Lesson 2.9: Sysmon and process trees
Windows' own logs say little about what programs did. Sysmon, a free Microsoft tool, records every process with its parent and full command line, network connections, files created and registry changes. The most useful question you can ask of it is 'who started this?': Word starting PowerShell is almost never normal. In the lab you read a workstation's Sysmon events, rebuild the process tree, decode the hidden PowerShell command, and find the file, the persistence and the C2 connection it created, all from one export.
18 min
You will learn to
- Explain what Sysmon records
- Rebuild a process tree from parent and child
- Recognise suspicious parent-child pairs
- Follow a process to its files, registry and network activity
- Explain living-off-the-land binaries
Key terms
- Sysmon
- System Monitor, a free Sysinternals tool from Microsoft that logs detailed process, network, file and registry activity.
- Process tree
- Processes linked by who started whom (parent → child).
- Event 1 / 3 / 11 / 13
- Process creation; network connection; file created; registry value set.
- LOLBin
- A legitimate built-in program abused by attackers, so nothing malicious needs to be installed to start.
← The same-origin policy and CORS · All lessons · Verifying downloads →