Sysmon Config Review

sysmon-config-review.md

argument-hint	<path-or-url-to-sysmonconfig.xml>
allowed-tools	Bash Read Write Glob Grep WebFetch

Sysmon Config Review — AI-Powered Configuration Audit

Review a Sysmon XML configuration for coverage gaps, risky exclusions, stale rules, and missing modern event types. Map all findings to MITRE ATT&CK techniques.

Input

$ARGUMENTS contains either:

• A local file path to a Sysmon XML configuration file
• A URL to a raw Sysmon XML config (e.g., a GitHub raw URL or any HTTP/HTTPS link)

Detect which one: if the argument starts with http:// or https://, treat it as a URL. Otherwise treat it as a file path.

If no argument is provided, look for common locations:

1. Check if a .xml file was mentioned recently in conversation
2. Look for sysmonconfig*.xml in the current directory
3. Ask the user for the path or URL

Workflow

Step 1 — Load and Parse the Config

If URL: Download the config to a temp file first:

curl -sL "<URL>" -o /tmp/sysmon-review-input.xml

Then read /tmp/sysmon-review-input.xml. If the download fails or the content is not XML (e.g., an HTML page), tell the user. For GitHub URLs, convert to raw format if needed (e.g., github.com/user/repo/blob/main/file.xml becomes raw.githubusercontent.com/user/repo/main/file.xml).

If file path: Read the file directly.

Extract:

• Schema version (<Sysmon schemaversion="X.XX">)
• Hash algorithms configured
• Whether CheckRevocation is enabled
• All <EventFiltering> sections

Step 2 — Event ID Coverage Audit

Check every Sysmon event ID and classify its status. The event IDs to check:

EID	Name	Key Field
1	ProcessCreate	<ProcessCreate>
2	FileCreateTime	<FileCreateTime>
3	NetworkConnect	<NetworkConnect>
5	ProcessTerminate	<ProcessTerminate>
6	DriverLoad	<DriverLoad>
7	ImageLoad	<ImageLoad>
8	CreateRemoteThread	<CreateRemoteThread>
9	RawAccessRead	<RawAccessRead>
10	ProcessAccess	<ProcessAccess>
11	FileCreate	<FileCreate>
12/13/14	RegistryEvent	<RegistryEvent>
15	FileCreateStreamHash	<FileCreateStreamHash>
17/18	PipeEvent	<PipeEvent>
19/20/21	WmiEvent	<WmiEvent>
22	DnsQuery	<DnsQuery>
23	FileDelete	<FileDelete>
24	ClipboardChange	<ClipboardChange>
25	ProcessTampering	<ProcessTampering>
26	FileDeleteDetected	<FileDeleteDetected>
27	FileBlockExecutable	<FileBlockExecutable>
28	FileBlockShredding	<FileBlockShredding>
29	FileExecutableDetected	<FileExecutableDetected>

For each event ID, determine:

• Active with rules: Has include/exclude rules that produce meaningful logging
• Silently disabled: Uses onmatch="include" with zero rules (logs nothing)
• Commented out: Present but inside XML comments
• Missing entirely: No section exists in the config
• Log-everything: Uses onmatch="exclude" with no/few rules (logs almost everything)

Flag any event ID that is silently disabled or missing — these are blind spots.

Step 3 — Exclusion Risk Analysis

For each event type with exclusions, evaluate:

Overly broad exclusions:

• Excluding by Image alone without CommandLine or ParentImage constraints
• Excluding by IntegrityLevel (blanket sandboxed process exclusion)
• Excluding by ParentImage where the parent is commonly spoofable
• DNS exclusions using end with on domains known to host customer content or be abused for C2 (e.g., *.windows.net, *.azurewebsites.net, *.blob.core.windows.net, *.githubusercontent.com)

Fragile exclusions:

• condition="is" on full command lines (breaks on spacing, casing, or Windows updates)
• Hard-coded paths that vary across Windows versions
• Version-specific paths (e.g., Office16, v4.0.30319)

Missing from exclusions (noise risks):

• Known-noisy processes that aren't filtered, which could cause excessive log volume
• Identify if the config is likely to generate impractical volumes for any event type

Step 4 — ATT&CK Technique Mapping

Map the config's effective coverage to ATT&CK techniques. Focus on high-impact gaps:

Credential Access:

• T1003.001 — LSASS Memory: Requires ProcessAccess (EID 10) monitoring of lsass.exe
• T1003.003 — NTDS: Requires RawAccessRead (EID 9) or FileCreate for ntds.dit copies
• T1557 — Adversary-in-the-Middle: Network monitoring of suspicious ports

