Sysmon¶
FreeDR does not have its own Sysmon collector. It reads the
Microsoft-Windows-Sysmon/Operational channel through the
Windows Event Log source, like any other channel. Sysmon adds
network, DNS, process-access, driver-load, pipe and WMI telemetry that the
native ETW sources do not cover.
Installation¶
| When | What happens |
|---|---|
First install (setup wizard or elevated freedr-agent bootstrap) |
If neither a Sysmon64 nor a Sysmon service exists, FreeDR writes sysmon-freedr.xml and install-sysmon.ps1 to its machine directory and runs the script. If this step fails, the bootstrap stops with the stage ensure Sysmon. |
| Settings › Sources › Sysmon | The same installer can be started later from the console (it runs in the LocalSystem service). |
| Sysmon already installed | Nothing changes. FreeDR never reconfigures or replaces an existing Sysmon installation or its configuration. |
How the installer works (scripts/install-sysmon.ps1):
- Downloads
https://download.sysinternals.com/files/Sysmon.zipfrom Microsoft. FreeDR does not bundle Sysmon because its license forbids redistribution. - Checks the archive against a pinned SHA-256 and refuses to install if it differs.
- Runs
Sysmon64.exe -accepteula -i <config>and then checks that the service exists. - Downloads time out after 120 s. FreeDR kills the whole install after 5 minutes (
SYSMON_INSTALL_TIMEOUT= 300 s).
Note
The pinned hash covers one Sysmon release. If Microsoft publishes a new
Sysmon.zip, the hash check fails and the automatic install stops until
FreeDR updates the pin. You can install Sysmon yourself. FreeDR then uses
it with your configuration.
Settings › Sources shows the Sysmon state: installed, running, service name
(Sysmon64 or Sysmon), and the configuration hash the driver recorded
(HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash).
FreeDR's Sysmon configuration (config/sysmon-freedr.xml)¶
The configuration is adapted from SwiftOnSecurity sysmon-config v74 (CC BY 4.0)
and uses schema 4.50 with sha256 hashing only. Its main design choice is to
suppress Sysmon events that duplicate FreeDR's native sources.
| Sysmon event (ID) | Configured as | Reason or notable filters |
|---|---|---|
| ProcessCreate (1), ProcessTerminate (5) | Suppressed (empty include) |
Native process ETW records these. |
| FileCreateTime (2), FileCreate (11), FileDelete (23) | Suppressed | Native file ETW and USN record these. |
| RegistryEvent (12/13/14) | Suppressed | Native registry ETW records these. |
| ImageLoad (7) | Only images loaded into lsass.exe |
Used to detect credential-theft DLL loads. |
| NetworkConnect (3) | Included only for: images under C:\Users, C:\ProgramData, C:\Windows\Temp, C:\Recycle*, C:\perflogs, C:\intel, Windows\fonts, system32\config or \-rooted paths; LOLBins, Office apps and remote-access tools (for example powershell.exe, rundll32.exe, mshta.exe, certutil.exe, bitsadmin.exe, psexec.exe, nc.exe); destination ports 22, 23, 25, 143, 1080, 1723, 3128, 3389, 4444, 5800, 5900, 8080, 9001, 9030 |
Excludes Defender platform, Teams, *.microsoft.com and Akamai/NSATC Microsoft hosts, loopback and link-local addresses. |
| ProcessAccess (10) | Kept, with these exclusions: query/set-information-only masks 0x400, 0x1000, 0x1400, 0x3000 and 0x3200, unless the target is lsass.exe or Sysmon itself; svchost.exe to svchost.exe with 0x40; and Defender MsMpEng.exe as the source. |
Task Manager alone produced thousands of these per second and starved ingestion. Sysmon 15.22 crashes on a CallTrace filter, so the configuration has no CallTrace filter. |
| RawAccessRead (9) | Kept, except C:\ProgramData\FreeDR\freedr-agent.exe |
FreeDR's own USN journal reads would otherwise log about 4 events per second. |
| ProcessTampering (25) | Kept (empty exclude) |
|
| DriverLoad (6) | Kept, except signatures containing microsoft or windows, or starting with Intel |
|
| CreateRemoteThread (8) | Kept, except common system sources (WmiPrvSE, svchost, wininit, csrss, services, winlogon, audiodg), kernel32.dll start module, and Chrome as target |
|
| FileCreateStreamHash (15) | Kept (empty exclude) |
ADS creation, including Zone.Identifier. |
| PipeEvent (17/18) | Kept, except WmiPrvSE.exe connecting to \lsass and \srvsvc |
|
| WmiEvent (19/20/21) | Kept (empty exclude) |
|
| DnsQuery (22) | Kept, except reverse lookups (.arpa), localhost, and Microsoft, Bing, MSN, Skype, Office and Windows Update domains |
The configuration has no rules for 24 (clipboard) or 26–29 (file block/detect). Sysmon's own state, configuration-change and error events (4, 16, 255) cannot be filtered. FreeDR subscribes to every Sysmon ID listed below, so it also collects these events whenever Sysmon writes them, for example under your own configuration.
