Image, TargetFilename

55. PowerShell Operational Events

Script Block Logging (4104) — Suspicious Pattern Hunting

# Download cradles
index=wineventlog EventCode=4104 ScriptBlockText="*DownloadString*"
  OR ScriptBlockText="*DownloadFile*" OR ScriptBlockText="*Invoke-WebRequest*"
  OR ScriptBlockText="*Net.WebClient*" OR ScriptBlockText="*Start-BitsTransfer*"

# Credential access
index=wineventlog EventCode=4104 ScriptBlockText="*Invoke-Mimikatz*"
  OR ScriptBlockText="*sekurlsa*" OR ScriptBlockText="*kerberos::*"
  OR ScriptBlockText="*lsadump*" OR ScriptBlockText="*token::elevate*"

# Evasion (AMSI bypass)
index=wineventlog EventCode=4104 ScriptBlockText="*AmsiUtils*"
  OR ScriptBlockText="*amsiInitFailed*" OR ScriptBlockText="*AmsiScanBuffer*"
  OR ScriptBlockText="*VirtualAlloc*" OR ScriptBlockText="*-ExecutionPolicy Bypass*"

# Encoding/obfuscation
index=wineventlog EventCode=4104 ScriptBlockText="*FromBase64String*"
  OR ScriptBlockText="*ToBase64String*" OR ScriptBlockText="*DeflateStream*"
  OR ScriptBlockText="*GzipStream*"

# Lateral movement
index=wineventlog EventCode=4104 ScriptBlockText="*Invoke-Command*"
  OR ScriptBlockText="*Enter-PSSession*" OR ScriptBlockText="*Invoke-WmiMethod*"

# Persistence
index=wineventlog EventCode=4104 ScriptBlockText="*Register-ScheduledTask*"
  OR ScriptBlockText="*New-Service*" OR ScriptBlockText="*Set-ItemProperty*HKLM*Run*"

PowerShell Severity Classification

56. PowerShell Logging Deep Dive

4104 vs 4103 vs 800 — What Each Captures

Recommendation: Enable ALL THREE. 4104 gives you the code. 4103 gives you what the code did with what values. 800 gives you the execution context.

ScriptBlockId — Reassembling Fragmented Scripts

# Reassemble fragmented scripts
index=wineventlog EventCode=4104
| sort ScriptBlockId, MessageNumber
| stats list(ScriptBlockText) as parts values(MessageTotal) as total by ScriptBlockId, Computer
| eval full_script=mvjoin(parts, "")
| where match(full_script, "(?i)DownloadString|Invoke-Expression|FromBase64|Invoke-Mimikatz|AmsiUtils")
| table Computer, ScriptBlockId, total, full_script

Key Insight: -EncodedCommand

Event 4104 captures the DECODED script, not the Base64 blob. Sysmon Event 1 captures the original -enc command line. Use both: 4104 for decoded content, Sysmon 1 for the original command.

57. AMSI Bypass Detection

# Direct AMSI bypass strings
index=wineventlog EventCode=4104
| where match(ScriptBlockText, "(?i)AmsiUtils|amsiInitFailed|AmsiScanBuffer|AmsiOpenSession|amsi\\.dll")
| table _time, Computer, ScriptBlockText

# Reflection-based AMSI bypass
index=wineventlog EventCode=4104
| where match(ScriptBlockText, "(?i)\\[Reflection\\.Assembly\\]|DynamicMethod|Runtime\\.InteropServices")
  AND match(ScriptBlockText, "(?i)Amsi|Marshal")
| table _time, Computer, ScriptBlockText

# Non-PowerShell loading PS engine (unmanaged PS — bypasses CLM entirely)
index=sysmon EventCode=7 ImageLoaded="*\\System.Management.Automation.dll"
| where NOT match(Image, "(?i)powershell|pwsh|wsmprovhost|svchost|mmc")
| table _time, Computer, Image, ImageLoaded

# CLM bypass via PowerShell v2
index=sysmon EventCode=1 Image="*\\powershell.exe"
| where match(CommandLine, "(?i)-version\\s+2|-v\\s+2")
| table _time, Computer, User, CommandLine

