Applying Sysmon-type filtering to Elastic Agent Process Auditing

No ratings

Presented at BSides Augusta 2023 by

Josh Brower

Process Auditing is a powerful tool in the detection toolbox. According to @Cyb3rWard0g’s research, the vast majority of the adversarial techniques in the ATT&CK framework can be detected with process auditing. Unfortunately, this power comes with a price - process auditing generates a lot of results that can be overwhelming to sift through. In this presentation, we will walk through a practical option to handle these problems using Security Onion’s Elastic Agent integration as an example. Specifically, we will use @SwiftOnSecurity Sysmon configuration as a source filter and convert it into a format that can be used by Security Onion to filter out known-good results.