| CARVIEW |
?yWindows 11?V?@?\?zSysmon???I?v?V?????@?\?ɓo??B?s?R?ȋ??????????ł??Ԃ?o???ŋ????O?c?[?????p?p?FTech TIPS
2026?N3???̃A?b?v?f?[?g?iKB5079473?j?ɂ??AIT?Ǘ??҈??p?̊Ď??c?[???uSysmon?v??Windows 11?̕W???I?v?V?????Ƃ??ĒJ?n???ꂽ?B????܂Ŏ蓮???????K?v?????????x?ȃ??O???W???A???N???b?N?Ŏ????\?ɂȂ????B?s?R?ȃv???Z?X??ʐM?A?t?@?C?????????????????A?ŋ??̖h??ݒ?Ɖ?̓e?N?j?b?N??O????????B
???̋L???͉??????ł??B????o?^?i?????j????ƑS?Ă????????????܂??B
?ΏہFWindows 11
Windows 11?̐V?@?\?uSysmon?v???I?v?V?????@?\?ɓo??2026?N3???̃A?b?v?f?[?g?iKB5079473?j?ɂ??AIT?Ǘ??҈??p?̊Ď??c?[???uSysmon?v??Windows 11?̕W???I?v?V?????Ƃ??ĒJ?n???ꂽ?B????܂Ŏ蓮???????K?v?????????x?ȃ??O???W???A???N???b?N?Ŏ????\?ɂȂ????B?s?R?ȃv???Z?X??ʐM?A?t?@?C?????????????????A?ŋ??̖h??ݒ?Ɖ?̓e?N?j?b?N??O????????B
?@2026?N3??10???i?č????ԁj?ɒJ?n?ƂȂ???Windows 11?̍X?V?v???O?????iKB5079473?j?ŁA???N?Z?L?????e?B?̐??Ƃ????Ɉ??p????Ă????Ď??c?[???uSysmon?iSystem Monitor?j?v???W?????ڂ??ꂽ?B????܂ł́AMicrosoft?̃V?X?e?????[?e?B???e?B?[?W?uSysinternals?v????̎蓮?C???X?g?[?????K?v?????????A?????Windows 11?́u?I?v?V?????@?\?v???琔?N???b?N?ŗL?????ł???悤?ɂȂ????B
?@?{Tech TIPS?ł́ASysmon??L??????????@????A???O?̊m?F???@??t?B???^?????O???@?APowerShell???g??????͎?@?܂ł????????B
Sysmon?Ƃ?
?@Sysmon?iSystem Monitor?j?́AWindows?̃J?[?l?????x???œ??삷??V?X?e???Ď??c?[?????B?W????Windows?C?x???g???O?ł͋L?^????Ȃ??A???\?̂悤?ȏڍׂȊ?????ߑ????A?C?x???g???O?ɏ??????ށB
| ?Ď??Ώ? | ???e?̗? |
|---|---|
| ?v???Z?X?̐????E?I?? | ?ǂ̃v???O???????????N???????? |
| ?l?b?g???[?N?ڑ? | ?ǂ̃v???Z?X???ǂ?IP?ɒʐM?????? |
| ?t?@?C???쐬?????̕ύX | ?^?C???X?^???v?̉????m |
| ?h???C?o?̓ǂݍ??? | ?s?R?ȃJ?[?l???h???C?o?̌??o |
| ???W?X?g???̕ύX | ?????N???ݒ?Ȃǂ̏????????Ȃ? |
| DNS?N?G?? | ?h???C?????̉????L?^ |
| Sysmon?̊Ď??Ώ? | |
Sysmon??L??????????@
?@Sysmon??L???ɂ???ɂ́A2026?N3???̍X?V?v???O?????iKB5079473?j?̓K?p???K?v?ł???B?Ώۃo?[?W?????́A2024 Update?i?o?[?W????24H2?j??2025 Update?i?o?[?W????25H2?j?ł???B
?u?ݒ?v?A?v??????Sysmon??L??????????@
?@?u?ݒ?v?A?v??????́A?ȉ??̎菇?ŗL?????ł???B
??????菇
- ?u?ݒ?v?A?v?????N?????A?m?V?X?e???n?|?m?I?v?V?????@?\?n??I??????
