admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Proper XML formatting

Browse Source
This commit is contained in:
Olaf Hartong
2021-04-24 20:22:10 +02:00
parent c8efb72933
commit 05ba7a6803
287 changed files with 3044 additions and 3034 deletions
Download Patch File Download Diff File Expand all files Collapse all files
10_process_access/exclude_carbon_black_response.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Windows\CarbonBlack\cb.exe</SourceImage><!--CarbonBlack:Response-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Windows\CarbonBlack\cb.exe</SourceImage> <!--CarbonBlack:Response-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_cisco_amp.xml
+7 -7
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="contains all">C:\Program Files\Cisco\AMP\;sfc.exe</SourceImage><!--Cisco AMP-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="contains all">C:\Program Files\Cisco\AMP\;sfc.exe</SourceImage> <!--Cisco AMP-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_couchbase_sigar.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">c:\Program Files\Couchbase\Server\bin\sigar_port.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">c:\Program Files\Couchbase\Server\bin\sigar_port.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_ivanti.xml
+8 -8
View File
@@ -1,12 +1,12 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\cpushld.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Ivanti\Workspace Control\cpushld.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\RES Software\Workspace Manager\cpushld.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\cpushld.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Ivanti\Workspace Control\cpushld.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\RES Software\Workspace Manager\cpushld.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_lsass_noise.xml
+20 -20
View File
@@ -1,22 +1,22 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="end with">wmiprvse.exe</SourceImage>
<SourceImage condition="end with">GoogleUpdate.exe</SourceImage>
<SourceImage condition="end with">LTSVC.exe</SourceImage>
<SourceImage condition="end with">taskmgr.exe</SourceImage>
<SourceImage condition="end with">VBoxService.exe</SourceImage> <!-- Virtual Box -->
<SourceImage condition="end with">vmtoolsd.exe</SourceImage> <!-- VMWare -->
<SourceImage condition="end with">\Citrix\System32\wfshell.exe</SourceImage> <!--Citrix process in C:\Program Files (x86)\Citrix\System32\wfshell.exe -->
<SourceImage condition="is">C:\Windows\System32\lsm.exe</SourceImage> <!-- System process under C:\Windows\System32\lsm.exe -->
<SourceImage condition="end with">Microsoft.Identity.AadConnect.Health.AadSync.Host.exe</SourceImage> <!-- Microsoft Azure AD Connect Health Sync Agent -->
<SourceImage condition="begin with">C:\Program Files (x86)\Symantec\Symantec Endpoint Protection</SourceImage> <!-- Symantec -->
<GrantedAccess>0x1000</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION Generic call, quite noisy and tells not much-->
<GrantedAccess>0x1400</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_QUERY_INFORMATION Generic call, quite noisy and tells nothing-->
<GrantedAccess>0x101400</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_QUERY_INFORMATION + SYNCHRONIZE Generic call, quite noisy and tells nothing-->
<GrantedAccess>0x101000</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION + SYNCHRONIZE Generic call, quite noisy and tells nothing-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="end with">wmiprvse.exe</SourceImage>
<SourceImage condition="end with">GoogleUpdate.exe</SourceImage>
<SourceImage condition="end with">LTSVC.exe</SourceImage>
<SourceImage condition="end with">taskmgr.exe</SourceImage>
<SourceImage condition="end with">VBoxService.exe</SourceImage> <!-- Virtual Box -->
<SourceImage condition="end with">vmtoolsd.exe</SourceImage> <!-- VMWare -->
<SourceImage condition="end with">\Citrix\System32\wfshell.exe</SourceImage> <!--Citrix process in C:\Program Files (x86)\Citrix\System32\wfshell.exe -->
<SourceImage condition="is">C:\Windows\System32\lsm.exe</SourceImage> <!-- System process under C:\Windows\System32\lsm.exe -->
<SourceImage condition="end with">Microsoft.Identity.AadConnect.Health.AadSync.Host.exe</SourceImage> <!-- Microsoft Azure AD Connect Health Sync Agent -->
<SourceImage condition="begin with">C:\Program Files (x86)\Symantec\Symantec Endpoint Protection</SourceImage> <!-- Symantec -->
<GrantedAccess>0x1000</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION Generic call, quite noisy and tells not much-->
<GrantedAccess>0x1400</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_QUERY_INFORMATION Generic call, quite noisy and tells nothing-->
<GrantedAccess>0x101400</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_QUERY_INFORMATION + SYNCHRONIZE Generic call, quite noisy and tells nothing-->
<GrantedAccess>0x101000</GrantedAccess> <!-- PROCESS_QUERY_LIMITED_INFORMATION + SYNCHRONIZE Generic call, quite noisy and tells nothing-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_mcafee_endpoint.xml
+7 -7
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe</SourceImage><!--McAfee:Endpoint Security Platform-->
