sysmon-logs

This script enhances endpoint logging telemetry for the purpose of advanced malware threat detection or for building detections or malware analysis. This can be used in production, however you might want to tune the GPO edits as needed.

Import and export custom Sysmon configurations using an interactive GUI that lets you build event rules, manage filters, and generate clean XML configs without manually editing Sysmon files.

The Granted Access Converter is a utility designed to help users understand and interpret the GrantedAccess values found in Sysmon Event ID 10 logs.

Sysmon XML Configuration for Advanced Threat Detection.

Incident Response (IR) ve tehdit tespiti odaklı optimize edilmiş bir Sysmon konfigürasyonu içerir.

Home SOC Lab - WAZUH

Sysmon logs in the window environment are received from a computer in another environment through winlogbeat through Logstash, and then repositioned in Elasticsearch and displayed in PyQt.

Cybersecurity labs showcasing SOC investigation, telemetry correlation, and analyst decision-making.

Blue Team home lab: 30 MITRE ATT&CK techniques attacked with Atomic Red Team on Windows 11 and detected in Splunk with custom SPL, plus a second Wazuh/Suricata/ELK SIEM-NIDS-HIDS deployment. Full detection-engineering writeups.

SOC Home Lab with Ubuntu (host), Wazuh SIEM, Windows endpoint (victim) with Sysmon, and Kali Linux (attacker). Simulates real-world attacks for aspiring SOC analysts. Practice threat detection, log analysis, and incident response using Wazuh and Sysmon in a controlled environment.

A professional SOC-style project using Sysmon to detect process, network, file, and registry activities on a Windows 11 VM, with simulated attacks from Kali Linux.

Built a SIEM lab using Splunk, Sysmon, and Windows/Linux VMs. Simulated real-world attacks like brute force, account lockouts, and PowerShell abuse. Developed custom detection rules, alerts, and a SOC dashboard for real-time threat monitoring.

Built SOC detection engineering lab: Sysmon + Splunk pipeline, 6 MITRE ATT&CK-mapped detections built with Atomic Red Team, a live dashboard, and a formal incident report.