Post-breach, the number one failure is insufficient logging. Sysmon on Windows, auditd on Linux, and macOS Unified Logging generate the telemetry needed to detect privilege escalation, lateral movement, and persistence. This lesson teaches you to configure detailed auditing, ship logs to a SIEM, and create detection rules that catch real-world attack patterns—not just noise.
Sysmon (System Monitor) is a Windows service that logs detailed process creation (Event ID 1), network connections (3), file creation (11), and much more. A well-tuned Sysmon configuration (e.g., SwiftOnSecurity's template) cuts noise and highlights suspicious activity. Deploy via GPO or SCCM. Use Sysmon logs to detect process hollowing, credential dumping, and lateral movement via PSExec.
After installation, Event Viewer → Applications and Services Logs/Microsoft/Windows/Sysmon/Operational will populate with telemetry.
auditd can log system calls, file accesses, and user commands based on rules in /etc/audit/rules.d/. Add rules to monitor sensitive files (-w /etc/shadow -p wa), track privilege escalation (a always,exit -S execve -F euid=0), and log changes to critical configs. Use 'auditctl -l' to list rules. Ship logs to a central server using audispd plugins. Auditd is essential for detecting root actions.
# Add audit rules to monitor /etc/passwd and execve as root
sudo auditctl -w /etc/passwd -p wa -k passwd_changes
sudo auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -k root_commands
sudo auditctl -l # verify rules loaded💡 Use the 'ausearch' tool to query audit logs: 'ausearch -k root_commands' to see all root executions. Combine with 'aureport' for summaries.
macOS's unified logging system (log stream, log show) collects system and app logs in a single database. Use predicates to filter for security-relevant events: authorization failures, TCC denials, and process execs. Example: 'log stream --predicate 'subsystem == "com.apple.TCC"'. Forward these to a SIEM using a forwarding agent. The log data is voluminous, so precise filtering is key.
⚠️ Sysmon and auditd can generate massive log volumes. Plan storage and bandwidth accordingly, and use filtering to reduce noise before forwarding.
Verify exercises to earn ★ 200 XP and unlock next lab level.