<SourceImage condition="is">C:\Program Files\McAfee\Agent\x86\macompatsvc.exe</SourceImage><!--McAfee:Agent-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe</SourceImage> <!--McAfee:Endpoint Security Platform-->
<SourceImage condition="is">C:\Program Files\McAfee\Agent\x86\macompatsvc.exe</SourceImage> <!--McAfee:Agent-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_microsoft_windows_defender.xml
+6 -6
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\Microsoft Security Client\MsMpEng.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Microsoft Security Client\MsMpEng.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_mobaxterm.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_palo_alto_cortex_xdr.xml
+7 -7
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\Palo Alto Networks\Traps\cyserver.exe</SourceImage><!--Palo Alto Cortex XDR-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\Palo Alto Networks\Traps\cyserver.exe</SourceImage> <!--Palo Alto Cortex XDR-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_razr_sdk.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_sccm.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\WINDOWS\CCM\CcmExec.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\WINDOWS\CCM\CcmExec.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_splunk.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\Splunk\bin\splunkd.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Splunk\bin\splunkd.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_vmware_player.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files (x86)\VMware\VMWare Player\vmware-authd.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\VMware\VMWare Player\vmware-authd.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_vmware_workstation.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_winzip.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\WinZip\FAHWindow64.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\WinZip\FAHWindow64.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_debugging.xml
+6 -6
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<CallTrace name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">dbghelp.dll</CallTrace>
<CallTrace name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">dbgcore.dll</CallTrace>
<CallTrace name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">dbghelp.dll</CallTrace>
<CallTrace name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">dbgcore.dll</CallTrace>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_desktop.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<TargetImage condition="contains">Desktop</TargetImage> <!--Files on the Desktop-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<TargetImage condition="contains">Desktop</TargetImage> <!--Files on the Desktop-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_dumphashes.xml
+21 -21
View File
@@ -1,24 +1,24 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\csrss.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--><!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\wininit.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--><!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\winlogon.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--><!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\services.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--><!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\csrss.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--> <!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\wininit.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--> <!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\winlogon.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--> <!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\services.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--> <!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_hook_check.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<GrantedAccess name="technique_id=T1093,technique_name=Process Hollowing">0x21410</GrantedAccess> <!-- misc::detours in Mimikatz, thanks @Carlos_Perez -->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<GrantedAccess name="technique_id=T1093,technique_name=Process Hollowing">0x21410</GrantedAccess> <!-- misc::detours in Mimikatz, thanks @Carlos_Perez -->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_lsass_access.xml
+17 -17
View File
@@ -1,25 +1,25 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<!-- In some environments this causes HIGH CPU usage by sysmon, remove this module when that occurs -->
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--><!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1FFFFF</GrantedAccess><!--Expect EDRs/AVs to also trigger this-->
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--><!-- depending on what you're running on your host, this might be noisy-->
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--> <!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1FFFFF</GrantedAccess> <!--Expect EDRs/AVs to also trigger this-->
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--> <!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1F1FFF</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--><!-- depending on what you're running on your host, this might be noisy-->
