# 🛡️ Sysmon Event ID Cheat Sheet
#CS #logs #edr 

A comprehensive guide to all Sysmon Event IDs, their descriptions, and use cases for monitoring and security analysis. 🛠️

---

## 📜 Table of Sysmon Event IDs

| **Event ID** | **Event Name**                    | **Description**                                                                 |
|--------------|----------------------------------|-------------------------------------------------------------------------------|
| 1            | Process Creation                 | Logs details of process creation including parent process and command line.  |
| 2            | File Creation Time               | Records file creation timestamps. Useful for tracking unauthorized changes.  |
| 3            | Network Connection               | Captures outbound network connections.                                        |
| 4            | Sysmon Service State Changed     | Indicates changes in the Sysmon service state (e.g., start, stop).           |
| 5            | Process Terminated               | Logs details of terminated processes.                                         |
| 6            | Driver Loaded                    | Monitors driver loading. Helps detect malicious or unsigned drivers.         |
| 7            | Image Loaded                     | Logs DLL and EXE loading, including hashes. Useful for detecting tampering.  |
| 8            | CreateRemoteThread               | Captures remote thread creation, often used in injection attacks.            |
| 9            | Raw Access Read                  | Logs raw read access to disks, which could indicate malicious behavior.      |
| 10           | Process Access                   | Tracks interactions with processes, such as handle manipulation.             |
| 11           | File Create                      | Logs the creation of new files or folders.                                   |
| 12           | Registry Object Added/Deleted    | Monitors additions or deletions in the Windows Registry.                     |
| 13           | Registry Value Set               | Logs changes to registry values.                                             |
| 14           | Registry Key and Value Rename    | Tracks renaming of registry keys and values.                                 |
| 15           | FileCreateStreamHash             | Captures creation of alternate data streams.                                 |
| 16           | Sysmon Configuration Change      | Detects changes to the Sysmon configuration.                                 |
| 17           | Pipe Created                     | Monitors creation of named pipes.                                            |
| 18           | Pipe Connected                   | Tracks connections to named pipes.                                           |
| 19           | WMI Event Filter                 | Monitors WMI event filters being registered.                                 |
| 20           | WMI Event Consumer               | Logs WMI event consumers being registered.                                   |
| 21           | WMI Event Consumer to Filter     | Tracks WMI bindings between consumers and filters.                           |
| 22           | DNS Query                        | Captures DNS queries made by the system. Useful for detecting anomalies.     |
| 23           | File Deleted                     | Logs file deletion activities.                                               |
| 24           | Clipboard Change                 | Detects clipboard modifications, which can indicate data exfiltration.       |
| 25           | Process Tampering                | Captures process memory changes such as hollowing or injection.              |
| 26           | File Executed (Detected)         | Logs execution of files.                                                     |
| 27           | File Executed (Blocked)          | Tracks execution attempts that are blocked.                                  |
| 28           | File Executed with Local Admin   | Captures files executed with administrative privileges.                      |
| 29           | File Executed with System Account| Monitors execution of files with system-level privileges.                    |

---

## 🔍 Key Use Cases for Sysmon Monitoring

1. **Process Monitoring**: Use Event IDs 1, 5, and 25 to track process creation, termination, and tampering activities.
2. **Network Monitoring**: Leverage Event ID 3 to detect unauthorized or suspicious network connections.
3. **Registry Monitoring**: Event IDs 12–14 are crucial for identifying changes to critical registry keys and values.
4. **File Integrity**: Monitor file creation, deletion, and alternate data streams with Event IDs 2, 11, 15, and 23.
5. **Privilege Escalation**: Detect elevated or unauthorized executions using Event IDs 28 and 29.

---

## 💡 Pro Tips

- **Tuning**: Customize your Sysmon configuration to reduce noise and focus on relevant events.
- **Correlation**: Use Event ID combinations to detect multi-step attacks (e.g., DLL injection followed by network activity).
- **Log Forwarding**: Forward Sysmon logs to SIEM tools like Splunk or ELK for centralized analysis.

Mastering Sysmon Event IDs enables you to build a robust monitoring system and strengthen your defense strategies. 🚀