- ?u?I?v?V?????@?\?v??ʂ́mWindows?̂??̑??̋@?\?n???N???b?N????
- ?mWindows?̋@?\?n?_?C?A???O???J???̂ŁA?uSysmon?v?Ƀ`?F?b?N?????āmOK?n?{?^?????N???b?N????
?@?ċN???͕s?v?ŁA?????ɗ??p?\?ɂȂ?B
Sysmon??L????????i1?j?u?ݒ?v?A?v?????N?????A?m?V?X?e???n?|?m?I?v?V?????@?\?n??I???A?u?I?v?V?????@?\?v??ʂ??J???A?mWindows?̂??̑??̋@?\?n???N???b?N????B
Sysmon??L????????i2?j?mWindows?̋@?\?n?_?C?A???O???J??????A?uSysmon?v?Ƀ`?F?b?N?????āmOK?n?{?^?????N???b?N????B
PowerShell????Sysmon??L????????
?@PowerShell???g????Sysmon??L???????邱?Ƃ??ł???B?Ǘ??Ҍ?????Windows?^?[?~?i????PowerShell???J???A?ȉ??̃R?}???h???b?g?????s????悢?B
Enable-WindowsOptionalFeature -Online -FeatureName "Sysmon" -NoRestart
Sysmon?T?[?r?X?̊J?n?Ə????ݒ?
?@Sysmon?́A?L?????????????ł̓T?[?r?X?͋N?????Ă??Ȃ??B?Ǘ??Ҍ????ŃR?}???h?v?????v?g?܂???PowerShell???J???A?ȉ??̃R?}???h?????s????K?v??????B
sysmon -i -n
?u-i?v?́A?T?[?r?X???C???X?g?[???E?J?n????I?v?V?????B?u-n?v?̓l?b?g???[?N?ڑ??̊Ď???L????????I?v?V?????B
Sysmon?̃T?[?r?X?????s????Sysmon??L??????????A?Ǘ??Ҍ????ŃR?}???h?v?????v?g???J???A?usysmon -i -n?v?????s???āASysmon?̃T?[?r?X???N?????ă??O?̋L?^???J?n????B
?@?R?}???h?̎??s??A?T?[?r?X??????ɋN?????Ă??邩?ǂ??????m?F????ɂ́A?Ǘ??Ҍ?????PowerShell???J???A?ȉ??̃R?}???h???b?g?????s????悢?B
Get-Service Sysmon | Format-List Name, Status, StartType
?uStatus: Running?v?ƕ\???????ΐ???ғ????Ă???B?T?[?r?X???C???X?g?[??????Ă??Ȃ??ƁA?uGet-Service : ?T?[?r?X?? 'Sysmon' ?̃T?[?r?X????????܂???B?v?Ƃ????G???[???\???????B
Sysinternals?ł?Sysmon?͎??O?ɃA???C???X?g?[?????K?v
?@????Sysinternals?ł?Sysmon???C???X?g?[?????Ă???ꍇ?́A?Ǘ??Ҍ????ŃR?}???h?v?????v?g???J???A?ȉ??̃R?}???h?????s????K?v??????B????ŃT?[?r?X?ƃh???C?o???A???C???X?g?[??????A???????풓???????????B
??32bit??
sysmon.exe -u force
??64bit??
sysmon64.exe -u force
Sysmon?̃??O???m?F??????@
?@Sysmon?????s?????????ł͈Ӗ????Ȃ??BSysmon???L?^?????C?x???g???m?F???A?ُ?Ȃ??̂??Ȃ????ǂ??????m?F????K?v??????B
???@A?F?C?x???g?r???[?A?[??Sysmon???L?^?????C?x???g???m?F????
