Run Sigma rules on EVTX in your browser
Run 2,395 SigmaHQ rules on Windows .evtx logs without installing Hayabusa or Chainsaw: in-browser Sigma matching, ATT&CK context, pivots, and your own YAML rules.
Posts tagged "{tag}": #sysmon
Sysmon Event ID 22: DNS queries, C2 domains and exfiltration
Using Sysmon's DNS-query event for hunting — process-attributed domain lookups, spotting C2 and DGA domains, DNS tunnelling, and the fields that make it useful.
Sysmon file and registry events: 11, 12–14, 15 and 23/26
Tracking dropped files, registry persistence, alternate data streams and self-deletion with Sysmon — FileCreate (11), registry events (12/13/14), FileCreateStreamHash (15) and FileDelete (23/26).
Sysmon Event ID 7: image loads, DLL hijacking and sideloading
Using Sysmon's image-load event to catch DLL search-order hijacking, sideloading and unsigned modules — the fields, the signature checks that matter, and how to manage its very high volume.
Sysmon Event ID 3: Network connection detected (C2 hunting)
Sysmon Event ID 3 logs each TCP/UDP connection with the process that made it. Fields explained, how to spot beaconing and LOLBin traffic, and how to tame the noise.
Sysmon Event IDs 8 and 10: process injection and LSASS access
Detecting code injection and credential theft with Sysmon — CreateRemoteThread (8) and ProcessAccess (10), reading GrantedAccess masks against lsass.exe, and using the call trace to find unsigned modules.
EVTX triage: what to read first when you have an hour and a host
A practitioner's order of operations for triaging Windows Event Logs during incident response — which channels matter, which event IDs lie to you, and where Sysmon does the heavy lifting.
Sysmon configuration that catches real adversaries
An opinionated take on Sysmon: which event IDs actually matter in IR, why olafhartong/sysmon-modular is the right baseline, and the configuration mistakes that blind you to real attacks.