A curated and bespoke list of resources for learning about deploying, managing, and hunting with Microsoft Sysmon. Contains presentations, deployment methods, configuration file examples, blogs, and additional GitHub repositories. You can now breeze through most of the content here: https://mhaggis.github.io/sysmon-dfir/ Sysmon Learning Resources General Community Guide TrustedSec Sysinternals Sysmon Community Guide Utilities SysmonHunter - An easy ATT&CK-based Sysmon hunting tool SysmonX - An Augmented Drop-In Replacement of Sysmon SysmonTools - Nader Shalabi Parse Sysmon logs - Matt Churchill, CrowdStrike Sysmon Config Bypass Finder - @MartinKorman Presentations Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) -- 2018 - Tom Ueltschi How to Go from Responding to Hunting with Sysinternals Sysmon - Mark Russinovich Tracking Hackers on Your Network with Sysinternals Sysmon - Mark Russinovich Advanced Incident Detection and Threat Hunting using Sysmon and Splunk Video - Tom Ueltschi Advanced Incident Detection and Threat Hunting using Sysmon and Splunk Slides - Tom Ueltschi Splunking the Endpoint - James Brodsky Splunking the Endpoint: “Hands on!”