Part 2 – Understanding the Most Valuable Sysmon Event IDs
Introduction
Sysmon can generate more than 30 event types. Not every event provides the same investigative value. Some events are useful only during specific investigations. Others provide valuable telemetry during nearly every threat hunt.
Effective threat hunters understand which events deserve immediate attention and how those events relate to attacker behavior.
This article examines the Sysmon events that provide the greatest value during threat hunting. The focus is not on memorizing Event IDs. The goal is to understand what each event represents and how it can help identify malicious activity.
—
Event ID 1 – Process Creation
Process creation is the foundation of endpoint threat hunting.
Nearly every attack requires the execution of a process. Whether the attacker launches PowerShell, executes ransomware, or starts a credential dumping tool, Sysmon records the event.
Event ID 1 includes information such as:
– Image path
– Original file name
– Command line
– Current directory
– Parent process
– Parent command line
– User account
– Process ID
– Parent Process ID
– Process GUID
– File hashes
This information allows analysts to answer critical investigative questions.
– What executed?
– Who executed it?
– What started the process?
– What arguments were supplied?
– When did execution occur?
Why It Matters
Attackers frequently abuse trusted Windows binaries.
Examples include:
– powershell.exe
– cmd.exe
– rundll32.exe
– regsvr32.exe
– mshta.exe
– certutil.exe
– wscript.exe
– cscript.exe
The executable itself is often legitimate.
The command line usually reveals malicious intent.
For example, a normal PowerShell session differs significantly from one that executes an encoded command or downloads remote content.
Hunting Opportunities
Look for:
– Office applications launching PowerShell.
– Browsers spawning command shells.
– Encoded PowerShell commands.
– Executables launched from user profile folders.
– Temporary directory execution.
– Unsigned administrative tools.
– Rare parent-child process relationships.
Understanding normal process execution is one of the most valuable skills a threat hunter can develop.
—
Event ID 3 – Network Connections
Eventually, attackers need to communicate.
Whether they download malware, establish command and control, or exfiltrate data, network activity provides valuable evidence.
Event ID 3 records outbound network connections.
Typical fields include:
– Source IP
– Destination IP
– Destination port
– Protocol
– Initiating process
– User account
Why It Matters
A network connection by itself is rarely suspicious.
The initiating process provides context.
For example:
A web browser connecting to a website is expected.
PowerShell connecting to an unknown external server deserves investigation.
Likewise, an executable running from a temporary directory that immediately contacts an external IP address may indicate malware execution.
Hunting Opportunities
Investigate:
– Rare outbound destinations.
– Administrative tools communicating externally.
– Unexpected DNS servers.
– Uncommon ports.
– Newly observed external infrastructure.
Network telemetry becomes even more valuable when correlated with process creation events.
—
Event ID 7 – Image Loaded
Windows applications rarely consist of a single executable.
Programs load Dynamic Link Libraries (DLLs) throughout execution.
Event ID 7 records these DLL loads.
Why It Matters
Attackers frequently abuse DLL loading.
Examples include:
– DLL search order hijacking.
– Side-loading.
– Malicious DLL replacement.
– Unsigned libraries.
Monitoring image loads can reveal persistence mechanisms that would otherwise remain invisible.
Hunting Opportunities
Look for:
– Unsigned DLLs.
– DLLs loaded from user directories.
– Unexpected DLL locations.
– Rare modules loaded by trusted applications.
Because DLL loading occurs frequently, many organizations tune this event carefully to reduce noise.
—
Event ID 8 – CreateRemoteThread
CreateRemoteThread is commonly associated with process injection.
Process injection allows one process to execute code inside another process.
Attackers use this technique to hide malicious activity.
Why It Matters
Malware frequently injects code into trusted Windows processes.
Examples include:
– explorer.exe
– svchost.exe
– lsass.exe
Process injection helps attackers evade detection and blend into legitimate system activity.
Hunting Opportunities
Investigate:
– Unexpected injection into Windows processes.
– Injection performed by scripting engines.
