Sysmon skills

Hunting for DCOM Lateral Movement

mukul975

Detect DCOM abuse for enhanced cybersecurity.

Detecting WMI Persistence

mukul975

Identify and analyze WMI-based persistence mechanisms.

Detecting Malicious Scheduled Tasks

mukul975

Identify and analyze malicious tasks in Windows systems.

Detecting Credential Dumping Techniques

mukul975

Identify and respond to credential theft on Windows systems.

Detecting Living Off the Land

mukul975

Identify abuse of Windows binaries for threat detection.

Hunting for Process Injection Techniques

mukul975

Detect and analyze process injection techniques on Windows.

Hunting for Lateral Movement via WMI

mukul975

Detect WMI-based lateral movement in Windows environments.

Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.

Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for cross-process memory operations, remote thread creation, and anomalous DLL loads. Use when hunting defense-evasion activity that hides code inside legitimate processes, investigating an EDR alert on suspicious cross-process access, or validating Sysmon coverage for injection detection.

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.