Windows Sysmon Monitoring with Splunk 

Overview:

For this project, I set up Sysmon on my Windows host and ingested the logs into Splunk. Sysmon provides deep visibility into process creation, network connections, and DNS queries — data that goes beyond standard Windows Security logs. Using this data, I built a Splunk dashboard that highlights suspicious activity and common attacker behaviours. 

Panel 1a – Top Executed Processes (Event ID 1)

• Shows the most commonly executed processes on the system. This helps establish a baseline of normal activity while also revealing potentially risky executables (e.g., powershell.exe, wmic.exe, rundll32.exe). 

Panel 1b – Top Executed Processes (Event ID 1)

• A quick view of the top 10 executed processes. This complements Panel 1 by providing an easy-to-read breakdown, useful for highlighting the most active executables on the system. 

Panel 2 – Suspicious Command-Line Usage (Event ID 1)

• Filters process creation events for suspicious commands. Attackers often abuse built-in tools like PowerShell, CMD, or Certutil for malicious activity. This table helps surface unusual or risky command-line executions. 

Panel 3 – Outbound Network Connections (Event ID 3)

• Shows which processes are making network connections, including destination IPs and ports. Useful for detecting unusual traffic patterns, like powershell.exe connecting externally or processes communicating over uncommon ports. 

Panel 4 – DNS Queries (Event ID 22)

• Lists the most queried domain names. Tracking DNS queries is valuable for spotting suspicious lookups, such as queries to command-and-control domains or odd, rarely seen domains. 

Lessons Learned

• Sysmon provides much deeper insights than regular Windows logs — especially around process execution and command-line arguments.

• Using stats and top commands in Splunk made it easier to aggregate large volumes of logs and focus on what really matters.

• This exercise reinforced how attackers often use “living off the land” techniques (abusing normal tools like PowerShell or CMD).
  
  

Reflection:
This project was fun because it felt more like real SOC work. Instead of just raw events, I was pulling out useful patterns. Building the panels step by step also helped me get comfortable with stats, which I now prefer over manually selecting fields.