?@?^?X?N?o?[?ɂ???m?X?^?[?g?n?{?^?????E?N???b?N???ăN?C?b?N?A?N?Z?X???j???[???J???A?m?C?x???g?r???[?A?[?n??I???A?u?C?x???g?r???[?A?[?v???N??????B
?@???y?C???Łu?A?v???P?[?V?????ƃT?[?r?X???O?v?|?uMicrosoft?v?|?uWindows?v?|?uSysmon?v?|?uOperational?v??I??????ƁA?E?y?C????Sysmon???L?^?????C?x???g?̈ꗗ???\???????B
?C?x???g?r???[?A?[?Ń??O???m?F?????u?C?x???g?r???[?A?[?v???N????????A???y?C???Łu?A?v???P?[?V?????ƃT?[?r?X???O?v?|?uMicrosoft?v?|?uWindows?v?|?uSysmon?v?|?uOperational?v??I??????B?E?y?C????Sysmon???L?^?????C?x???g?̈ꗗ???\???????B?????ŕs?R?ȃ??O???Ȃ????ǂ??????m?F????悢?B
?@?e?C?x???g?ɂ́u?C?x???gID?v???t?^????Ă???A???e?????ʂ????|????ɂȂ?B??v?ȃC?x???gID?????\?Ɏ????B
| ?C?x???gID | ???e |
|---|---|
| 1 | ?v???Z?X?????i?ł???{?I?ȊĎ????ځj |
| 2 | ?t?@?C???̍쐬?????ύX?i?^?C???X?^???v?̉?????j |
| 3 | ?l?b?g???[?N?ڑ? |
| 7 | ?C???[?W?iDLL?Ȃǁj?̓ǂݍ??? |
| 11 | ?t?@?C???̍쐬 |
| 12?^13?^14 | ???W?X?g???̕ύX |
| 22 | DNS?N?G?? |
| Sysmon???L?^????C?x???gID?̈Ӗ? | |
???@B?FPowerShell???g????Sysmon???L?^?????C?x???g???m?F????
?@?C?x???g?r???[?A?[?́AGUI?Ŋm?F?ł??ĕ?????₷???B???????A??ʂ̃??O????K?v?ȏ????i?荞?ނȂ?APowerShell?̕??????|?I?Ɍ????I???B
?@?Ⴆ?ASysmon?̒???50???̃C?x???g???擾????̂ł???APowerShell?ňȉ??̃R?}???h???b?g?????s????悢?B
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 50
PowerShell?̃R?}???h???b?g?Œ???50???̃??O???o?͂?????L?̃R?}???h???b?g?????s????ƁA????50???̃??O?????o?͂????B
?\???t?@?C???ŃC?x???g???t?B???^?????O????
?@?W???̏?Ԃł͑S?ẴC?x???g???L?^????邽?߁A???O???c??ɂȂ?d?v?ȏ??????Ă??܂??\????????BXML?`???̍\???t?@?C?????g???āu?L?^???Ȃ??C?x???g?v???`???Ă????̂??^?p?̃R?c???B
?@?ȉ??́A?P????Sysmon?̍\???t?@?C???̗Ⴞ?B
<Sysmon schemaversion="4.82">
<!-- Capture all hashes -->
<HashAlgorithms>*</HashAlgorithms>
<EventFiltering>
<!-- Log all drivers except if the signature -->
<!-- contains Microsoft or Windows -->
<DriverLoad onmatch="exclude">
<Signature condition="contains">microsoft</Signature>
<Signature condition="contains">windows</Signature>
</DriverLoad>
<!-- Do not log process termination -->
<ProcessTerminate onmatch="include" />
<!-- Log network connection if the destination port equals 443 -->
<!-- or 80, and process isn't InternetExplorer -->
<NetworkConnect onmatch="include">
<DestinationPort>443</DestinationPort>
<DestinationPort>80</DestinationPort>
</NetworkConnect>
<NetworkConnect onmatch="exclude">
<Image condition="end with">iexplore.exe</Image>
