gensecaihq/wazuh-autopilot/wazuh-windows-sysmon

Wazuh Windows and Sysmon

Windows logs reach Wazuh through the EventChannel collector and are decoded as JSON under data.win.*. Security-log rules live in the windows_security group; Sysmon rules in the sysmon group.

Field paths

Security log: Event ID → Wazuh rule

Logon types

2 interactive, 3 network (SMB, most lateral movement), 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials (runas /netonly; pass-the-hash indicator with NTLM), 10 remote interactive (RDP), 11 cached. Type 3 or 10 from workstation to workstation is unusual in most environments.

Sysmon detection groups

Sysmon events are decoded under generic sysmon_event* groups; Wazuh's behavioural detections sit in sysmon_eid*_detections groups — query these, not the raw event groups:

Sysmon Event ID 22 (DNS query) is decoded (group sysmon_event_22) but the stock ruleset has few detections on it — DNS hunting needs custom rules (example to create: custom rule 100400 for queries to newly registered domains).

Procedure

1. Read data.win.system.eventID, channel and the key eventdata fields before the rule description.
2. For authentication: build the sequence per account and source — failures (rule 60122) → lockout

(rule 60115) or success (rule 60106) → privileges (rule 67028) → group change (rule 60154). Success after a failure burst from the same source is the escalation point.

1. For process detections: parent → child → command line → network → file drops, all on the same

agent within minutes (get_wazuh_alerts agent_id="<id>" rule_groups=["sysmon"]).

1. Check prevalence with get_alerts_aggregated before calling a rule "suspicious" — some Sysmon rules

fire constantly for admin tooling.

1. Map to ATT&CK from the behaviour (see mitre-attack-mapping); rule.mitre is a hint.

Noise

Service accounts with type 5 logons, backup/monitoring accounts, SCCM/Intune, Windows Update spawning scripting hosts, IT admin PowerShell. Record the benign pattern so detection-engineer can scope a level-0 child rule.

Output

add_finding with the Event ID sequence (account, source IP/workstation, logon type, timestamps), Sysmon process chain and verdict; link_mitre for supported techniques (e.g. T1110, T1078, T1021.001, T1543.003, T1070.001, T1003.001, T1055).