ETW vs Sysmon Against C2 Servers

by Damon Mohammedbeger

In this article, I want to talk about my research about ETW and Sysmon and how I can use these events for detection against C2 servers like Cobalt Strike, PoshC2, Sliver and, as always, Metasploit.

So, as a pentester and security researcher, I tried to work on the Blue-Team side (defensive approach) with my own offensive experience, etc.

In this article, I will talk about these things (which was some of my researches from two years ago about detection with a Blue-Teaming approach):

1. My own tools created with C# for monitoring ETW/Sysmon Events (Real-time) and how can Detect Remote-Thread-Injection Attack via ETW/Sysmon Events to Detect Malware/backdoor or C2 Client Process also Detecting their Traffic!
   1. ETW vs Sysmon against Cobalt Strike
   2. ETW vs Sysmon against PoshC2
   3. ETW vs Sysmon against Sliver
   4. ETW vs Sysmon against Metasploit &‌ talk about some bugs or problems I saw in my tools when as defender you want to use ETW or Sysmon.
2. Using ETW VirtualMemAlloc Events for Detection
   1. PE MZ bytes Detection via Memory Scanner tool which made by C# and this memory scanner works based on ETW VirtualMemAlloc events.

Before I begin, I want to talk about 2017, because since 2016/2017 I started to work....