Contents x
    Windows
    • 22 Nov 2023
    • 1 Minute to read
    • Contributors
    • Print
    • Dark
      Light
    Contents

    Windows

    • Updated on 22 Nov 2023
    • 1 Minute to read
    • Contributors
    • Print
    • Dark
      Light
    Article Summary

    LimaCharlie's Windows sensor is one of the EDR-class sensors. It interfaces with the kernel to acquire deep visibility into the host's activity while taking measures to preserve the host's performance.

    Supports Windows XP 32 bit and up.

    Installation Instructions

    Sensor installation instructions can be found here.

    Supported Events

    Supported Commands

    Artifacts

    Given configured paths to collect from, the Windows sensor can batch upload logs / artifacts directly from the host.

    Learn more about collecting Artifacts here.

    Payloads

    For more complex needs not supported by Events, Artifacts, or Commands, it's possible to execute payloads on hosts via the Windows sensor.

    Learn more about executing Payloads here.

    Microsoft Defender

    The Windows sensor can listen, alert, and automate based on various Defender events.

    This is done by ingesting artifacts from the Defender Event Log Source and using Detection & Response rules to take the appropriate action.

    A config template to alert on the common Defender events of interest is available here. The template can be used in conjunction with Infrastructure Service or its user interface in the web app.

    Specifically, the template alerts on the following Defender events:

    • windows-defender-malware-detected (event ID 1006)
    • windows-defender-history-deleted (event ID 1013)
    • windows-defender-behavior-detected (event ID 1015)
    • windows-defender-activity-detected (event ID 1116)
    Was this article helpful?
    What's Next