58. Application Error & Installer Events

59. Windows Defender Events

# Detect Defender being disabled or tampered
index=wineventlog source="WinEventLog:Microsoft-Windows-Windows Defender/Operational"
  EventCode IN (5001, 5004, 5007, 5010, 5012, 1013)
| table _time, Computer, EventCode, Message

# Detect exclusion additions
index=wineventlog source="WinEventLog:Microsoft-Windows-Windows Defender/Operational" EventCode=5007
| search Message="*Exclusion*"
| table _time, Computer, Message

60. Task Scheduler Operational Events

61. WMI Events

62. BITS Client Events

63. Remote Desktop Events

TerminalServices-LocalSessionManager/Operational

TerminalServices-RDPClient/Operational

64. Windows Firewall Events

65. AppLocker Events

66. DNS Client Events

67. Sysmon Complete Event ID Reference

68. Event 10 — LSASS Credential Theft Detection

GrantedAccess Values for LSASS

CallTrace Field — Most Underused Field in Sysmon

# Normal (AV checking LSASS):
C:\Windows\SYSTEM32\ntdll.dll+12345|C:\Windows\System32\KERNELBASE.dll+6789|
C:\Program Files\Windows Defender\MsMpEng.exe+abc

# Mimikatz sekurlsa::logonpasswords:
C:\Windows\SYSTEM32\ntdll.dll+9c5a4|C:\Windows\System32\KERNELBASE.dll+2cd86|
UNKNOWN(00000000XXXXXXXX)              ← UNBACKED MEMORY = shellcode/injected

# Procdump:
...|C:\Windows\System32\dbghelp.dll+xxx|C:\SysinternalsSuite\procdump64.exe+xxx

# comsvcs.dll MiniDump:
...|C:\Windows\System32\comsvcs.dll+xxx|C:\Windows\System32\rundll32.exe+xxx

Comprehensive LSASS Detection with Risk Scoring

index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
| where NOT SourceImage IN (
    "C:\\Windows\\system32\\csrss.exe",
    "C:\\Windows\\system32\\wininit.exe",
    "C:\\Windows\\system32\\WerFault.exe",
    "C:\\Windows\\system32\\svchost.exe",
    "C:\\Windows\\system32\\lsass.exe"
  )
| where NOT match(SourceImage, "(?i)MsMpEng\\.exe|MpCmdRun\\.exe|MsSense\\.exe")
| eval risk=case(
    match(CallTrace, "UNKNOWN"), "CRITICAL-shellcode",
    GrantedAccess="0x1FFFFF", "CRITICAL-full_access",
    GrantedAccess="0x143a" OR GrantedAccess="0x143A", "CRITICAL-mimikatz",
    GrantedAccess="0x1438", "CRITICAL-credential_dump",
    GrantedAccess="0x1038", "HIGH-memory_rw",
    GrantedAccess="0x1010", "HIGH-memory_read",
    GrantedAccess="0x0810", "HIGH-suspend_read",
    match(CallTrace, "dbghelp|dbgcore"), "HIGH-debugger",
    match(CallTrace, "comsvcs"), "HIGH-minidump",
    GrantedAccess="0x1410", "MEDIUM-query_read",
    GrantedAccess="0x0040", "MEDIUM-dup_handle",
    1=1, "LOW-other"
  )
| where NOT risk="LOW-other"
| table _time, Computer, SourceImage, GrantedAccess, risk, CallTrace
| sort risk

Beyond LSASS — Other Event 10 Targets

69. Event 1 — Advanced Process Analysis

# Command line length analysis (long = encoded/obfuscated)
index=sysmon EventCode=1
| eval cmd_len=len(CommandLine)
| where cmd_len > 500
| table _time, Computer, User, Image, cmd_len, CommandLine | sort - cmd_len

