#SysmonForLinux - Twitter Hashtag

over 2 years ago

Excited for @hack_lu! In addition to my planned talk, I'll conduct a 90-min workshop to introduce Kunai: your new Linux threat-hunting tool (an alternative to #SysmonForLinux). See you there! More info: https://t.co/qv8hqFKC5y

0

24

10

2

3K

RawSec @0xrawsec

almost 3 years ago

If you are looking for a #SysmonForLinux alternative or if you are just curious ! Take a look to kunai: https://t.co/LafBReqB4v If you want to try the stuff out, there is a pre-compiled binary on GitHub: https://t.co/I8Mj8ZsXpj #ebpf #linux #threathunting #dfir

0

3

1

281

raptor @0xdea

about 3 years ago

#Encoding is hard, exhibit no.2368474 #SysmonForLinux // ht @timb_machine https://t.co/NsvwgXa6Nw

0

5

0

935

RawSec @0xrawsec

over 3 years ago

Its been a while I did not posted on my #SysmonForLinux kind of project ! It is because it takes a lot of time to develop, here is where I am. Example, executing dig command: - we see execve event with hashes #ThreatHunting 1/6

0xrawsec's tweet photo. Its been a while I did not posted on my #SysmonForLinux kind of project ! It is because it takes a lot of time to develop, here is where I am.

Example, executing dig command:
- we see execve event with hashes

#ThreatHunting

1/6 https://t.co/qaz2KUiXZt

1

19

10

6

3K

RawSec @0xrawsec

over 3 years ago

I think I got bored waiting after #SysmonForLinux so I decided to start my own BPF based Linux monitoring project. Roadmap: - shared object loading - driver loading - dns queries - network connections Tell me if you want other stuffs for a first release ! #ThreatHunting

0xrawsec's tweet photo. I think I got bored waiting after #SysmonForLinux so I decided to start my own BPF based Linux monitoring project. Roadmap:
- shared object loading
- driver loading
- dns queries
- network connections
Tell me if you want other stuffs for a first release !
#ThreatHunting https://t.co/M6Olrkcy5O

6

149

41

36

0

Roberto Rodriguez 🇵🇪

@Cyb3rWard0g

over 4 years ago

I 💖 what @cyb3rops did here with auditd 🙏 https://t.co/QFcrVI9CTl and the extensions and additional tagging from @bfuzzy1 🚀 https://t.co/UUyIansvVT Great examples to base #SysmonForLinux collection rules 🙏 I will start adding and testing those! Thank you for sharing! 🍻

2

45

17

5

0

Roberto Rodriguez 🇵🇪

@Cyb3rWard0g

over 4 years ago

🚨 Experimenting with a @MITREattack based approach to manage our #Sysmon configs 🚀 Sharing our #SysmonForLinux configs first! Still a WIP, but would 💖 to get your feedback! 😎 All research and community driven! #MSTIC @russmcsec @jessen_kurien https://t.co/Yhr7Wh2CUI

Cyb3rWard0g's tweet photo. 🚨 Experimenting with a @MITREattack based approach to manage our #Sysmon configs 🚀

Sharing our #SysmonForLinux configs first! Still a WIP, but would 💖 to get your feedback! 😎

All research and community driven! #MSTIC @russmcsec @jessen_kurien

https://t.co/Yhr7Wh2CUI https://t.co/1f4z9K1yjG

Roberto Rodriguez 🇵🇪

@Cyb3rWard0g

over 4 years ago

🚨 Learning how to install #Sysmon for Linux 🐧 & send security events to #AzureSentinel in a research lab environment!! 🧪 #MSTIC #Microsoft 📡 Sysmon (SysinternalsEBPF) -> Syslog -> SIEM 🚀 ✅ Scripts ✅ ARM templates ✅ Sysmon configs and more.. https://t.co/juoMCueKU5

5

473

172

116

0

3

144

65

26

0

OSSEM @OSSEM_Project

over 4 years ago

🚀 Any NEW fields on the schemas for #SysmonForLinux events compared to Windows🤔? @Cyb3rPandaH used our #Sysmon for Windows & Linux data dictionaries in a python 🐍 script to answer that😎 ✅ ParentUser (ProcessCreate) ✅ User (EID 5,9,11) 🖇️ Script: https://t.co/vO1mjtvGnw

OSSEM_Project's tweet photo. 🚀 Any NEW fields on the schemas for #SysmonForLinux events compared to Windows🤔?

@Cyb3rPandaH used our #Sysmon for Windows & Linux data dictionaries in a python 🐍 script to answer that😎

✅ ParentUser (ProcessCreate)
✅ User (EID 5,9,11)

🖇️ Script: https://t.co/vO1mjtvGnw https://t.co/5SC2ozQIrB

Roberto Rodriguez 🇵🇪

@Cyb3rWard0g

over 4 years ago

🚨 Learning how to install #Sysmon for Linux 🐧 & send security events to #AzureSentinel in a research lab environment!! 🧪 #MSTIC #Microsoft 📡 Sysmon (SysinternalsEBPF) -> Syslog -> SIEM 🚀 ✅ Scripts ✅ ARM templates ✅ Sysmon configs and more.. https://t.co/juoMCueKU5

5

473

172

116

0

1

52

23

8

0

OSSEM @OSSEM_Project

over 4 years ago

@Cyb3rWard0g 🚨 Thanks to @Cyb3rPandaH , we updated our #Linux data dictionaries to keep up with the event schemas from #SysmonForLinux and share them with the community 🚀 I see some new fields names 🙊👀 https://t.co/SQtaKTgXYp @OTR_Community

0

4

0

Kevin Sheldrake @kevsecurity

over 4 years ago

Hey everyone. Thanks for all the messages - it’s been great waking up in a different time zone to see them all. Hope you all find #sysmon #sysmonforlinux useful! #Sysinternals25 #Sysinternals #eBPF

0

25

0

Kevin Sheldrake @kevsecurity

over 4 years ago

@EricaZeli @olafhartong @markrussinovich @mxatone @Sysinternals @Cyb3rWard0g I should say, the major design decision for #sysmonforlinux was that you wouldn’t need to recompile your kernel or install symbols packages or limit yourself to BTF environments. I wrote the discovery code to work it out itself. It will need improving but the aim is there.

1

3

0

Kevin Sheldrake @kevsecurity

over 4 years ago

So happy to see my Linux port of #sysmon finally being released! #Sysinternals #sysmonforlinux

12

374

50

10

0

Top Tweets for #SysmonForLinux

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users