Sysmon Detection Engineering

About this course

You should already have Sysmon installed and configured with a working ruleset, know how to read a Sysmon event in Event Viewer or a log pipeline, and understand basic Windows process and network concepts. If you have not configured Sysmon before, complete a Sysmon fundamentals course first; this course assumes the tool is already running and focuses entirely on building detections from the telemetry it produces...

Unlock it with 90 HFC, or get every paid lab and course with HackFury Pro.

Skills you practice

Difficulty: Advanced

• Defensive security

What the course covers

1. Prerequisites
2. Purpose
3. Concept Map
4. Abbreviations
5. Terminology
6. Core Lessons
7. Danger Zone
8. Real World
9. Scope
10. Readiness Checklist
11. FAQ
12. Key Takeaways
13. Summary