Sysmon configuration file template with default high-quality event tracing

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

PowerShell module for creating and managing Sysinternals Sysmon config files.

Detect possible sysmon logging bypasses given a specific configuration

Pushes Sysmon Configs

Sysmon and wazuh integration with Sigma sysmon rules [updated]

Sysmon config for both Windows and Linux Devices. Windows one is a bit dated

This script enhances endpoint logging telemetry for the purpose of advanced malware threat detection or for building detections or malware analysis. This can be used in production, however you might want to tune the GPO edits as needed.

This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.

Sysmon Config Pusher - Modernized

Import and export custom Sysmon configurations using an interactive GUI that lets you build event rules, manage filters, and generate clean XML configs without manually editing Sysmon files.

Ansible role for installing Sysmon with popular config files included.

Comprehensive Sysmon configuration file (sysmon_config.xml) specifically designed for integration with Wazuh SIEM. The configuration is optimized to detect and monitor security-relevant events based on MITRE ATT&CK framework techniques.

No description available

No description available

A web application dedicated to write sysmon configuration file

https://github.com/Swiftonsecurity/sysmon-config

Just another sysmon config

Sysmon Config for Linux

사이버 위협을 탐지 및 분석을 위한 Sysmon Configure

Detection Wizard brings YARA, Suricata, Sigma, Sysmon, QRadar, Splunk, and IOCs into one powerful interface for powerful rule management and threat detection.

Utility to convert SysInternals' Sysmon binary configuration to XML

Sysmon Configuration Files

Sysmon configuration to get all the logs needed to forensics, almost everything but the most common dlls.

Converts Sysmon rules to uberAgent ESA Threat Detection rules

A cutting-edge, real-time security monitoring system, designed to revolutionize your network's defense

No description available

Project to convert Sysmon config filters to Elastic Agent - Defend Integration filters

The Granted Access Converter is a utility designed to help users understand and interpret the GrantedAccess values found in Sysmon Event ID 10 logs.

Sysmon configuration file