Sysmon events FreeDR decodes¶
Sysmon events are stored as Windows Event Log rows (windows_event_log_v2)
and appear in Hunt through events and event_log. Their event_type is
event_log.sysmon.<name>. Sysmon has no named columns. Each EventData
field is an event_payload entry with a lower-cased name, for example
image, targetimage, destinationip, queryname or grantedaccess. The
acting process (process_id, source_process_id for 8/10, or
parent_process_id for 1) fills the actor_* columns.
| ID | event_type | ID | event_type |
|---|---|---|---|
| 1 | event_log.sysmon.process_create |
16 | event_log.sysmon.configuration_changed |
| 2 | event_log.sysmon.file_creation_time_changed |
17 | event_log.sysmon.pipe_created |
| 3 | event_log.sysmon.network_connect |
18 | event_log.sysmon.pipe_connected |
| 4 | event_log.sysmon.service_state_changed |
19 | event_log.sysmon.wmi_filter |
| 5 | event_log.sysmon.process_terminate |
20 | event_log.sysmon.wmi_consumer |
| 6 | event_log.sysmon.driver_load |
21 | event_log.sysmon.wmi_binding |
| 7 | event_log.sysmon.image_load |
22 | event_log.sysmon.dns_query |
| 8 | event_log.sysmon.create_remote_thread |
23 | event_log.sysmon.file_delete |
| 9 | event_log.sysmon.raw_access_read |
24 | event_log.sysmon.clipboard_change |
| 10 | event_log.sysmon.process_access |
25 | event_log.sysmon.process_tampering |
| 11 | event_log.sysmon.file_create |
26 | event_log.sysmon.file_delete_detected |
| 12 | event_log.sysmon.registry_event_create_delete |
27 | event_log.sysmon.file_block_executable |
| 13 | event_log.sysmon.registry_event_value_set |
28 | event_log.sysmon.file_block_shredding |
| 14 | event_log.sysmon.registry_event_rename |
29 | event_log.sysmon.file_executable_detected |
| 15 | event_log.sysmon.file_create_stream_hash |
255 | event_log.sysmon.error |
With FreeDR's configuration, IDs 1, 2, 5, 11, 12–14 and 23 are normally absent. They appear if you use your own Sysmon configuration.
Self-exclusion¶
FreeDR keeps its own activity out of Sysmon data in two places:
- Configuration:
RawAccessReadexcludesC:\ProgramData\FreeDR\freedr-agent.exe. This applies only when FreeDR installed Sysmon. - Ingestion: Every Sysmon event whose acting process ID is the running
FreeDR agent is dropped before storage. The drop is counted in the Event Log
health counter
own_events_excluded. This also applies when you use your own Sysmon configuration.
When Sysmon is absent¶
The Event Log collector treats an unregistered channel as unavailable,
not as a failure. It retries that channel every 10 minutes
(UNAVAILABLE_RETRY) and reports the count as unavailable_channels. Rules
that need Sysmon data do not fire. All other sources are unaffected.