Scenario 1 lab

As a hands-on exercise for scenario 1, you are going to implement detections for both the hashes and network indicators based on the context we identified in the previous section during the Investigate phase. We are going to specifically focus on Sysmon as a data source for the sake of simplicity. We’ve already mentioned that there are other places where these detections could be created, both listed in the prior tables and specific to your own environment, but the process of designing and implementing the detection remains the same regardless of the data source. After walking through this exercise, you should be able to understand how to apply the same process to your use cases.

Installing and configuring Sysmon as a data source

In this part of the lab, we will integrate Sysmon as a data source in our detection engineering lab and use it to create a detection based on the list of hashes we’ve obtained from OSINT. Sysmon is not installed and configured...