# OriginalFileName vs IMAGE (masquerading detection)
index=sysmon EventCode=1
| where isnotnull(OriginalFileName) AND OriginalFileName!=""
| eval image_name=replace(Image, ".*\\\\", "")
| eval orig_lower=lower(OriginalFileName), image_lower=lower(image_name)
| where orig_lower != image_lower
| table _time, Computer, Image, OriginalFileName, CommandLine

# Processes from temp/user directories
index=sysmon EventCode=1
| where match(CurrentDirectory, "(?i)\\\\Temp\\\\|\\\\tmp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\Local\\\\Temp")
| table _time, Computer, User, Image, CurrentDirectory, CommandLine

# Rare process hashes (long-tail analysis)
index=sysmon EventCode=1
| stats count dc(Computer) as host_count by Hashes, Image
| where host_count < 3 AND count < 5
| sort count | head 50

70. Event 7 — DLL Side-Loading & BYOVD

DLL Side-Loading Detection

# Unsigned DLLs loaded by signed executables
index=sysmon EventCode=7 Signed="false" SignatureStatus!="Valid"
| where match(Image, "(?i)C:\\\\Program Files|C:\\\\Windows")
| where NOT match(ImageLoaded, "(?i)C:\\\\Windows\\\\|C:\\\\Program Files\\\\")
| stats count by Image, ImageLoaded, Signed | sort count

Common Side-Loading Pairs

Event 6 (DriverLoad) — BYOVD Detection

# Unsigned drivers
index=sysmon EventCode=6 Signed="false"
| table _time, Computer, ImageLoaded, Hashes, Signed

# Drivers from user-writable paths
index=sysmon EventCode=6
| where match(ImageLoaded, "(?i)\\\\Users\\\\|\\\\Temp\\\\|\\\\Downloads\\\\|\\\\AppData\\\\")
| table _time, Computer, ImageLoaded, Hashes, Signed

# Known vulnerable driver names
index=sysmon EventCode=6
| where match(ImageLoaded, "(?i)RTCore64\\.sys|gdrv\\.sys|dbutil_2_3\\.sys|cpuz141\\.sys|iqvw64e\\.sys|mhyprot2\\.sys|kprocesshacker\\.sys|procexp152\\.sys")
| table _time, Computer, ImageLoaded, Hashes, Signed

Resource: LOLDrivers Project (loldrivers.io) — known-vulnerable driver hash list.

71. Event 22 — Per-Process DNS Hunting

# Rare DNS queries (long-tail analysis)
index=sysmon EventCode=22
| stats count dc(Computer) as hosts by QueryName, Image
| where hosts < 3 AND count < 5 | sort count | head 50

# Non-browser processes making external DNS queries
index=sysmon EventCode=22
| where NOT match(Image, "(?i)chrome|firefox|edge|msedge|teams|outlook|svchost")
| where NOT match(QueryName, "(?i)\\.microsoft\\.com|\\.windows\\.com|\\.office\\.com")
| stats count by Image, QueryName | sort count | head 100

# rundll32 making DNS queries (almost always suspicious)
index=sysmon EventCode=22 Image="*\\rundll32.exe"
| table _time, Computer, Image, QueryName, QueryResults

# DGA detection via high unique domain count
index=sysmon EventCode=22
| eval domain_parts=split(QueryName, ".") | eval sld=mvindex(domain_parts, -2) | eval sld_len=len(sld)
| where sld_len > 10
| stats dc(QueryName) as unique_domains count by Image, Computer
| where unique_domains > 20 | sort - unique_domains

72. Event 25 — Process Tampering

# ALL process tampering events
index=sysmon EventCode=25
| table _time, Computer, Image, Type, User | sort - _time

# Correlate tampering with subsequent activity
index=sysmon EventCode=25
| rename Computer as host, ProcessId as tampered_pid
| join type=left host tampered_pid
  [search index=sysmon (EventCode=3 OR EventCode=1)
   | rename Computer as host, ProcessId as tampered_pid
   | table _time, host, tampered_pid, Image, DestinationIp, CommandLine]
| table _time, host, Image, Type, DestinationIp, CommandLine

