Module 11 — Sysmon First Hunt Workbook

Prerequisites: Tools installed · EVTX module · VNC or RDP to .114

0. Purpose

Reading Event ID tables is not hunting. This workbook walks one repeatable narrative: something spawned PowerShell and wrote a file — then you prove it in three log layers plus GUI confirmation.

1. ELI5

You stage a harmless "suspicious" play in the lab (new PowerShell child + temp file). Then you ask three witnesses what they saw:

1. Sysmon — "I saw process create (1), file create (11), maybe network (3)"
2. Security log — "I saw 4688 with command line"
3. ProcExp / Procmon — "I saw the parent chain and disk writes live"

If all three agree, you can hunt for real.

2. Lab access (GUI)

3. Scenario — "spawn and stage"

Step A — Trigger (SSH)

# On .114 (or from MiniMac via SSH)
powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\tester808\win11_hunt_lab_trigger.ps1

Installer copy from MiniMac:

scp ~/code/CodeCollector/win11_hunt_lab_trigger.ps1 tester808@192.168.50.114:C:/Users/tester808/

What it does (benign):

1. Writes hunt-lab-<timestamp>.txt under %TEMP%
2. Spawns child powershell.exe via Start-Process
3. Dumps recent Sysmon + Security events to JSON

Step B — Expected telemetry (verified 2026-09-01)

Example live capture:

Sysmon 1  → powershell.exe (child)
Sysmon 11 → ...\Temp\hunt-lab-20260901-095751.txt
Security 4688 → tester808 created powershell.exe

4. Investigation commands (SSH)

# Sysmon — last 15 minutes, hunt IDs only
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 200 |
  Where-Object { $_.TimeCreated -gt (Get-Date).AddMinutes(-15) -and $_.Id -in 1,3,7,11,22 } |
  Select-Object TimeCreated, Id, @{N='Img';E={
    if ($_.Message -match 'Image: (.+?)\r') { $matches[1].Split('\')[-1] } else { '...' }
  }} | Format-Table -AutoSize

# Security — 4688 with command line
Get-WinEvent -LogName Security -MaxEvents 50 |
  Where-Object { $_.Id -eq 4688 -and $_.TimeCreated -gt (Get-Date).AddMinutes(-15) } |
  Select-Object TimeCreated, @{N='Msg';E={$_.Message.SubstringMin(300,$_.Message.Length)}} |
  Format-List

# Correlate by time — replace timestamp
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 500 |
  Where-Object { $_.Message -match 'hunt-lab' } |
  Select-Object TimeCreated, Id, Message

5. GUI hunt (VNC session)

Process Explorer

1. Launch procexp64.exe as Administrator.
2. Find your hunt powershell.exe session (or re-run trigger while ProcExp is open).
3. Lower pane (Ctrl+D) — confirm amsi.dll, ntdll.dll loaded.
4. Properties → Image — path, command line, parent (if still running).

Process Monitor

1. Launch Procmon64.exe as Administrator.
2. Filter → Filter… add:
   • Process Name is powershell.exe → Include
   • Path contains hunt-lab → Include
3. Run trigger script from elevated PowerShell in VNC session.
4. Look for CreateFile / WriteFile on %TEMP%\hunt-lab-*.txt.
5. File → Save → C:\Users\tester808\Documents\hunt-01.pml — stop capture when done.

6. Correlation worksheet

Fill this after each run:

Filled example — c2_rust lab on .114 (2026-09-01)

Auto-generated via win_hunt_worksheet_fill.ps1 after carrier + udrl + implant runs:

# Regenerate worksheet from MiniMac
scp tools/platform_lab/scripts/win_hunt_worksheet_fill.ps1 tester808@192.168.50.114:/tmp/
ssh tester808@192.168.50.114 \
  "powershell -File C:/tmp/win_hunt_worksheet_fill.ps1 -SinceMinutes 90"

VNC checklist (ProcExp): Find platform-agent.exe → Ctrl+D → confirm amsi.dll, ntdll.dll loaded → after spawn_inject, child Notepad under parent.

sequenceDiagram
  participant You as Operator SSH/VNC
  participant PS as powershell.exe
  participant Child as child powershell
  participant Sys as Sysmon
  participant Sec as Security log

  You->>PS: run hunt trigger
  PS->>Child: Start-Process
  Sys-->>You: Event 1 (both PIDs)
  PS->>PS: Out-File temp
  Sys-->>You: Event 11 (file)
  Sec-->>You: Event 4688 (cmdline)

7. Stretch exercises

8. Record in notebook

• Completed one full hunt correlation worksheet
• Saved one Procmon .pml or screenshot of ProcExp DLL pane
• Named three differences between Sysmon 1 and Security 4688

Navigation

← Tools inventory · c2_rust hunt correlation · AD domain lab · MOC