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--> <!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x1010</GrantedAccess>
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--><!-- depending on what you're running on your host, this might be noisy-->
</Rule>
<Rule groupRelation="and">
<TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage> <!--Mitre T1098--> <!--Mitre T1550.002--> <!--Mitre T1003--> <!-- depending on what you're running on your host, this might be noisy-->
<GrantedAccess>0x143A</GrantedAccess>
</Rule>
</Rule>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_office_process_injection.xml
+7 -7
View File
@@ -1,12 +1,12 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include"><!-- Credit to @Antonlovesdnb https://blog.pwntario.com/team-posts/antons-posts/hunting-malicious-macros-->
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include"> <!-- Credit to @Antonlovesdnb https://blog.pwntario.com/team-posts/antons-posts/hunting-malicious-macros-->
<Rule groupRelation="and" name="technique_id=T1055,technique_name=Process Injection">
<SourceImage condition="contains all">C:\Program Files;\Microsoft Office\Root\Office</SourceImage>
<CallTrace condition="contains">\Microsoft Shared\VBA</CallTrace>
<SourceImage condition="contains all">C:\Program Files;\Microsoft Office\Root\Office</SourceImage>
<CallTrace condition="contains">\Microsoft Shared\VBA</CallTrace>
</Rule>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_process_discovery.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<!--<GrantedAccess name="technique_id=T1057,technique_name=Process Discovery">0x1410</GrantedAccess> Disabled, quite noisy --><!--Experimental: when a process accesses a lot of other processes this is process discovery through meterpreter for example-->
<!--<GrantedAccess name="technique_id=T1057,technique_name=Process Discovery">0x1410</GrantedAccess> Disabled, quite noisy --> <!--Experimental: when a process accesses a lot of other processes this is process discovery through meterpreter for example-->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_process_suspend_resume.xml
+11 -11
View File
@@ -1,14 +1,14 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<GrantedAccess name="technique_id=T1093,technique_name=Process Hollowing">0x0800</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME -->
<GrantedAccess name="technique_id=T1003,technique_name=Credential Dumping">0x0810</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME + PROCESS_VM_READ - possible memory dump to extract sensitive information -->
<GrantedAccess name="technique_id=T1055,technique_name=Process Injection">0x0820</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME + PROCESS_VM_WRITE - possible memory injection -->
<GrantedAccess name="technique_id=T1093,technique_name=Process Hollowing">0x800</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME -->
<GrantedAccess name="technique_id=T1003,technique_name=Credential Dumping">0x810</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME + PROCESS_VM_READ - possible memory dump to extract sensitive information -->
<GrantedAccess name="technique_id=T1055,technique_name=Process Injection">0x820</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME + PROCESS_VM_WRITE - possible memory injection -->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<GrantedAccess name="technique_id=T1093,technique_name=Process Hollowing">0x0800</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME -->
<GrantedAccess name="technique_id=T1003,technique_name=Credential Dumping">0x0810</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME + PROCESS_VM_READ - possible memory dump to extract sensitive information -->
<GrantedAccess name="technique_id=T1055,technique_name=Process Injection">0x0820</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME + PROCESS_VM_WRITE - possible memory injection -->
<GrantedAccess name="technique_id=T1093,technique_name=Process Hollowing">0x800</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME -->
<GrantedAccess name="technique_id=T1003,technique_name=Credential Dumping">0x810</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME + PROCESS_VM_READ - possible memory dump to extract sensitive information -->
<GrantedAccess name="technique_id=T1055,technique_name=Process Injection">0x820</GrantedAccess> <!-- PROCESS_SUSPEND_RESUME + PROCESS_VM_WRITE - possible memory injection -->
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_suspicious_locations.xml
+22 -22
View File
@@ -1,26 +1,26 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\PerfLogs\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\$Recycle.bin\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Intel\Logs\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Default\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Public\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\NetworkService\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Fonts\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Debug\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Media\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Help\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\addins\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\repair\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\security\