73. Event 3 — Network Connection Hunting

# LOLBins making outbound connections
index=sysmon EventCode=3
| where match(Image, "(?i)\\\\(certutil|mshta|regsvr32|rundll32|bitsadmin|msiexec|wmic|cmstp|msbuild|powershell|cmd)\\.exe$")
| where NOT match(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)")
| table _time, Computer, Image, DestinationIp, DestinationPort, User

# Svchost to unusual ports (injection indicator)
index=sysmon EventCode=3 Image="*\\svchost.exe" Initiated=true
| where DestinationPort NOT IN (80, 443, 53, 123, 389, 636, 445, 135, 88, 5985, 5986)
| where NOT match(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)")
| stats count by DestinationIp, DestinationPort | sort count

# Process-level beaconing detection
index=sysmon EventCode=3 Initiated=true
| where NOT match(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)")
| bin _time span=5m
| stats count by Image, DestinationIp, DestinationPort, _time, Computer
| streamstats current=f last(_time) as prev_time by Image, DestinationIp, Computer
| eval delta=_time-prev_time
| stats avg(delta) as avg_interval, stdev(delta) as stdev_interval, count
  by Image, DestinationIp, DestinationPort, Computer
| where count > 20 AND stdev_interval < (avg_interval * 0.2)
| eval jitter_pct=round((stdev_interval/avg_interval)*100,2)
| sort jitter_pct

74. Events 17/18 — Named Pipes

Event 17 = Pipe CREATED. Event 18 = Pipe CONNECTED. Not logged by default — requires Sysmon.

Why Pipes Matter for Hunting

Pipe Types

C2 Framework Pipes

Lateral Movement Pipes

Credential Attack Pipes

Expected Windows Pipes (Know Normal to Find Evil)

ALWAYS PRESENT:
  lsass, ntsvcs, scerpc, browser, wkssvc, srvsvc, winreg,
  samr, netlogon, svcctl, atsvc, epmapper, spoolss,
  tapsrv, InitShutdown, protected_storage, ROUTER

KEY INSIGHT: When Event 18 shows Image="System" connecting to a pipe,
that is a REMOTE connection over SMB. Local pipe access shows the
actual process path.

Detection Queries

# Known malicious pipe names (comprehensive)
index=sysmon EventCode IN (17, 18)
| where match(PipeName, "(?i)\\\\msagent_|\\\\MSSE-.*-server|\\\\postex_|\\\\status_|\\\\mojo\\.|\\\\interprocess\\.|meterpreter|msf_|gruntsvc|\\\\RemCom_|DserNamePipe|SearchTextHarvester|csexec|PAExec|win_svc")
| table _time, Computer, EventCode, Image, PipeName

# Remote pipe connections (lateral movement indicator)
# Image="System" means connection came over SMB from another host
index=sysmon EventCode=18 Image="System"
| stats count by PipeName, Computer | sort - count

# Pipe creation by unusual processes
index=sysmon EventCode=17
| where NOT match(Image, "(?i)svchost|lsass|services|spoolsv|SearchIndexer|System|wininit|csrss|smss")
| stats count by Image, PipeName | sort count | head 30

# Rarest pipes (long-tail — your best hunting query)
index=sysmon EventCode=17
| stats count dc(Computer) as hosts by PipeName
| where hosts < 3 | sort count | head 30

# Risk-scored pipe detection
index=sysmon EventCode IN (17, 18)
| eval pipe_risk=case(
    match(PipeName, "(?i)\\\\msagent_|\\\\postex_|\\\\status_|\\\\MSSE-.*-server|\\\\mojo\\.|\\\\interprocess\\."), "CRITICAL-cobalt_strike",
    match(PipeName, "(?i)\\\\meterpreter|\\\\msf_"), "CRITICAL-metasploit",
    match(PipeName, "(?i)\\\\PSEXESVC"), "HIGH-psexec",
    match(PipeName, "(?i)\\\\RemCom_comm|\\\\csexec|\\\\PAExec"), "HIGH-lateral_move",
    match(PipeName, "(?i)\\\\gruntsvc|\\\\DserNamePipe|\\\\SearchTextHarvester|\\\\win_svc"), "HIGH-c2_framework",
    match(PipeName, "(?i)\\\\drsuapi") AND EventCode=18 AND Image="System", "CRITICAL-dcsync_pipe",
    1=1, "LOW"
  )
| where pipe_risk!="LOW"
| table _time, Computer, EventCode, Image, PipeName, pipe_risk | sort pipe_risk

