This is where I keep the Sysmon configs for the Living off the Land demos on my blog. There's one so far.
A modified SwiftOnSecurity config. I needed Sysmon to catch a payload hidden in an NTFS Alternate Data Stream (certutil downloads file.ext:malware.exe, wmic runs it), and I found out the default config doesn't log that specific thing at all. EID 15 only watches script extensions and the Downloads/Startup folders, so an .exe hidden in an ADS on the Desktop just slips through.
So I added rules to EID 15 for executable content in an ADS (.exe, .dll, .scr, .com). That's all it needs, the rest of the config is untouched.
Maps to T1564.004 (Hide Artifacts: NTFS File Attributes).
Deploy:
sysmon -c sysmonconfig-export.xml