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\system32\config\systemprofile\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">VolumeShadowCopy</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\htdocs\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\wwwroot\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\Temp\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\PerfLogs\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\$Recycle.bin\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Intel\Logs\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Default\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Public\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\NetworkService\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Fonts\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Debug\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Media\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Help\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\addins\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\repair\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\security\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\system32\config\systemprofile\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">VolumeShadowCopy</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\htdocs\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\wwwroot\</SourceImage>
<SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\Temp\</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/include_suspicious_powershell.xml
+4 -4
View File
@@ -1,12 +1,12 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="include">
<Rule groupRelation="and">
<CallTrace name="technique_id=T1059.001,technique_name=PowerShell" condition="contains">System.Management.Automation.ni.dll</CallTrace>
<SourceImage condition="is not">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</SourceImage>
</Rule>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_dell_process.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Dell-->
<Image condition="is">C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</Image>
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Dell-->
<Image condition="is">C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</Image>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_intel_gfx_service.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Intel-->
<Image condition="is">C:\Windows\system32\igfxCUIService.exe</Image> <!--Intel: Drops bat and other files in \Windows in normal operation-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Intel-->
<Image condition="is">C:\Windows\system32\igfxCUIService.exe</Image> <!--Intel: Drops bat and other files in \Windows in normal operation-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_ivanti_res.xml
+7 -7
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<Image condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
<Image condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe</Image>
</FileCreate>
</RuleGroup>
</EventFiltering>
<Image condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
<Image condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe</Image>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_microsoft_click2run.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Microsoft:Office:Click2Run-->
<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image> <!-- Microsoft:Office Click2Run-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Microsoft:Office:Click2Run-->
<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image> <!-- Microsoft:Office Click2Run-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_microsoft_services.xml
+12 -12
View File
@@ -1,14 +1,14 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<Image condition="is">C:\Windows\System32\smss.exe</Image> <!-- Microsoft:Windows: Session Manager SubSystem: Creates swapfile.sys,pagefile.sys,hiberfile.sys-->
<Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image> <!-- Microsoft:Windows: Windows 10 app, creates tons of cache files-->
<Image condition="is">C:\Windows\system32\wbem\WMIADAP.EXE</Image> <!-- Microsoft:Windows: WMI Performance updates-->
<TargetFilename condition="begin with">C:\Windows\System32\DriverStore\Temp\</TargetFilename> <!-- Microsoft:Windows: Temp files by DrvInst.exe-->
<TargetFilename condition="begin with">C:\Windows\System32\wbem\Performance\</TargetFilename> <!-- Microsoft:Windows: Created in wbem by WMIADAP.exe-->
<TargetFilename condition="end with">WRITABLE.TST</TargetFilename> <!-- Microsoft:Windows: Created in wbem by svchost-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<Image condition="is">C:\Windows\System32\smss.exe</Image> <!-- Microsoft:Windows: Session Manager SubSystem: Creates swapfile.sys,pagefile.sys,hiberfile.sys-->
<Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image> <!-- Microsoft:Windows: Windows 10 app, creates tons of cache files-->
<Image condition="is">C:\Windows\system32\wbem\WMIADAP.EXE</Image> <!-- Microsoft:Windows: WMI Performance updates-->
<TargetFilename condition="begin with">C:\Windows\System32\DriverStore\Temp\</TargetFilename> <!-- Microsoft:Windows: Temp files by DrvInst.exe-->
<TargetFilename condition="begin with">C:\Windows\System32\wbem\Performance\</TargetFilename> <!-- Microsoft:Windows: Created in wbem by WMIADAP.exe-->
