ICS Watch Dog

Microsoft Sysinternals Sysmon is one of the best tools for improving visibility into what happens on your Windows servers and workstations. The ICS Watch Dog project provides ready-to-use Sysmon configurations designed for enterprise IT and ICS/OT environments, mapped to the SANS ICS 5 Critical Controls. Start with the IT baseline and progress through OT-specific configs as your monitoring program matures.

All configs are in the sysmon-configs/ directory.

Community-contributed configurations for specific use cases. See sysmon-configs/community/.

Third-party configs retained for learning and comparison. Not maintained by ICS Watch Dog.

1. Download Sysmon from Microsoft
2. Download a configuration file from the sysmon-configs/ directory:
   • Workstations: start with sysmonconfig-baseline-it-workstation.xml
   • Servers: start with sysmonconfig-baseline-it-server.xml
3. Install from an elevated command prompt:

sysmon.exe -accepteula -i sysmonconfig-baseline-it-workstation.xml

4. Verify in Windows Event Viewer under: Applications and Services Logs > Microsoft > Windows > Sysmon > Operational

For detailed instructions, see the Getting Started guide on the project website.

Every detection rule in the curated configurations is tagged with the MITRE ATT&CK technique it is designed to detect. The technique ID, technique name, and a site-specific detection description are embedded in the Sysmon rule name attribute, which Sysmon writes to the Windows Event Log RuleName field. SIEMs can extract this structured data directly without external lookup tables, enabling ATT&CK correlation and dashboards from raw Sysmon events.

For the full convention, format details, SIEM parsing examples, and field constraints, see the ATT&CK Rule Tagging guide.

Living off the Land Binaries and Scripts (LOLBAS) detection is built into the curated configurations using a three-tier strategy that balances high-signal coverage with the false positive sensitivity of OT environments:

• Tier 1 (Core): 12 high-signal detections in all 8 curated configs. Each rule scoped by binary + command-line pattern. Should rarely or never fire in stable OT environments.
• Tier 2 (Advanced): 20 broader detections in 5 advanced configs (jumphost, server-ad, server-services, enhanced-ot, advanced-ot). Accepts moderate false positives in exchange for broader coverage.
• Tier 3 (Comprehensive): 13 opt-in modules in sysmon-configs/modules/lolbas/ providing 153 rules of Sigma-level coverage organized by ATT&CK technique family.

Tier 1 and Tier 2 use Sysmon composite <Rule groupRelation="and"> logic for high-precision detection. All rules use the ATT&CK structured tagging convention.

For the three-tier strategy, full rule lists, OT tuning guide, and comparison with other Sysmon projects, see the LOLBAS Detection guide.

Advanced users can customize their Sysmon configuration by merging opt-in modules from the sysmon-configs/modules/ directory into a curated base config. Modules are focused XML fragments organized into six categories: OT vendor (Siemens, Rockwell, Schneider, AVEVA, Ignition), IT vendor noise reduction (Chrome, Edge, Firefox, Adobe, Office), cloud storage (Dropbox, OneDrive, Google Drive, Box, MEGA), sector (electric, water, oil/gas, manufacturing), industrial protocol (Modbus, OPC-UA, DNP3, S7comm, EtherNet/IP, BACnet, IEC 60870-5-104, MQTT), and remote access (TeamViewer, AnyDesk, ScreenConnect, RustDesk).

The merge tool combines a base curated config with selected modules into a deployable configuration:

.\tools\Merge-SysmonModules.ps1 `
    -BaseConfig sysmon-configs\sysmonconfig-baseline-ot.xml `
    -Modules @(
        'sysmon-configs\modules\vendor-ot\siemens-tia-portal.xml',
        'sysmon-configs\modules\protocol\modbus-tcp.xml',
        'sysmon-configs\modules\cloud-storage\include_mega.xml'
    ) `
    -OutputPath sysmonconfig-site-acmeplant.xml

Requires: Windows PowerShell 3.0+ or PowerShell Core 7+. No external dependencies. The curated configs remain the primary supported deployment artifact -- modules are an opt-in layer for advanced users.

For module library overview, dual-use convention, and full module list, see the Module Library guide.

After deploying Sysmon, validate that your configuration is generating the expected events. The included test script performs safe actions and checks the Sysmon event log for results:

# Run observation-only tests (no system changes)
.\tools\Test-SysmonConfig.ps1

# Include registry and WMI tests (modifies system state, cleaned up automatically)
.\tools\Test-SysmonConfig.ps1 -AllowSystemChanges

Requires: Administrator privileges, Sysmon installed and running, PowerShell 3+. No external dependencies.

For details, see the Efficacy Testing guide.

Measure how well your Sysmon configuration covers your actual system. Three tools work together:

# Live system coverage report
.\tools\Get-SysmonCoverage.ps1 -ConfigPath sysmonconfig-baseline-ot.xml

# Offline: capture inventory, analyze elsewhere
.\tools\Export-SystemInventory.ps1 -OutputPath my-system.json
.\tools\Get-SysmonCoverage.ps1 -ConfigPath sysmonconfig-baseline-ot.xml -InventoryPath my-system.json

PS 2.0 compatible (Console and Markdown output). JSON output requires PS 3.0+. No external dependencies.

For details, see the Coverage Assessment guide. To build custom modules for your gaps, see the Build Your Own Module guide.

Every module includes a provenance block documenting its source and a confidence level (verified-in-lab, vendor-documented, security-research, or theoretical). Companion .validation.md files alongside each module record what has been tested and what has not.

The following matrix tracks which configurations and scripts have been tested on which operating systems and Sysmon versions. Dates reflect the most recent test run.

Legend: PASS (date) = tested and working. FAIL (date) = tested and failed. N/A = not applicable for this OS. Empty = not yet tested. Win7 scripts are expected to exit with a PS version error (this is a PASS).

Note: Server 2016 uses Sysmon.exe (32-bit); all other systems use Sysmon64.exe. Win7 scripts exit cleanly with a PS version error ("requires PowerShell 3.0 or later") -- this is the expected PASS behavior.

These configurations are provided as-is for educational and operational use. They are NOT tested against all environments and may require tuning for your specific systems. Cutaway Security, LLC and contributors assume no liability for any impact resulting from the use of these configurations. Users are responsible for testing in their own environments before production deployment. This is especially critical in ICS/OT environments where system availability and safety are paramount.

Community-contributed configurations are not maintained or tested by Cutaway Security, LLC. Users must perform their own due diligence, review, and testing before deploying community configurations in any environment.

Contributions are welcome via pull requests or GitHub issues (feature enhancements). Community configs are placed in the sysmon-configs/community/ directory with author attribution. See the Community Contributions page for guidelines.

• Microsoft Sysinternals Sysmon
• SwiftOnSecurity Sysmon Config
• Working With Sysmon Configurations Like a Pro Through Better Tooling - Matt Graeber
• Sysinternals Sysmon suspicious activity guide

This project is dual-licensed:

Open Source: Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) -- you may use, modify, and redistribute with attribution, provided derivative works are shared under the same or compatible license.

Commercial: Organizations that need to incorporate ICS Watch Dog content into proprietary products or services without the ShareAlike obligation may obtain a commercial license. Contact Cutaway Security, LLC at [email protected] for terms.

See the NOTICE file for full attribution requirements.

• Don C. Weber (cutaway)
• Aaron Boyd (icsblitz)
• Gavin Dilworth (zDHD)

This project was developed and is supported by Cutaway Security, LLC. in collaboration with each contributor.