SysmonLinux.Util

Description

PowerShell Module for parsing logs generated by Sysinternals Sysmon for Linux. The module can parse one or more Syslog files from a Linux system and allow for the search of specific events that meet a given criteria. The module can be use also for aiding in the generation of filter rules based on the resulting objects of queries performed against the logs, greatly speeding the creation and tunning of Sysmon configuration files.

Install

The module is available from the PowerShell Gallery https://www.powershellgallery.com/packages/SysmonLinux.Util/ from PowerShell it can be installed using the Install-Module cmdlet.

Install-Module -Name SysmonLinux.Util -Force -Verbose

Functions

The module provides the following functions:

• ConvertTo-SysmonRule
• Get-SysmonLinuxConfigChange
• Get-SysmonLinuxEvent
• Get-SysmonLinuxFileCreate
• Get-SysmonLinuxFileDelete
• Get-SysmonLinuxNetworkConnect
• Get-SysmonLinuxProcessCreate
• Get-SysmonLinuxProcessTerminate
• Get-SysmonLinuxRawAccess
• Get-SysmonLinuxState

The module allows for a general search across one or multiple event types by filtering for common fields like:

• ProcessGUID
• ParentProcessGUID
• Image
• User

This is done using the Get-SysmonLinuxEvent function.

PS />Get-SysmonLinuxEvent -EventType Any -ProcessGuid "{de9527a5-6a3f-616f-a52f-d98154560000}"
    
    EventId           : 1
    Version           : 5
    EventType         : ProcessCreate
    Computer          : ubuntu
    EventRecordID     : 35705
    RuleName          : -
    UtcTime           : 2021-10-20 01:00:47.600
    ProcessGuid       : {de9527a5-6a3f-616f-a52f-d98154560000}
    ProcessId         : 2356
    Image             : /usr/sbin/dumpe2fs
    FileVersion       : -
    Description       : -
    Product           : -
    Company           : -
    OriginalFileName  : -
    CommandLine       : dumpe2fs -h /dev/sda5
    CurrentDirectory  : /
    User              : root
    LogonGuid         : {de9527a5-0000-0000-0000-000000000000}
    LogonId           : 0
    TerminalSessionId : 4294967295
    IntegrityLevel    : no level
    Hashes            : -
    ParentProcessGuid : {00000000-0000-0000-0000-000000000000}
    ParentProcessId   : 874
    ParentImage       : -
    ParentCommandLine : -
    ParentUser        : -
    
    EventId       : 9
    Version       : 2
    EventType     : RawAccessRead
    Computer      : ubuntu
    EventRecordID : 35706
    RuleName      : -
    UtcTime       : 2021-10-20 01:00:47.619
    ProcessGuid   : {de9527a5-6a3f-616f-a52f-d98154560000}
    ProcessId     : 2356
    Image         : /usr/sbin/dumpe2fs
    Device        : /dev/sda5
    User          : root
    
    EventId       : 5
    Version       : 3
    EventType     : ProcessTerminate
    Computer      : ubuntu
    EventRecordID : 35707
    RuleName      : -
    UtcTime       : 2021-10-20 01:00:47.620
    ProcessGuid   : {de9527a5-6a3f-616f-a52f-d98154560000}
    ProcessId     : 2356
    Image         : /usr/sbin/dumpe2fs
    User          : root

Log files can be specified via the pipeline and filtering for some fileds is possible by specifying one or more values, the use of * as a wildcard is also possible.

PS /> ls syslog* | Get-SysmonLinuxProcessCreate -Image */ping,*/whoami,*/id

        EventId           : 1
        Version           : 5
        EventType         : ProcessCreate
        Computer          : ubuntu
        EventRecordID     : 7468
        RuleName          : -
        UtcTime           : 2021-10-16 04:51:15.156
        ProcessGuid       : {de9527a5-5a43-616a-312b-c11c7a550000}
        ProcessId         : 8455
        Image             : /usr/bin/ping
        FileVersion       : -
        Description       : -
        Product           : -
        Company           : -
        OriginalFileName  : -
        CommandLine       : ping 8.8.8.8 -c 2
        CurrentDirectory  : /home/carlos/Desktop
        User              : carlos
        LogonGuid         : {de9527a5-0000-0000-e803-000001000000}
        LogonId           : 1000
        TerminalSessionId : 3
        IntegrityLevel    : no level
        Hashes            : -
        ParentProcessGuid : {de9527a5-5a43-616a-f537-ea5ba5550000}
        ParentProcessId   : 8454
        ParentImage       : /usr/bin/dash
        ParentCommandLine : /usr/bin/sh
        ParentUser        : carlos

Resulting objects can be further filtered using PowerShell and leveraging the Select-Object cmdlet they can be trimmed to only those fields of interest and later fed via the pipeline in to ConvertTo-SysmonRule to build compund rules for detections or for exclusion of known behaviour.

PS /home/carlos/Desktop> Get-SysmonLinuxRawAccess | select image,device -unique | ConvertTo-SysmonRule
<Rule groupRelation="and">
 <Image condition='is'>/usr/lib/systemd/systemd-logind</Image>
 <Device condition='is'>/dev/sda1</Device>
</Rule>
<Rule groupRelation="and">
 <Image condition='is'>/usr/lib/systemd/systemd-logind</Image>
 <Device condition='is'>/dev/sda</Device>
</Rule>
<Rule groupRelation="and">
 <Image condition='is'>/usr/sbin/dumpe2fs</Image>
 <Device condition='is'>/dev/sda5</Device>
</Rule>