<TargetFilename condition="end with">WRITABLE.TST</TargetFilename> <!-- Microsoft:Windows: Created in wbem by svchost-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_microsoft_windows_recent_files.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<TargetFilename condition="contains">\AppData\Roaming\Microsoft\Windows\Recent\</TargetFilename><!--Microsoft:Windows:RecentFiles-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<TargetFilename condition="contains">\AppData\Roaming\Microsoft\Windows\Recent\</TargetFilename> <!--Microsoft:Windows:RecentFiles-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_microsoft_windows_update.xml
+9 -9
View File
@@ -1,11 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Microsoft:Windows:Updates-->
<TargetFilename condition="begin with">C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\</TargetFilename> <!-- Microsoft:Windows: Feature updates containing lots of .exe and .sys-->
<Image condition="begin with">C:\WINDOWS\winsxs\amd64_microsoft-windows</Image> <!-- Microsoft:Windows: Windows update-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Microsoft:Windows:Updates-->
<TargetFilename condition="begin with">C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\</TargetFilename> <!-- Microsoft:Windows: Feature updates containing lots of .exe and .sys-->
<Image condition="begin with">C:\WINDOWS\winsxs\amd64_microsoft-windows</Image> <!-- Microsoft:Windows: Windows update-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_msdatp.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<Image condition="is">c:\Program Files\Microsoft Security Client\MsMpEng.exe</Image>
</FileCreate>
</RuleGroup>
</EventFiltering>
<Image condition="is">c:\Program Files\Microsoft Security Client\MsMpEng.exe</Image>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_outlook_profile.xml
+2 -2
View File
@@ -3,8 +3,8 @@
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<Rule groupRelation="and">
<Image condition="image">Outlook.exe</Image><!--Outlook will write on every close, external tampering is still important-->
<TargetFilename condition="contains">Roaming\Microsoft\Outlook\Outlook.xml</TargetFilename><!--https://labs.f-secure.com/archive/malicous-outlook-rules/-->
<Image condition="image">Outlook.exe</Image> <!--Outlook will write on every close, external tampering is still important-->
<TargetFilename condition="contains">Roaming\Microsoft\Outlook\Outlook.xml</TargetFilename> <!--https://labs.f-secure.com/archive/malicous-outlook-rules/-->
</Rule>
</FileCreate>
</RuleGroup>
11_file_create/exclude_provtool.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Microsoft:Windows-->
<Image condition="is">c:\windows\system32\provtool.exe</Image> <!-- Microsoft:Windows:Provisioning package runtime processing tool -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Microsoft:Windows-->
<Image condition="is">c:\windows\system32\provtool.exe</Image> <!-- Microsoft:Windows:Provisioning package runtime processing tool -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_sccm.xml
+7 -7
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<Image condition="is">C:\WINDOWS\CCM\CcmExec.exe</Image>
<TargetFilename condition="begin with">C:\Windows\CCM</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
<Image condition="is">C:\WINDOWS\CCM\CcmExec.exe</Image>
<TargetFilename condition="begin with">C:\Windows\CCM</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/exclude_scheduled_task_noise.xml
+11 -11
View File
@@ -1,13 +1,13 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Microsoft:Windows-->
<TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\PLA\FabricTraces</TargetFilename> <!-- Microsoft:Windows: -->
<TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</TargetFilename> <!-- Microsoft:Windows: -->
<TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector</TargetFilename> <!-- Microsoft:Windows: Customer Experience Improvement Program-->
<TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant</TargetFilename> <!-- Microsoft:Windows: Customer Experience Improvement Program-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<!--SECTION: Microsoft:Windows-->
<TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\PLA\FabricTraces</TargetFilename> <!-- Microsoft:Windows: -->
<TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</TargetFilename> <!-- Microsoft:Windows: -->
<TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector</TargetFilename> <!-- Microsoft:Windows: Customer Experience Improvement Program-->
<TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant</TargetFilename> <!-- Microsoft:Windows: Customer Experience Improvement Program-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_appc_shim.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">C:\Windows\AppPatch\Custom</TargetFilename>