Live System Pipe Enumeration

# PowerShell — list all active pipes
Get-ChildItem \\.\pipe\ | Select-Object Name
[System.IO.Directory]::GetFiles("\\\\.\\pipe\\") | ForEach-Object { Split-Path $_ -Leaf }

# Sysinternals
pipelist.exe

# Compare against known-good baseline → new pipes = investigate

75. Event 15 — Alternate Data Streams

# Files downloaded from internet (Zone.Identifier)
index=sysmon EventCode=15
| where match(TargetFilename, "Zone\\.Identifier")
| rex field=TargetFilename "(?<base_file>.+):Zone\\.Identifier"
| table _time, Computer, Image, base_file, Hash

# Suspicious ADS (non-Zone.Identifier = actually suspicious)
index=sysmon EventCode=15
| where NOT match(TargetFilename, "Zone\\.Identifier")
| table _time, Computer, Image, TargetFilename, Hash | sort - _time

76. Cross-Event Correlation Patterns

Pattern: Process Injection Chain

Event 1 (attacker process) → Event 8 (CreateRemoteThread) → Event 10 (ProcessAccess) → Event 3 (C2 connection)

index=sysmon EventCode IN (1, 8, 10, 3) Computer="TARGET_HOST"
| sort _time | table _time, EventCode, Image, TargetImage, SourceImage, DestinationIp, CommandLine

Pattern: Credential Dump → Lateral Movement

Event 10 (LSASS access) → Event 1 (recon) → Event 1 (lateral movement) → Event 3 (outbound)

index=sysmon Computer="SOURCE_HOST"
| where (EventCode=10 AND TargetImage="*\\lsass.exe")
  OR (EventCode=1 AND (Image="*\\net.exe" OR Image="*\\wmic.exe" OR Image="*\\psexec*"))
  OR (EventCode=3 AND match(Image, "(?i)wmic|psexec"))
| sort _time | table _time, EventCode, Image, TargetImage, CommandLine, DestinationIp

Pattern: Macro → Download → Execute → Persist

Event 1 (winword → cmd/ps) → Event 22 (DNS query) → Event 11 (file dropped) → Event 1 (payload run) → Event 13 (Run key)

index=sysmon Computer="TARGET_HOST"
| where (EventCode=1 AND ParentImage="*\\winword.exe")
  OR EventCode=22
  OR (EventCode=11 AND match(TargetFilename, "(?i)\\\\Temp\\\\|\\\\Downloads\\\\"))
  OR (EventCode=13 AND match(TargetObject, "\\\\Run\\\\"))
| sort _time | table _time, EventCode, Image, ParentImage, TargetFilename, TargetObject, QueryName, CommandLine

Pattern: BYOVD → EDR Kill

Event 6 (vulnerable driver loaded) → Event 1 (exploit tool) → Event 5 (EDR terminated)

index=sysmon Computer="TARGET_HOST"
| where (EventCode=6 AND Signed="true") OR EventCode=1 OR EventCode=5
| sort _time | table _time, EventCode, Image, ImageLoaded, ParentImage, Signed, Signature, CommandLine

77. Sysmon Configuration Best Practices

Golden Rules

1. Log everything, then exclude. Never start with include-only.
2. Never exclude: Events 1, 8, 10, 11, 13, 25
3. Be careful with Event 3: Exclude by process (chrome, edge), not destination.
4. Aggressive Event 7 exclusions: System32 DLLs, known signed DLLs.

Event Volume Estimation (per endpoint per day)

Recommended Configs

# Install with config
sysmon64.exe -accepteula -i sysmonconfig.xml

# Update config (no reinstall)
sysmon64.exe -c sysmonconfig.xml

# Verify running
sc query Sysmon64