olafhartong / ta-sysmon-deploy Goto Github PK

View Code? Open in Web Editor NEW

31.0 8.0 13.0 961 KB

Deploy and maintain Symon through the Splunk Deployment Sever

License: MIT License

Batchfile 100.00%

sysmon splunk-deployment splunk dfir threat-hunting

ta-sysmon-deploy's Introduction

TA-Sysmon-deploy

Deploy and maintain Sysmon through the Splunk Deployment Server.

This will enable you to have all systems running the same version of Sysmon and the same up-to-date configuration. No more logging in to all servers and installing it manually or having to negotiate a GPO change.

When deployed it will check for Sysmon on the system, when it is below the configured version (currently 8.00), it will uninstall that version and install 8.00 with the attached configuration.

Every 12 hours it will check if the config file from the deployment server is newer than the running config. If so, it will update. All actions of the scripts are logged and indexed into the Windows index as sourcetype InstallLog:Sysmon

Note!

Currently it assumes the app to be named TA-Sysmon-deploy.

It will look for the SplunkForwarder service to be installed and use its install location as a variable in the script.

I also maintain a Sysmon repository to customise your own configuration, mapped to the MITRE ATT&CK framework https://github.com/olafhartong/sysmon-modular The included config is a complete generated configuration from this repository, you can start from this. Keep a lookout for the git repository, as it is frequently updated.

Usage:

Obviously you are required to have a deployment server and installed Universal Forwarder agents connected to it.

Download the latest Sysmon version from here https://download.sysinternals.com/files/Sysmon.zip, due to the distribution license I am not able to include it. Place sysmon.exe in the bin folder and you're ready to deploy!

Download and install to your deployment server under etc/deployment-apps and assign to your servers.

ta-sysmon-deploy's People

Contributors

Stargazers

Watchers

Forkers

threatinteltest benhe119 mbrownnycnyc linuxpakistan karma1331 rebubula dekoder splunk-app-and-ta-development suirand1 rkondracki bidivermaak infinitywatch

ta-sysmon-deploy's Issues

batch issue

Hi,

i was unable to run your script on windows, when i push app. from splunk, he try to install sysmon (because i do not have it installed) and batch breaks with error:

C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin>deploy.bat

C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin>ECHO OFF
'c:\windows\sysmon.exe' is not recognized as an internal or external command,
operable program or batch file.

Usage:
Install:                 C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -i [<configfile>]
Update configuration:    C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -c [<configfile>]
Install event manifest:  C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -m
Print schema:            C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -s
Uninstall:               C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe -u [force]
  -c   Update configuration of an installed Sysmon driver or dump the
       current configuration if no other argument is provided. Optionally
       take a configuration file.
  -i   Install service and driver. Optionally take a configuration file.
  -m   Install the event manifest (done on service install as well).
  -s   Print configuration schema definition of the specified version.
       Specify 'all' to dump all schema versions (default is latest).
  -u   Uninstall service and driver. Adding force causes uninstall to proceed
       even when some components are not installed.

The service logs events immediately and the driver installs as a boot-start driver to capture activity from early in the boot that the service will write to the event log when it starts.

On Vista and higher, events are stored in "Applications and Services Logs/Microsoft/Windows/Sysmon/Operational". On older systems, events are written to the System event log.

Use the '-? config' command for configuration file documentation.More examples are available on the Sysinternals website.

Specify -accepteula to automatically accept the EULA on installation, otherwise you will be interactively prompted to accept it.

Neither install nor uninstall requires a reboot.

is there error in script?
what in case where there is not installed sysmon, does he install it?

tnx.

update.bat not updating sysmon config

Hi there,

I have altered my sysmon config on my deployment server within the TA-Sysmon-deploy but when the new config gets pushed out to clients sysmon on the endpoint doesn't get updated with the new config.

I can see the endpoint gets the new the configuration file copied to C:\Windows but sysmon continues to use the previous configuration still.

I haven't altered the update.bat script.

Any idea why it's not updating Sysmon on the endpoint with the new config?

Thanks

Multiple issues with deploy.bat scritp

Deploy.bat is not performing as it should be and it causes reinstalling sysmon every time it runs. Few issues:

sysmon.exe is not copied to c:\windows, however check is performed on it :
"FOR /F "delims=" %%b IN ('c:\windows\sysmon.exe ^| FIND /c "System Monitor v11.10"') DO"
"FIND /c "System Monitor v11.10" is hardcoded without a variable, therefore if you are having newer sysmon version it will allways goes to reinstalling sysmon
"if "%CHECK_SYSMON_RUNNIG%" == "1" " is incorrect and will never work because environment variables in batch files are expanded when a line is parsed. In the case of blocks delimited by parentheses (as your if defined) the whole block counts as a "line" or command.
This means that all occurrences of %FOO% are replaces by their values before the block is run. In your case with nothing, as the variable doesn't have a value yet.
To solve this you can enable delayed expansion:
setlocal enabledelayedexpansion
Delayed expansion causes variables delimited by exclamation marks (!) to be evaluated on execution instead of parsing which will ensure the correct behavior in your case:

if not defined BAR (
    set FOO=1
    echo Foo: !FOO!
)

olafhartong / ta-sysmon-deploy Goto Github PK

ta-sysmon-deploy's Introduction

TA-Sysmon-deploy

Note!

Usage:

ta-sysmon-deploy's People

Contributors

Stargazers

Watchers

Forkers

ta-sysmon-deploy's Issues

batch issue

update.bat not updating sysmon config

Multiple issues with deploy.bat scritp

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent