Endpoint Detection & Response (EDR) using Sysmon + Splunk

Objective

Simulate basic endpoint detection by monitoring process execution using Sysmon logs and analyzing them in Splunk. Focused on process-level monitoring and basic threat detection.

Setup

• Windows 11 (Endpoint)
• Sysmon for process logging (Event ID 1 – Process Creation)
• Splunk Universal Forwarder (log forwarding)
• Splunk Enterprise (analysis)

Detection Logic

• Monitored Sysmon Event ID 1 (Process Creation)

• Focus on:

  • cmd.exe
  • powershell.exe

• Extracted:

  • Process path (Image)
  • CommandLine
  • Parent process
  • User

Key Queries

index=main EventCode=1 earliest=-24h
(Image="*\\cmd.exe" OR Image="*\\powershell.exe")
| table _time ComputerName Image CommandLine ParentImage User

index=main EventCode=1 earliest=-24h
(Image="*\\cmd.exe" OR Image="*\\powershell.exe")
| timechart count by Image

Outcome

• Successfully ingested Sysmon logs into Splunk
• Detected and analyzed command-line activity
• Visualized process execution trends over time

Screenshots

1. Setup Proof

2. Sysmon Logs Ingested

3. Process Detection Table

4. Detection Visualization