</NetworkConnect>
</EventFiltering>
</Sysmon>
?@???????A????ł͒P???ȃt?B???^?????O???????Ă??Ȃ????߁A?????̃C?x???g???L?^????Ă??܂??BGitHub?́uSwiftOnSecurity/sysmon-config?v?Ŕz?z????Ă???usysmonconfig-export.xml?v????I?ȃ??[???Z?b?g?Ƃ??čL?????p????Ă???̂ŁA????????p????̂??悢???낤?B
?@???̃t?@?C?????uconfig.xml?v?Ƃ??ĕۑ????A?ȉ??̃R?}???h?œK?p????悢?B
sysmon -c .\config.xml
?\???t?@?C???ŃC?x???g???t?B???^?????O????i1?j?u???????v?A?v?????N?????A??L?̍\???t?@?C???̓??e??\??t????B??????mTemp?n?t?H???_?ȂǂɁuconfig.xml?v?Ƃ??ĕۑ?????B
?\???t?@?C???ŃC?x???g???t?B???^?????O????i2?j?usysmon -c .\config.xml?v?????s???āA?쐬?????\???t?@?C????K?p????B????ŁA?\???t?@?C???ŏ??O????悤?ɐݒ肵???C?x???g???L?^????Ȃ??Ȃ?B
?@?ݒ肪???????K?p???ꂽ???ǂ????m?F????ɂ͈ȉ??????s????B???݂̐ݒ???e???\???????B
sysmon -c
?ݒ?̓K?p???m?F?????usysmon -c?v?R?}???h?????s????ƁA?ݒ肳??Ă?????e???o?͂????B?\???t?@?C???Őݒ肵?????e?????f????Ă??邩?ǂ??????m?F????Ƃ悢?B
PowerShell?ɂ????H?I?ȉ??
?@PowerShell???g???āA?u?^?C???X?^???v?̉?????????o????v?Ɓu?s?R?ȊO???ʐM??o???v??2?̃V?i???I??Sysmon?̃C?x???g???O???璊?o??????@???Љ?悤?B????????Ǘ??Ҍ?????PowerShell???J???Ď??s????B
?^?C???X?^???v?̉?????????o????
?@?}???E?F?A?͎??g?̑??݂??B?????߁A?쐬?????𐔔N?O?ɋU?????邱?Ƃ?????B???̃X?N???v?g?͂??́u?????????s?ׂ??̂??́v???L?^???????O?𒊏o??????̂??B
Get-WinEvent -FilterHashtable @{
LogName = 'Microsoft-Windows-Sysmon/Operational'
Id = 2 # ?t?@?C???쐬?????̕ύX
} -MaxEvents 100 | ForEach-Object {
$xml = [xml]$_.ToXml()
$data = $xml.Event.EventData.Data
[PSCustomObject]@{
Time = $_.TimeCreated
Process = ($data | Where-Object Name -eq 'Image').('#text')
TargetFile = ($data | Where-Object Name -eq 'TargetFilename').('#text')
CreationTime = ($data | Where-Object Name -eq 'CreationUtcTime').('#text')
PreviousTime = ($data | Where-Object Name -eq 'PreviousCreationUtcTime').('#text')
}
} | Format-Table -AutoSize
?@?u???????v?A?v?????N?????A??L?̃X?N???v?g??\??t???āutimestamp.ps1?v?Ȃǂ̃t?@?C?????ŕۑ????āA?Ǘ??Ҍ????ŊJ?????R?}???h?v?????v?g??PowerShell?ňȉ??̃R?}???h?Ŏ??s????悢?B
PowerShell -ExecutionPolicy RemoteSigned .\timestamp.ps1
?@?Y?????郍?O?i?C?x???g?j????????Ȃ??????Ƃ??́A?uGet-WinEvent : ?w?肵???I???????Ɉ?v????C?x???g????????܂???ł????B?v?Ƃ????G???[???b?Z?[?W???\???????B
?@?????????ꍇ?́A?Ώۃ??O?̋L?^??????Ώۃv???Z?X?̃t???p?X?Ȃǂ̈ꗗ?\???\???????B
?@??L?̃X?N???v?g?ł͒??߂̍ő?100???̃??O?𒊏o????B???????????Ƒ??₵?????ꍇ?́AGet-WinEvent?R?}???h???b?g?̈????u-MaxEvents?v?̒l?𑝂₵?Ăق????B
?s?R?ȊO???ʐM??o??
