{"id":43515,"date":"2021-10-20T17:00:52","date_gmt":"2021-10-20T17:00:52","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=98985"},"modified":"2021-10-20T17:00:52","modified_gmt":"2021-10-20T17:00:52","slug":"new-microsoft-sysmon-report-in-virustotal-improves-security","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/new-microsoft-sysmon-report-in-virustotal-improves-security\/","title":{"rendered":"New Microsoft Sysmon report in VirusTotal improves security"},"content":{"rendered":"

Today, following the 25th year anniversary of Microsoft Sysinternals<\/a>, we are announcing the general availability of a new Microsoft Sysmon report in VirusTotal<\/a>.<\/p>\n

Whether you\u2019re an IT professional or a developer, you\u2019re probably already using Microsoft Sysinternals utilities to help you manage, troubleshoot, and diagnose your Windows systems and applications. The powerful logging capabilities of Sysinternals utilities became indispensable for defenders as well, enabling security analytics and advanced detections. The System Monitor (Sysmon) utility, which records detailed information on the system\u2019s activities in the Windows event log, is often used by security products to identify malicious activity.<\/p>\n

The new behavior report in VirusTotal includes extraction of Microsoft Sysmon logs for Windows executables (EXE) on Windows 10, with very low latency, and with Windows 11 on the roadmap. This is the latest milestone in the long history of collaboration between Microsoft and VirusTotal. Microsoft 365 Defender<\/a> uses VirusTotal reports as an accurate threat intelligence source, and VirusTotal uses detections from Microsoft Defender Antivirus as a primary source of detection in its arsenal. Microsoft Sysinternals Autoruns, Process Explorer, and Sigcheck tools integrate VirusTotal reports, and VirusTotal itself uses Sigcheck to report details on Windows portable executable files.<\/p>\n

The security industry has long recognized the value of Microsoft Sysmon. Last year, the United Kingdom National Cyber Security Center (NCSC) published a tutorial on basic logging requirements for security, Logging Made Easy<\/a> (LME), and cited Microsoft Sysmon as the solution for security host-based logging. Security professionals are building solutions<\/a> on Microsoft Sysmon. Microsoft Azure Sentinel includes several solutions based on Microsoft Sysmon, including parsing and normalizing<\/a> data. Meanwhile, TrustedSec has released a very useful community guide for Sysmon configuration<\/a>, noting how the tool provides security value to customers. Splunk also released a blog post that highlights how Sysmon events can be used for threat hunting<\/a>.<\/p>\n

\"Microsoft<\/p>\n

Figure 1: Microsoft Sysinternals report in VirusTotal.<\/em><\/p>\n

Adding the unique capabilities of Microsoft Sysmon to VirusTotal expands the intelligence available for the whole security community to consume, analyze, and inform solutions\u2014resulting in better security for all.<\/p>\n

\n

\u201cWe are really excited about this new collaboration with Microsoft that reinforces our long partnership to keep our world a little bit safer. VirusTotal is based on industry and community collaboration. We scan users\u2019 submissions with a variety of tools to correlate and further characterize files, URLs, IP addresses, and domains to highlight suspicious signals. We also run executables uploaded to VirusTotal in a controlled environment, resulting in the discovery of the network infrastructure used by attackers, registry keys providing persistence on infected machines, and other valuable indicators of compromise. The integration of Microsoft Sysmon is an important added value to the already existing behavior analysis solutions in the VirusTotal Multisandbox project that will benefit the entire cybersecurity community.\u201d\u2014<\/em>Karl Hiramoto, Senior Software Engineer, VirusTotal<\/p>\n<\/blockquote>\n

A look at the Microsoft Sysmon report<\/h2>\n

Sysmon\u2019s logging capabilities cover important system events such as process activity, complete with command line, activity on the filesystem and registry, network connections, and more. The Sysmon documentation<\/a> provides an exhaustive description of all the available events and security features.<\/p>\n

The Sysmon logs in the new behavior report in VirusTotal include an extraction of a rich set of indicators of compromise (IoCs) and system metadata from Microsoft Sysmon security events.<\/p>\n

For example, the activity of a coin miner malware is captured in Sysmon and exposed in the detonation report. The process activity is captured in the Process Tree, as well as in the Processes Created and Processes Terminated sections:<\/p>\n

\"Process<\/p>\n

\"Process<\/p>\n

Figure 2: Process tree, process created, and process terminated info in Microsoft Sysinternals report.<\/em><\/p>\n

Network events show the malware communication to the miner\u2019s server:<\/p>\n

\"IP<\/p>\n

Figure 3: IP traffic and DNS resolutions info in Microsoft Sysinternals report.<\/em><\/p>\n

The rest of the sections contain information about files, registry artifacts, and more. For example, the dropped files are captured and registry keys are logged:<\/p>\n

\"Dropped<\/p>\n

\"Dropped<\/p>\n

Figure 4: Dropped files and registry modification info in Microsoft Sysinternals report.<\/em><\/p>\n

Some of the shell commands clearly identify the threat as a coin miner:<\/p>\n

\"Shell<\/p>\n

Figure 5: Shell commands info in Microsoft Sysinternals report.<\/em><\/p>\n

Better community threat intelligence results, better security for all<\/h2>\n

We discussed in a past blog entry<\/a> how to use the MSTICPy Threat Intelligence APIs<\/a> to query information about IOCs and how to build relationships and graphs from them. Now we are publishing a new notebook<\/a> to explore file detonation data from VirusTotal. This new notebook lets researchers:<\/p>\n