<TargetFilename name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">C:\Windows\AppPatch\Custom</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_batch_files.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_chm_files.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1064,technique_name=Scripting" condition="end with">.chm</TargetFilename><!--Scripting, thanks to Darkoperator-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename name="technique_id=T1064,technique_name=Scripting" condition="end with">.chm</TargetFilename> <!--Scripting, thanks to Darkoperator-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_default_profile_changes.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="begin with">C:\Users\Default</TargetFilename> <!--Microsoft:Windows: Changes to default user profile-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="begin with">C:\Users\Default</TargetFilename> <!--Microsoft:Windows: Changes to default user profile-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_desktop.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="contains">Desktop</TargetFilename> <!--Files on the Desktop-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="contains">Desktop</TargetFilename> <!--Files on the Desktop-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_dotnet.xml
+14 -14
View File
@@ -1,16 +1,16 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="contains">AppData\Local\Microsoft\CLR_v2.0\UsageLogs\</TargetFilename><!--Dotnet v2 binary started-->
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\cscript.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\wscript.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\wmic.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\mshta.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\svchost.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\regsvr32.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\rundll32.exe.log</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="contains">AppData\Local\Microsoft\CLR_v2.0\UsageLogs\</TargetFilename> <!--Dotnet v2 binary started-->
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\cscript.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\wscript.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\wmic.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\mshta.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\svchost.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\regsvr32.exe.log</TargetFilename>
<TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\rundll32.exe.log</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_downloaded_files.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE--> <!--PRIVACY WARNING-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE--> <!--PRIVACY WARNING-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_drivers_added.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="begin with">C:\Windows\System32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="begin with">C:\Windows\System32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_executables.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_group_policy_changes.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\Machine\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
<TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\User\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\Machine\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
<TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\User\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_hta_scripts.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1218.005,technique_name=Mshta" condition="end with">.hta</TargetFilename><!--Scripting-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename name="technique_id=T1218.005,technique_name=Mshta" condition="end with">.hta</TargetFilename> <!--Scripting-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_iso.xml
+7 -7
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.iso</TargetFilename><!--often ignored by AV/EDR but opens like a zip file in windows-->
<TargetFilename condition="end with">.img</TargetFilename><!--often ignored by AV/EDR but opens like a zip file in windows-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="end with">.iso</TargetFilename> <!--often ignored by AV/EDR but opens like a zip file in windows-->
<TargetFilename condition="end with">.img</TargetFilename> <!--often ignored by AV/EDR but opens like a zip file in windows-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_kirbi.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.kirbi</TargetFilename><!--Mimikatz or kekeo default kerberos ticket file extention-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="end with">.kirbi</TargetFilename> <!--Mimikatz or kekeo default kerberos ticket file extention-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_links.xml
+7 -7
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1187,technique_name=Forced Authentication" condition="end with">.lnk</TargetFilename>
<TargetFilename name="technique_id=T1187,technique_name=Forced Authentication" condition="end with">.scf</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename name="technique_id=T1187,technique_name=Forced Authentication" condition="end with">.lnk</TargetFilename>
<TargetFilename name="technique_id=T1187,technique_name=Forced Authentication" condition="end with">.scf</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_microsoft_clickonce.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_microsoft_msbuild_scripts.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="end with">.*proj</TargetFilename><!--Microsoft:MSBuild:Script More information: https://twitter.com/subTee/status/885919612969394177-->
