← detection engineer

Windows Telemetry Deep Dive — EVTX, Sysmon, ETW

beginner 4h

Audit-configure Windows for high-fidelity logging, read Sysmon config XML, and identify which EVTX events catch which TTPs.

After this module you will

  • › Identify the critical Event IDs every detection engineer knows (4688, 4624, 4625, 4672, 4663, 7045, …)
  • › Install and configure Sysmon with a community baseline config
  • › Read and interpret Sysmon event types 1–29
  • › Explain the difference between ETW, EVTX, and WMI subscriptions
  • › Map a TTP to the event IDs that would capture it

Lessons

1 Native Windows Event Log — Channels, Audit Policy, Critical IDs
25 min
2 Sysmon — Installation, Config XML, Event Types 1–29
30 min
3 SwiftOnSecurity & Olaf Hartong Baseline Configs — What They Include and Why
20 min
4 ETW vs EVTX vs WMI Subscriptions — When Each Source Helps
20 min
5 PowerShell & Scripting Telemetry — ScriptBlock, Module, Transcription Logging
25 min
6 Worked Example: Detecting whoami Recon Across 4688, Sysmon 1, and ETW
25 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →