Revisiting the Detection of Lateral Movement through Sysmon

Abstract

This work attempts to answer in a clear way the following key questions regarding the optimal initialization of the Sysmon tool, towards the identification of Lateral Movement in the MS Windows ecosystem. First, from an expert’s standpoint and with reference to the relevant literature, what are the criteria of determining the possibly optimal initialization features of the Sysmon’s event monitoring tool, which are also applicable as custom rules within the config.xml configuration file? Second, based on the identified features, how can a functional configuration file, able to identify as many LM variants as possible, be generated? To answer these questions, we relied on the MITRE ATT&CK knowledge base of adversary tactics and techniques, and focused on the execution of the nine commonest LM methods. The conducted experiments, performed on a properly configured testbed, suggested a great number of interrelated networking features, that were implemented as custom rules in the Sysmon’s config.xml file. Moreover, by capitalizing on the rich corpus of the 870K Sysmon logs collected, we create and evaluate in terms of TP and FP rates an extensible Python .evtx file analyzer, dubbed PeX, which can be used towards automatizing the parsing and scrutiny of such voluminous files. Both the .evtx logs dataset and the developed PeX tool are provided publicly for further propelling future research in this interesting and rapidly evolving field.

On the detection of lateral movement through supervised machine learning and an open-source tool to create turnkey datasets from Sysmon logs

“…In comparison to the relevant literature, which is rather scarce, the present work offers a solid, as it concerns both theoretical and empirical viewpoint, process for selecting the most appropriate classification features and data preprocessing methods towards the elimination of overfitting and the implementation of accurate and well-generalized ML models. To aid the evaluation of ML models, the LMD-2022 log-based dataset was enhanced into the LMD-2023 [26] version and implemented as element of investigation in the conducted experiments. Moreover, it is demonstrated that datasets created from the extraction of Sysmon logs into the CSV format can be quite effective, even in multiclass classification, if just trained with a bare minimum of high importance features.…”

“…The work ended with the presentation and evaluation of the Python_Evtx_Analyzer -(PeX) EDR tool, which incorporated the aforementioned EDR-policy's criteria. The tool manipulates Sysmon files in their raw EVTX form, which are then iterated over the presented EDR policy's features to reveal the existence of potential malicious LM activity (Python_Evtx_Analyzer -(PeX)) tool is publicly available on GitHub [23].…”

“…The soundness of ETCExp was assessed against a real, contemporary EVTX corpus, namely LM dataset (LMD) [26]. This will serve a dual goal: first, it allows us to verify the appropriateness of the tool for further use by the research community, and second, using the derived dataset, estimate the LM detection capacity of several ML techniques through a well-defined methodology.…”

“…To the best of our knowledge, the LMD dataset [26] is currently the only benchmark corpus comprising Sysmon logs. The 2022 LMD version (LMD-2022) incorporates normal and malicious traffic logs originated from the execution of nine state-of-the-art LM techniques, including four variants of the so-called Exploitation of Remote Services LM methodology and five equivalents credential exploitation techniques.…”