Defense Evasion:

• T1055 — Process Injection: Requires CreateRemoteThread (EID 8) + ProcessAccess (EID 10)
• T1055.012 — Process Hollowing: Requires ProcessTampering (EID 25)
• T1070.004 — File Deletion: Requires FileDelete (EID 23/26)
• T1574.001/002 — DLL Hijacking/Side-Loading: Requires ImageLoad (EID 7)

Execution:

• T1059.001 — PowerShell: Check for powershell.exe, pwsh.exe, powershell_ise.exe coverage
• T1059.003 — Windows Command Shell: Check cmd.exe coverage
• T1059.005 — Visual Basic: Check wscript.exe, cscript.exe coverage
• T1059.007 — JavaScript: Check mshta.exe, node.exe coverage

Persistence:

• T1547.001 — Registry Run Keys: Check RegistryEvent coverage of Run/RunOnce keys
• T1546.003 — WMI Event Subscription: Check WmiEvent coverage
• T1053 — Scheduled Task: Check FileCreate for Tasks directory + ProcessCreate for schtasks.exe

Lateral Movement:

• T1021.002 — SMB/Windows Admin Shares: Check PipeEvent coverage
• T1570 — Lateral Tool Transfer: Check FileCreate + NetworkConnect coverage

For each gap, note:

• The ATT&CK technique ID and name
• Which Sysmon event ID would provide coverage
• Whether the config is missing the event entirely or has insufficient rules

Step 5 — Staleness Check

Evaluate whether the config has aged poorly:

• Schema version: Compare against current Sysmon capabilities. Note which features are unavailable at the config's schema version.
• Missing modern LOLBAS: Check NetworkConnect includes against the current LOLBAS project. Common misses: certreq.exe, desktopimgdownldr.exe, finger.exe, msedge.exe, diantz.exe, curl.exe (built into Win10+).
• Missing modern tools: Check if the config monitors for pwsh.exe (PowerShell 7), wt.exe (Windows Terminal), msedge.exe, winget.exe.
• Stale vendor paths: Check for outdated application paths (old Office versions, old Chrome paths, deprecated tools like EMET).
• Cobalt Strike pipe names: If PipeEvent rules exist, check if they cover current default pipe patterns (MSSE--server, postex_, status_, msagent_) and note that custom profiles easily bypass static pipe names.

Step 6 — Generate Report

Write the report to stdout (do NOT create a file unless the user asks). Structure:

## Sysmon Config Review

**File:** {filename}
**Schema Version:** {version}
**Hash Algorithms:** {algorithms}
**Certificate Revocation Check:** {yes/no}

### Event ID Coverage

| EID | Name | Status | Risk |
|-----|------|--------|------|
| 1 | ProcessCreate | Active (exclude-based) | Low |
| 7 | ImageLoad | Silently disabled | HIGH — no DLL monitoring |
| 10 | ProcessAccess | Silently disabled | HIGH — no LSASS access monitoring |
| 25 | ProcessTampering | Commented out | HIGH — no hollowing/herpaderping detection |
...

### Critical Gaps (ATT&CK)

(Top 5-10 gaps ranked by impact, each with technique ID, what's missing, and why it matters)

### Risky Exclusions

(List exclusions that are overly broad, fragile, or security-relevant, with specific XML snippets)

### Staleness Issues

(Outdated paths, missing modern binaries, schema version gaps)

### Quick Fixes

(Numbered list of copy-paste XML snippets to address the most impactful gaps, ordered by effort — lowest effort first)

### Coverage Summary

| Category | Rating | Notes |
|----------|--------|-------|
| Process Execution | Strong/Moderate/Weak | ... |
| Credential Access | Strong/Moderate/Weak | ... |
| Defense Evasion | Strong/Moderate/Weak | ... |
| Persistence | Strong/Moderate/Weak | ... |
| Lateral Movement | Strong/Moderate/Weak | ... |
| Network Activity | Strong/Moderate/Weak | ... |
| File System | Strong/Moderate/Weak | ... |

Tone and Approach

• Be direct. Flag problems, don't soften them.
• Every finding must reference a specific ATT&CK technique or concrete risk.
• Quick fixes must be valid Sysmon XML that can be pasted into the config.
• Don't just list what's missing — explain what an attacker gets away with because of each gap.
• Acknowledge what the config does well. A balanced review is more credible.