Unleashing JonMon: Deep Insights into Your Windows Activity
No ratings
Presented at Texas Cyber Summit 2023 by
For a couple of years now, I have been curious about the internals of telemetry sensors like Microsoft Defender for Endpoint, Sysmon, etc. If defense is built upon the data these tools provide, we need to understand how that data is retrieved so we can truly trust it. I have reversed these sensors, but always thought to really understand how hard it is to obtain data, how attackers can manipulate data to deceive analysts, and evade these sensors I needed to create my own sensor. Insert JonMon. JonMon is a collection of open-source telemetry sensors designed to provide users with visibility into the operations and activity of their Windows systems. One of the most important features of JonMon is its kernel-level driver component, which is designed to collect crucial information related to system operations at a very low level. Specifically, this component is capable of collecting a wide range of telemetry related to process creation, image loads, registry events, and more.In addition to the kernel-level driver component, JonMon also features a user-mode component that collects information about .NET, RPC, network activity, and other important system events. By combining data from both the kernel-level and user-mode components, JonMon provides users with a comprehensive view of their security activity.The data collected by both components is made easily accessible to users through the Windows event log, allowing users to quickly and easily query the data and gain insights into their system operations. With its powerful telemetry collection capabilities and user-friendly interface, JonMon is an essential tool for anyone wanting to know how the sensors used by modern endpoint security products obtain their information and the difficulty of getting that information.This talk will go over telemetry mechanisms, telemetry evasion capabilities, and why/how I built JonMon to understand other sensors like MDE or Sysmon better so that I can help the defensive community understand and trust the data exposed by these tools and technologies.