首页 > 代码库 > Sysmon + NXlog构建简单的windows安全监控

Sysmon + NXlog构建简单的windows安全监控

工具:

Sysmon (sysmon 5.0) ,NXlog(nxlog-ce-2.9.1716.msi) .

Sysmon监控系统并生成windows event log,   NXlog将windows event log传输到syslog服务器。

Sysmon可以监控Process create, Process terminate, Driver loaded, File creation time changed, RawAccessRead, CreateRemoteThread, Sysmon service state changed。

配置:

NXlog配置:

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/docs/

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _syslog>
    Module      xm_syslog
</Extension>

<Input in>
    Module im_msvistalog
    Query <QueryList> <Query Id="0"> <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select> </Query></QueryList>
</Input>

<Output out>
    Module      om_udp
    Host        security-log.syslogserver.com
    Port        639
    Exec        to_syslog_snare();
</Output>

<Route 1>
    Path        in => out
</Route>

 Sysmon配置:

<Sysmon schemaversion="3.20">

  <!-- Capture all hashes -->

  <HashAlgorithms>*</HashAlgorithms>

  <EventFiltering>

    <!-- Log all drivers except if the signature -->

    <!-- contains Microsoft or Windows -->

    <DriverLoad onmatch="exclude">

      <Signature condition="contains">Microsoft</Signature>

      <Signature condition="contains">Windows</Signature>

    </DriverLoad>

    <ProcessTerminate onmatch="include" >

      <Image condition="end with">MsMpEng.exe</Image>

    </ProcessTerminate>

    <!-- Log network connection if the destination port equal 443 -->

    <!-- or 80, and process isn‘t InternetExplorer -->

    <!--NetworkConnect onmatch="include">

      <DestinationPort>443</DestinationPort>

      <DestinationPort>80</DestinationPort >

    </NetworkConnect -->

    <FileCreateTime onmatch="exclude" >

      <Image condition="end with">chrome.exe</Image>

    </FileCreateTime>

    <ImageLoad onmatch="include">

      <Signed condition="is">false</Signed>

    </ImageLoad>

    <!-- Log access rights for lsass.exe or winlogon.exe is not PROCESS_QUERY_INFORMATION -->

    <ProcessAccess onmatch="exclude">

      <GrantedAccess condition="is">0x1400</GrantedAccess>

    </ProcessAccess>

    <ProcessAccess onmatch="include">

      <TargetImage condition="end with">lsass.exe</TargetImage>

      <TargetImage condition="end with">winlogon.exe</TargetImage>

    </ProcessAccess>

    <NetworkConnect onmatch="exclude">

      <Image condition="end with">chrome.exe</Image>

      <SourcePort condition="is">137</SourcePort>

      <SourcePortName condition="is">llmnr</SourcePortName>

      <DestinationPortName condition="is">llmnr</DestinationPortName>

    </NetworkConnect>

    <CreateRemoteThread onmatch="include">

      <TargetImage condition="end with">explorer.exe</TargetImage>

      <TargetImage condition="end with">svchost.exe</TargetImage>

      <TargetImage condition="end with">winlogon.exe</TargetImage>

      <SourceImage condition="end with">powershell.exe</SourceImage>

    </CreateRemoteThread>

  </EventFiltering>

</Sysmon>

  

 

 

测试案例:

安装:

- sysmon -i config.conf 。   

- nxlog双击运行,记得启动服务。

 

使用mimikatz抓取hash:

 

技术分享

 

技术分享

参考:

http://www.freebuf.com/sectool/122779.html

https://technet.microsoft.com/en-us/sysinternals/dn798348

https://nxlog.co/docs/sysmon/audit-logging-on-windows-with-sysmon-and-nxlog.html

http://www.ilanni.com/?p=595

Sysmon + NXlog构建简单的windows安全监控