# Revisiting the Detection of Lateral Movement through Sysmon
## 6 Methodology  
For the needs of this work, we relied on log files produced by Sysmon, which is both a Windows system service and a device driver. Once installed, it is resilient to all the OS activities, including reboots and the event logger. Sysmon monitors and gathers event-oriented information in detail, namely process creations, network connections and modification actions, while organizing them simultaneously in folders and files of different compatible formats, namely.evtx,.xml,.csv, and.txt, to be available for further analysis. Sysmon currently supports 27 distinct types of case-sensitive events, which may be generated during logging activity of networking traffic and OS processes. The second column of Table 3 designates the Event IDs that were recognized in the context of the present work either as normal or suspicious and implemented them in the proposed rule-based policy detailed in Sections 6.1 and 6.2 and Appendices A.1 and A.2. The rightmost column of the same table specifies the designated per attack vector and Event ID related subsection. It is important to note that any Event ID that was not recognized during the analysis of the conducted experiments is omitted from Table 3, as it is irrelevant to the context of this paper. The basic features and capabilities of Sysmon, along with the full list of the supported Event IDs, can be found on the tool's official website in [4]. Sysmon allows the adoption of a rule-based custom configuration approach for the _config.xml_ file. Each event is identified and filtered through a specified tag placed under the EventFiltering section in the _config.xml_ file. The detailed list of all the available tags, along with the list of the conditional statements, which are necessary for the initialization of the _config.xml_ file, are available in the tool's official documentation [4]. Precisely, within the context of this paper, Sysmon was used to filter and identify events related to the executed LM attacks included in Section 5. Specifically for the attacks, due to their nature, they were divided into two main categories, namely _Exploitation of Remote Services and Credential Exploitation Attacks_, and discussed in Sections 6.1 and 6.2, respectively. Listing 1 presents the necessary initialization statements for the _config.xml_ file to be loaded in Sysmon's configuration. As seen in the first line of the listing, the declaration of the _schemaversion_, under the tag _<Sysmon schemaversion=\"13.30\"_>_, is fundamental for the initialization of the _config.xml_ file. Moreover, the declaration of the utilized _hashalgorithms_ as well as the <EventFiltering> tag, which states that the nature of the configuration file has to do with the filtering of Sysmon Events, are both of equal importance. The final required statement of xml code is the necessary specification for each concept _RuleGroup_. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**No.** & **Event ID** & **Description** & **Subsection** \\ \hline
1 & _Event ID 1_ & Process creation & Sections 6.1 and 6.2 \\
2 & _Event ID 2_ & A process changed a file creation time & Sections 6.1.3, 6.1.4 and 6.2 \\
3 & _Event ID 3_ & Network connection & Sections 6.1.4 and 6.2.1–6.2.3 \\
4 & _Event ID 5_ & Process terminated & Sections 6.1 and 6.2 \\
5 & _Event ID 10_ & Process Access & Sections 6.2.1–6.2.3 and 6.2.5 \\
6 & _Event ID 11_ & FileCreate & Sections 6.2.1–6.2.3 \\
7 & _Event ID 13_ & RegistryEvent (Value Set) & Sections 6.2.1–6.2.3 \\
8 & _Event ID 2_ & DNSEvent (DNS query) & Sections 6.2.1–6.2.3 \\
9 & _Event ID 23_ & FileDelete (File Delete archived) & Section 7.2 * \\
10 & _Event ID 255_ & Event ID 255: Error & Section 7.2 * \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Sysmon-generated events during the conducted experiments of Sections 6.1 and 6.2. The star exhibiter denotes normal traffic exclusively. For the purposes of the configuration of the _config.xml_ file, with the proposed rule-based methodology, more than 150 rules have been created.