SaaSHub helps you find the best software and product alternatives Learn more →
Top 15 Sysmon Open-Source Projects
-
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
-
DetectionLab
Automate the creation of a lab environment complete with security tooling and logging best practices
-
ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
-
sysmon-config
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events. (by ion-storm)
-
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
Sigma rules https://github.com/SigmaHQ/sigma its value, I get it. Here’s a post https://www.linkedin.com/posts/nasreddinebencherchali_detection-blueteam-sigma-activity-7104868070069817344-mn91?utm_source=share&utm_medium=member_desktop detailing that 31 Sigma rules from the Sigma repository are triggering on different stages of the attack as described here https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
cd c:\sysmon git clone https://github.com/SwiftOnSecurity/sysmon-config sysmon -accepteula -i sysmon-config/sysmon-config.xml
Project mention: Scripts to build a trimmed-down Windows 11 image | news.ycombinator.com | 2024-04-25
I was specifically using the https://github.com/olafhartong/sysmon-modular config, but once we started seeing systems crash I tried building extremely minimal configs and still found them causing hangs.
Project mention: EnableWindowsLogSettings: Documentation and scripts to properly enable Windows event logs. | /r/blueteamsec | 2023-06-04
Project mention: SysmonConfigPusher: Pushes Sysmon Configs - 2 years old, but wasn't included at the time | /r/blueteamsec | 2023-06-11
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Sysmon related posts
-
Software Hardening Tools for System Defense
-
Troubleshooting Intermittent Slowness on Network Share
-
Sysmon 15.0 is out now with advanced features
-
Sysmon not reading our config.xml-file
-
SysmonConfigPusher: Pushes Sysmon Configs - 2 years old, but wasn't included at the time
-
Cheap, Fast, Good and Simple Remote Monitoring for Small Environments
-
How do you actually threat hunt?
-
A note from our sponsor - SaaSHub
www.saashub.com | 7 May 2024
Index
What are some of the best open-source Sysmon projects? This list will help you:
| Project | Stars | |
|---|---|---|
| 1 | sigma | 7,649 |
| 2 | sysmon-config | 4,580 |
| 3 | DetectionLab | 4,476 |
| 4 | WindowsSpyBlocker | 4,460 |
| 5 | ThreatHunter-Playbook | 3,873 |
| 6 | sysmon-modular | 2,495 |
| 7 | SysmonTools | 1,449 |
| 8 | whids | 1,025 |
| 9 | sysmon-config | 751 |
| 10 | Zircolite | 598 |
| 11 | EnableWindowsLogSettings | 444 |
| 12 | iMonitorSDK | 321 |
| 13 | Shhmon | 216 |
| 14 | SysmonConfigPusher | 91 |
| 15 | sysmon | 55 |
Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com