<TargetFilename name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script More information: https://twitter.com/subTee/status/885919612969394177-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="end with">.*proj</TargetFilename> <!--Microsoft:MSBuild:Script More information: https://twitter.com/subTee/status/885919612969394177-->
<TargetFilename name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="end with">.sln</TargetFilename> <!--Microsoft:MSBuild:Script More information: https://twitter.com/subTee/status/885919612969394177-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_microsoft_settingcontent-ms.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.settingcontent-ms</TargetFilename> <!--Microsoft:Windows:SettingContent-MS (https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39)-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="end with">.settingcontent-ms</TargetFilename> <!--Microsoft:Windows:SettingContent-MS (https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39)-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_ms_office_documents_with_macros.xml
+17 -17
View File
@@ -1,19 +1,19 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: With Macro-->
<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:PowerPoint: With Macro-->
<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Excel: With Macro-->
<TargetFilename condition="end with">.xlm</TargetFilename> <!--Microsoft:Office:Excel: Legacy Excel With Macro-->
<TargetFilename condition="end with">.dotm</TargetFilename> <!--Microsoft:Office:Word: Template With Macro-->
<TargetFilename condition="end with">.xltm</TargetFilename> <!--Microsoft:Office:Excel: Template With Macro-->
<TargetFilename condition="end with">.potm</TargetFilename> <!--Microsoft:Office:PowerPoint: Template With Macro-->
<TargetFilename condition="end with">.ppsm</TargetFilename> <!--Microsoft:Office:PowerPoint: Slideshow With Macro-->
<TargetFilename condition="end with">.sldm</TargetFilename> <!--Microsoft:Office:PowerPoint: Slide With Macro-->
<TargetFilename condition="end with">.xlam</TargetFilename> <!--Microsoft:Office:Excel: Add-in Possibly With Macro-->
<TargetFilename condition="end with">.xla</TargetFilename> <!--Microsoft:Office:Excel: Add-in Possibly With Macro-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: With Macro-->
<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:PowerPoint: With Macro-->
<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Excel: With Macro-->
<TargetFilename condition="end with">.xlm</TargetFilename> <!--Microsoft:Office:Excel: Legacy Excel With Macro-->
<TargetFilename condition="end with">.dotm</TargetFilename> <!--Microsoft:Office:Word: Template With Macro-->
<TargetFilename condition="end with">.xltm</TargetFilename> <!--Microsoft:Office:Excel: Template With Macro-->
<TargetFilename condition="end with">.potm</TargetFilename> <!--Microsoft:Office:PowerPoint: Template With Macro-->
<TargetFilename condition="end with">.ppsm</TargetFilename> <!--Microsoft:Office:PowerPoint: Slideshow With Macro-->
<TargetFilename condition="end with">.sldm</TargetFilename> <!--Microsoft:Office:PowerPoint: Slide With Macro-->
<TargetFilename condition="end with">.xlam</TargetFilename> <!--Microsoft:Office:Excel: Add-in Possibly With Macro-->
<TargetFilename condition="end with">.xla</TargetFilename> <!--Microsoft:Office:Excel: Add-in Possibly With Macro-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_ms_office_excel_iqy_slk.xml
+9 -9
View File
@@ -1,11 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<!--Info on how these are abused: https://www.vmray.com/cyber-security-blog/forgotten-ms-office-features-used-deliver-malware/-->
<TargetFilename condition="end with">.iqy</TargetFilename> <!--Microsoft:Office:Excel: IQY file used to pull down dropper-->
<TargetFilename condition="end with">.slk</TargetFilename> <!--Microsoft:Office:Excel: SLK file used for command execution-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<!--Info on how these are abused: https://www.vmray.com/cyber-security-blog/forgotten-ms-office-features-used-deliver-malware/-->
<TargetFilename condition="end with">.iqy</TargetFilename> <!--Microsoft:Office:Excel: IQY file used to pull down dropper-->
<TargetFilename condition="end with">.slk</TargetFilename> <!--Microsoft:Office:Excel: SLK file used for command execution-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_outlook_attachments.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments--> <!--PRIVACY WARNING-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments--> <!--PRIVACY WARNING-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_outlook_persistence.xml
+8 -8
View File
@@ -1,11 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="contains">Roaming\Microsoft\Outlook\VbaProject.OTM</TargetFilename> <!--https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/-->
<TargetFilename condition="end with">.rwz</TargetFilename>
<TargetFilename condition="contains">Roaming\Microsoft\Outlook\Outlook.xml</TargetFilename><!--https://labs.f-secure.com/archive/malicous-outlook-rules/ works in combination with exclude_outlook_profile.xml -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="contains">Roaming\Microsoft\Outlook\VbaProject.OTM</TargetFilename> <!--https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/-->
