blue-teamMITRE T1003.001 MITRE T1053.0052026-05

Endpoint Telemetry Validation with Sysmon & Atomic Red Team

Executed controlled credential-access and persistence tests on Windows endpoints to verify Sysmon visibility and Sigma rule coverage.

#Sysmon #Atomic Red Team #Sigma Rules #Windows Internals #MITRE ATT&CK

28 views

Attack Vector (Red)

Simulated credential dumping against lsass.exe (T1003.001) and persistence via schtasks.exe (T1053.005).

Detection Logic (Blue)

Monitored Sysmon Event ID 10 (ProcessAccess targeting lsass.exe) and Event ID 1 / 4698 for task creation.

Hardening & Mitigation

Iteratively refined Sysmon XML filtering to capture high-signal offensive artifacts without overwhelming log storage.

Case Study & Technical Notes

Set up a home lab environment with Windows endpoints forwarding Sysmon and PowerShell ScriptBlock logs (Event ID 4104) to a central collector. Used Atomic Red Team tests to emulate LSASS memory dumping (T1003.001) and scheduled task persistence (T1053.005).

powershell

Invoke-AtomicTest T1003.001 -TestNumbers 1,2
Invoke-AtomicTest T1053.005 -TestNumbers 1

Identified telemetry blind spots in the default logging configuration, tuned the modular Sysmon XML configuration, and validated that Sigma rules accurately triggered on process creation and process access events.

View on GitHub