Microsoft Sysmon 설치
일부 Tenable Identity Exposure의 공격 지표(IoA)를 활성화하려면 Microsoft 시스템 모니터(Sysmon) 서비스가 필요합니다.
Sysmon은 시스템 활동을 모니터링하고 Windows 이벤트 로그에 기록하여 ETW(Event Tracing for Windows) 인프라에 좀 더 보안 중심적인 정보를 제공합니다.
추가로 Windows 서비스와 드라이버를 설치하면 Active Directory 인프라를 호스팅하는 도메인 컨트롤러의 성능에 영향을 미칠 수 있기 때문입니다. Tenable은 Microsoft Sysmon을 자동으로 배포하지 않습니다. 수동으로 설치하거나 전용 GPO를 사용해야 합니다.
다음 IoA에는 Microsoft Sysmon이 필요합니다.
이름 |
이유 |
---|---|
OS 자격 증명 덤핑: LSASS 메모리 |
프로세스 삽입 탐지 |
-
Microsoft 웹 사이트에서 Sysmon을 다운로드합니다.
-
명령줄 인터페이스에서 다음과 같은 명령을 실행하여 로컬 컴퓨터에 Microsoft Sysmon을 설치합니다.
복사.\Sysmon64.exe -accepteula -i C:\TenableSysmonConfigFile.xml
참고: 구성 설명은 주석이 추가된 Sysmon 구성 파일을 참조하십시오.
-
다음 명령을 실행하여 WMI 필터에 Sysmon이 설치되었음을 나타내는 레지스트리 키를 추가합니다.
복사reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Microsoft-Windows-Sysmon/Operational"
- Sysmon 설정 파일을 XML 파일로 복사하여 저장한 후 사용하십시오. 오류가 발생하는 경우 여기에서 구성 파일을 직접 다운로드할 수도 있습니다.
- 파일 속성에서 파일을 차단 해제한 다음에 사용하십시오.
<Sysmon schemaversion="4.40">
<EventFiltering>
<!--SYSMON EVENT ID 1 : PROCESS CREATION [ProcessCreate]-->
<RuleGroup name="" groupRelation="or">
<ProcessCreate onmatch="exclude">
<!--NOTE: Using "exclude" with no rules means everything in this section will be logged-->
</ProcessCreate>
</RuleGroup>
<!--SYSMON EVENT ID 2 : FILE CREATION TIME RETROACTIVELY CHANGED IN THE FILESYSTEM [FileCreateTime]-->
<RuleGroup name="" groupRelation="or">
<FileCreateTime onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</FileCreateTime>
</RuleGroup>
<!--SYSMON EVENT ID 3 : NETWORK CONNECTION INITIATED [NetworkConnect]-->
<RuleGroup name="" groupRelation="or">
<NetworkConnect onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</NetworkConnect>
</RuleGroup>
<!--SYSMON EVENT ID 4 : RESERVED FOR SYSMON SERVICE STATUS MESSAGES-->
<!--Cannot be filtered.-->
<!--SYSMON EVENT ID 5 : PROCESS ENDED [ProcessTerminate]-->
<RuleGroup name="" groupRelation="or">
<ProcessTerminate onmatch="exclude">
<!--NOTE: Using "exclude" with no rules means everything in this section will be logged-->
</ProcessTerminate>
</RuleGroup>
<!--SYSMON EVENT ID 6 : DRIVER LOADED INTO KERNEL [DriverLoad]-->
<RuleGroup name="" groupRelation="or">
<DriverLoad onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</DriverLoad>
</RuleGroup>
<!--SYSMON EVENT ID 7 : DLL (IMAGE) LOADED BY PROCESS [ImageLoad]-->
<RuleGroup name="" groupRelation="or">
<ImageLoad onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</ImageLoad>
</RuleGroup>
<!--SYSMON EVENT ID 8 : REMOTE THREAD CREATED [CreateRemoteThread]-->
<RuleGroup name="" groupRelation="or">
<CreateRemoteThread onmatch="include">
<TargetImage name="lsass" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
</CreateRemoteThread>
</RuleGroup>
<!--SYSMON EVENT ID 9 : RAW DISK ACCESS [RawAccessRead]-->
<RuleGroup name="" groupRelation="or">
<RawAccessRead onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</RawAccessRead>
</RuleGroup>
<!--SYSMON EVENT ID 10 : INTER-PROCESS ACCESS [ProcessAccess]-->
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<!-- Detect Access to LSASS-->
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
<GrantedAccess>0x1FFFFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
<GrantedAccess>0x1010</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
<GrantedAccess>0x143A</GrantedAccess>
</Rule>
<!-- Detect process hollowing to LSASS-->
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
<GrantedAccess>0x0800</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
<GrantedAccess>0x800</GrantedAccess>
</Rule>
<!-- Detect process process injection to LSASS-->
<Rule groupRelation="and">
<TargetImage name="technique_id=T1055,technique_name=Process Injection" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
<GrantedAccess>0x0820</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1055,technique_name=Process Injection" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
<GrantedAccess>0x820</GrantedAccess>
</Rule>
</ProcessAccess>
</RuleGroup>
<!--SYSMON EVENT ID 11 : FILE CREATED [FileCreate]-->
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</FileCreate>
</RuleGroup>
<!--SYSMON EVENT ID 12 & 13 & 14 : REGISTRY MODIFICATION [RegistryEvent]-->
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</RegistryEvent>
</RuleGroup>
<!--SYSMON EVENT ID 15 : ALTERNATE DATA STREAM CREATED [FileCreateStreamHash]-->
<RuleGroup name="" groupRelation="or">
<FileCreateStreamHash onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</FileCreateStreamHash>
</RuleGroup>
<!--SYSMON EVENT ID 16 : SYSMON CONFIGURATION CHANGE-->
<!--Cannot be filtered.-->
<!--SYSMON EVENT ID 17 & 18 : PIPE CREATED / PIPE CONNECTED [PipeEvent]-->
<RuleGroup name="" groupRelation="or">
<PipeEvent onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</PipeEvent>
</RuleGroup>
<!--SYSMON EVENT ID 19 & 20 & 21 : WMI EVENT MONITORING [WmiEvent]-->
<RuleGroup name="" groupRelation="or">
<WmiEvent onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</WmiEvent>
</RuleGroup>
<!--SYSMON EVENT ID 22 : DNS QUERY [DnsQuery]-->
<RuleGroup name="" groupRelation="or">
<DnsQuery onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</DnsQuery>
</RuleGroup>
<!--SYSMON EVENT ID 23 : FILE DELETED [FileDelete]-->
<RuleGroup name="" groupRelation="or">
<FileDelete onmatch="include">
<!--NOTE: Using "include" with no rules means nothing in this section will be logged-->
</FileDelete>
</RuleGroup>
</EventFiltering>
</Sysmon>