Системный монитор (Sysmon) — это служба, который после установки в системе остается резидентным для отслеживания и регистрации активности системы в журнале событий.
Установка репозитория Microsoft
1 2 | wget -q https://packages.microsoft.com/config/debian/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb dpkg -i packages-microsoft-prod.deb |
Установка пакетов
1 2 3 | apt-get update apt-get install sysinternalsebpf apt-get install sysmonforlinux |
После установке необходимых пакетов, возможно выполнить команду sysmon для просмотра всех параметров
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | sysmon –h Sysmon v1.0.0 - Monitors system events Sysinternals - www.sysinternals.com By Mark Russinovich, Thomas Garnier and Kevin Sheldrake Copyright (C) 2014-2021 Microsoft Corporation Using libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved. Usage: Install: sysmon -i [] Update configuration: sysmon -c [] Print schema: sysmon -s Uninstall: sysmon -u [force] -c Update configuration of an installed Sysmon driver or dump the current configuration if no other argument is provided. Optionally take a configuration file. -i Install service and driver. Optionally take a configuration file. -s Print configuration schema definition of the specified version. Specify 'all' to dump all schema versions (default is latest)). -u Uninstall service and driver. Adding force causes uninstall to proceed even when some components are not installed. The service logs events immediately and the driver installs as a boot-start driver to capture activity from early in the boot that the service will write to the event log when it starts. On Linux, events are stored in the Syslog, often found at /var/log/syslog. Use the '-? config' command for configuration file documentation. More examples are available on the Sysinternals website. Specify -accepteula to automatically accept the EULA on installation. Neither install nor uninstall requires a reboot. |
Установка и запуск службы sysmon в Debian
Скачиваем правила фиксации активности, для примера взяты правила фиксирующие всю активность в системе
1 2 | wget https://gist.githubusercontent.com/Cyb3rWard0g/bcf1514cc340197f0076bf1da8954077/raw/293db31bb81c48ff18a591574a6f2bf946282602/SysmonForLinux-CollectAll-Config.xml sysmon -accepteula -i SysmonForLinux-CollectAll-Config.xml |
Просмотр журналов sysmon
События sysmon можно просмотреть в журнале Syslog
1 | tail -f /var/log/syslog |