– Rare source processes.
– Repeated injection attempts.
Process injection should receive immediate analyst attention.
—
Event ID 10 – Process Access
Event ID 10 records when one process accesses another process.
This event is extremely valuable for identifying credential theft.
Why It Matters
Credential dumping tools often attempt to access LSASS.
LSASS stores authentication information used by Windows.
Many credential theft techniques require reading LSASS memory.
Legitimate software may also access LSASS.
Examples include:
– Endpoint security products.
– Backup software.
– Accessibility tools.
Analysts should investigate the requesting process before reaching a conclusion.
Hunting Opportunities
Review:
– LSASS access.
– Access requested by scripting engines.
– Unknown administrative utilities.
– Rare process combinations.
Context is essential.
—
Event ID 11 – File Creation
Attackers frequently create files during an intrusion.
Examples include:
– Payloads.
– Scripts.
– Tools.
– Archive files.
– Scheduled task binaries.
Event ID 11 records file creation activity.
Why It Matters
Malware rarely operates entirely in memory.
Many attacks involve dropping tools to disk.
File creation events help investigators identify:
– Payload staging.
– Tool deployment.
– Persistence components.
Hunting Opportunities
Search for:
– Executables in Downloads.
– Executables in Temp.
– Unexpected archive creation.
– Scripts written to user folders.
– Newly created administrative tools.
—
Event ID 13 – Registry Value Set
Persistence often begins with the Windows Registry.
Event ID 13 records registry value modifications.
Why It Matters
Many attacker persistence techniques rely on registry changes.
Examples include:
– Run keys.
– Startup entries.
– Security configuration changes.
– Service modifications.
Registry telemetry often survives system reboots, making it valuable during post-incident investigations.
Hunting Opportunities
Review:
– New Run entries.
– Disabled security settings.
– Unexpected autoruns.
– Registry modifications immediately after PowerShell execution.
—
Event ID 22 – DNS Query
DNS activity often provides the first indication that malware is attempting external communication.
Event ID 22 records DNS queries performed by a process.
Why It Matters
Attackers rarely communicate using raw IP addresses alone.
Most malware performs DNS lookups before contacting external infrastructure.
DNS telemetry provides valuable context.
Hunting Opportunities
Look for:
– Rare domains.
– Dynamic DNS providers.
– Newly observed domains.
– Suspicious subdomain patterns.
– DNS requests generated by PowerShell or command shells.
A DNS query alone does not indicate malicious activity.
Combined with process execution and network connections, it becomes much more valuable.
—
Correlating Events
Individual events rarely tell the complete story.
Threat hunters correlate multiple Sysmon events to reconstruct attacker activity.
Consider the following sequence:
1. Word launches PowerShell.
2. PowerShell downloads a file.
3. The downloaded executable is written to disk.
4. The executable starts.
5. The executable creates a registry Run key.
6. The executable contacts an external server.
Each action appears in a different Sysmon event.
Viewed independently, each event may appear benign.
Viewed together, they describe a complete intrusion.
This is why experienced threat hunters focus on timelines rather than isolated events.
—
Prioritize High-Value Events
Not every Sysmon event deserves equal attention.
For most threat hunting activities, prioritize:
1. Event ID 1 – Process Creation
2. Event ID 3 – Network Connection
3. Event ID 10 – Process Access
4. Event ID 13 – Registry Value Set
5. Event ID 22 – DNS Query
6. Event ID 11 – File Creation
7. Event ID 8 – CreateRemoteThread
These events provide the greatest visibility into attacker behavior while maintaining a manageable volume of telemetry.
—
Looking Ahead
Understanding Sysmon events is only one part of effective threat hunting.
The next step is learning how to use this telemetry to develop hypotheses, identify attacker tradecraft, and conduct structured investigations.
In Part 3, we will examine practical threat hunting methodologies using Sysmon. We will build hunting hypotheses, investigate common attacker techniques, correlate endpoint activity, and convert successful hunts into repeatable detection logic.
Killian Sherer 