?@?ǂ̃v???Z?X???ǂ?IP?A?h???X??|?[?g?ɐڑ??????????ꗗ??????PowerShell?X?N???v?g?͈ȉ??̒ʂ肾?B??????Ȃ?????IP??[??т̒ʐM???Ȃ????ǂ????m?F????̂ɖ𗧂B
Get-WinEvent -FilterHashtable @{
LogName = 'Microsoft-Windows-Sysmon/Operational'
Id = 3 # ?l?b?g???[?N?ڑ?
} -MaxEvents 200 | ForEach-Object {
$xml = [xml]$_.ToXml()
$data = $xml.Event.EventData.Data
[PSCustomObject]@{
Time = $_.TimeCreated
Process = ($data | Where-Object Name -eq 'Image').'#text'
DestIP = ($data | Where-Object Name -eq 'DestinationIp').'#text'
DestPort = ($data | Where-Object Name -eq 'DestinationPort').('#text')
DestHost = ($data | Where-Object Name -eq 'DestinationHostname').('#text')
}
} | Sort-Object DestIP -Unique | Format-Table -AutoSize
?@?u???????v?A?v?????N?????A??L?̃X?N???v?g??\??t???āunetlog.ps1?v?Ȃǂ̃t?@?C?????ŕۑ????āA?Ǘ??Ҍ????ŊJ?????R?}???h?v?????v?g??PowerShell?ňȉ??̃R?}???h?Ŏ??s????悢?B
PowerShell -ExecutionPolicy RemoteSigned .\netlog.ps1
?s?R?ȊO???ʐM???m?F?????쐬????PowerShell?X?N???v?g?????s????ƁA?ǂ̃v???Z?X???ǂ??ƒʐM?????̂????\???????B?????ŕs?R?ȃv???Z?X????ʐM?悪?Ȃ????ǂ??????m?F????悢?B?Ȃ???ʂ́A?\???t?@?C???f????O?̃??O???܂܂?邽?߁A?V?X?e????Web?u???E?U???ʐM???????e???o?͂???Ă???B
Sysmon?̃T?[?r?X??h???C?o?̓o?^??????????
?@?usysmon -i?v?ŃC???X?g?[??????Sysmon?̃T?[?r?X??h???C?o???A???C???X?g?[??????ɂ́A?Ǘ??Ҍ????ŃR?}???h?v?????v?g???J???A?ȉ??̃R?}???h?????s????悢?B
sysmon -u
?@????ŃT?[?r?X??h???C?o?̓o?^??????????A??????????A???C???X?g?[???????BSysmon?ɂ?郍?O???L?^????Ȃ??Ȃ?B
Copyright© Digital Advantage Corp. All Rights Reserved.
?A?C?e?B???f?B?A????̂??m?点
??IT eBook
???ڂ̃e?[?}
?ҏW??????̂??m?点
RSS?ɂ???
?A?C?e?B???f?B?AID?ɂ???
???[???}?K?W???o?^
??IT?̃??[???}?K?W???́A ???????A???ׂĖ????ł??B???Ѓ??[???}?K?W???????w?ǂ????????B
ITmedia?̓A?C?e?B???f?B?A??????Ђ̓o?^???W?ł??B
???f?B?A?ꗗ | ????SNS | ?L???ē? | ???₢???킹 | ?v???C?o?V?[?|???V?[ | RSS | ?^?c??? | ?̗p??? | ??????