Learning Sysmon - Detecting abuse via Process Access (Video 10)
In this video, Research Team Lead Carlos Perez demonstrates how to configure Sysmon to monitor instances of one process accessing another process in order to detect and take action against abuse.
Windows Driver Block List:
https://learn.microsoft.com/en-us/win...
Sysmon Modular:
https://github.com/olafhartong/sysmon...
Sysmon Community Guide:
https://github.com/trustedsec/SysmonC...
PSGumshoe PowerShell Module
https://www.powershellgallery.com/pac...
Sysmon Visual Studio Code Extension
https://marketplace.visualstudio.com/...
00:00 Intro
01:56 Building a Baseline
06:06 Event Fields
07:49 Creating an exclude for the baseline
11:55 Interpreting the AccessGranted field
15:17 Conclusion