Bro-Sysmon

How to Zeek Sysmon logs.

Overview

Bro-Sysmon enables Bro to receive Windows Event Logs. This provide a method to associate Network Monitoring and Host Monitoring. The work was spurred by the need to associate JA3 and HASSH fingerprints with the application on the host. The example below shows the hostname, Process ID, connection information, JA3 fingerprints, Application Path, and binary hashes.

blocky-PC	3200	192.168.200.100	59356	172.217.7.163	443	
	e7901d17482da52152fff3e9afadfa57	85acb5f1aec131b9897ae1fc1f22aff3
	clientservices.googleapis.com	C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe
	MD5=A42A2C130941F9C979F6F0CE14E03048,SHA256=4462807702DD61C873E73BB9EAB13B6EEFA6464311AA8A1831F0A2675351B5FF

How it works

Sysmon-Broker.py uses the Broker Python Bindings to establish peering with Bro. Bro subsribes to the /sysmon message bus. Windows event logs are received in JSON format by Symon-Broker.py. The script parses the JSON object and builds an event which is sent to the /sysmon message bus. Bro receives the events and makes them available to "script land". The provided Bro scripts will generate log files prepended with "sysmon_". Custom scrips can be added to handle the events like mapping JA3 fingerprints to client applications.

			Sysmon-Broker.py					Bro
				|						|
				|    ------ Establish Peering  ------>		|
				|						|
				|    <----- Establish Peering  -------		|
				|						|
				|    <----- Subscirbe /sysmon  -------		|
				|						|
Receive Sysmon JSON	-->	|						|
				|						|
				| -- Parse JSON					|
				| -- Build Event				|
				|						|
				|						|
				|    ------ Publish to /sysmon ------>		|
				|						|
				|						|  --> Bro Scipt to Log 
				|						|
				|						|  --> Bro Script Build Map 
											JA3 to Appication

Getting Started

• Install Sysmon on Windows host, tune config as you like.
• Install WinLogBeat on Windows host and configure to forward to Logstash on a Linux box.
• Install Logstash, Broker and Bro on the Linux host.
• Configure Logstash on the Linux host as beats listener and write logs out to file.
  Example Logstash config:

  	input {
  		beats {
  		  port => 9000
  		}
  	}
  	output {
  		file {
  		  path => "/home/logstash/bro-sysmon/WindowsSysmon.json"
  		}
  	}
  

• copy the sysmon folder to $bropath/share/bro/site/
• modify local.bro to include sysmon directory `@load sysmon`
• start Bro as you see fit, start in foreground until you're happy with it.
• tail -f /home/logstash/WindowsEventLogs.json | python sysmon-Broker.py &

Output

Bro-Sysmon events will now be available to Bro Scripts.

event sysmonProcNetConn(computerName: string, proto: string, 
			srcip: string, srcprt: string, dstip: string, dstprt: string, 
			processId: string, procImage: string) {
		print fmt("Host %s spawned ProcessID %s, %s", computerName, processId, procImage);
		}
Output: Host blocky-PC spawned ProcessID 3968, C:\Users\blocky\Desktop\putty.exe

Bro-Sysmon logs will be written to file.

#fields computerName    processId       company currentDirectory        description     fileVersion     hashes  image   integrityLevel  logonGuid       logonId parentCommandline       parentImage
     parentProcessGuid       parentProcessId processGuid     product terminalSessionId       user    utcTime
A8A1831F0A2675351B5FF	C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe	Low	{7A15C4BA-936D-5BDC-0100-0020642C5435}	0x135542c64	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" 	C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe	{7A15C4BA-F08F-5BEE-0100-00109E978637}	4584	-	?	2	blocky-PC\\blocky	2018-11-16 16:30:09.143

Credits

Bro-Sysmon concept was conceived and developed by Jeff Atkinson (@4a7361). Special thanks goes out to Kevin Thompson (@bfist), @tenzir_company and @0xHosom.

License

Bro-Sysmon comes with a 3-Clause BSD license