<TargetFilename condition="end with">.rwz</TargetFilename>
<TargetFilename condition="contains">Roaming\Microsoft\Outlook\Outlook.xml</TargetFilename> <!--https://labs.f-secure.com/archive/malicous-outlook-rules/ works in combination with exclude_outlook_profile.xml -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_overlooked_extensions.xml
+14 -14
View File
@@ -1,16 +1,16 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.rft</TargetFilename>
<TargetFilename condition="end with">.jsp</TargetFilename>
<TargetFilename condition="end with">.jspx</TargetFilename>
<TargetFilename condition="end with">.asp</TargetFilename>
<TargetFilename condition="end with">.aspx</TargetFilename>
<TargetFilename condition="end with">.php</TargetFilename>
<TargetFilename condition="end with">.war</TargetFilename>
<TargetFilename condition="end with">.ace</TargetFilename><!-- https://www.bleepingcomputer.com/news/security/over-100-exploits-found-for-19-year-old-winrar-rce-bug/ -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.rft</TargetFilename>
<TargetFilename condition="end with">.jsp</TargetFilename>
<TargetFilename condition="end with">.jspx</TargetFilename>
<TargetFilename condition="end with">.asp</TargetFilename>
<TargetFilename condition="end with">.aspx</TargetFilename>
<TargetFilename condition="end with">.php</TargetFilename>
<TargetFilename condition="end with">.war</TargetFilename>
<TargetFilename condition="end with">.ace</TargetFilename> <!-- https://www.bleepingcomputer.com/news/security/over-100-exploits-found-for-19-year-old-winrar-rce-bug/ -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_powershell_changes.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="begin with">C:\Windows\System32\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
<TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="begin with">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="begin with">C:\Windows\System32\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
<TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="begin with">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_powershell_scripts.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
<TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">.ps2</TargetFilename> <!--PowerShell -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
<TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">.ps2</TargetFilename> <!--PowerShell -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_python_scripts.xml
+8 -8
View File
@@ -1,11 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.py</TargetFilename> <!--Python [ More information: https://attack.mitre.org/wiki/Group/G0035 ] -->
<TargetFilename condition="end with">.pyc</TargetFilename> <!--Python compiled code -->
<TargetFilename condition="end with">.pyw</TargetFilename> <!--Python script to be ran with console suppressed -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="end with">.py</TargetFilename> <!--Python [ More information: https://attack.mitre.org/wiki/Group/G0035 ] -->
<TargetFilename condition="end with">.pyc</TargetFilename> <!--Python compiled code -->
<TargetFilename condition="end with">.pyw</TargetFilename> <!--Python script to be ran with console suppressed -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_rundll32.xml
+7 -7
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<Image condition="image">rundll32.exe</Image> <!-- Thanks to @c_APT-ure -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<Image condition="image">rundll32.exe</Image> <!-- Thanks to @c_APT-ure -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_scheduled_task_changes.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="begin with">C:\Windows\System32\Tasks</TargetFilename> <!--Mitre T1053--><!--Microsoft:ScheduledTasks-->
<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!--Mitre T1053--><!--Microsoft:ScheduledTasks-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="begin with">C:\Windows\System32\Tasks</TargetFilename> <!--Mitre T1053--> <!--Microsoft:ScheduledTasks-->
<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!--Mitre T1053--> <!--Microsoft:ScheduledTasks-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_start_menu_items.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="contains">\Start Menu</TargetFilename> <!--Microsoft:Windows: Startup links and shortcut modification-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="contains">\Start Menu</TargetFilename> <!--Microsoft:Windows: Startup links and shortcut modification-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_startup_items.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="contains">\Startup</TargetFilename> <!--Microsoft:Office: Changes to user's autoloaded files under AppData-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="contains">\Startup</TargetFilename> <!--Microsoft:Office: Changes to user's autoloaded files under AppData-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_system_driver_files.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_taskmanager_lsass.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="and">
<FileCreate onmatch="include">
<TargetFilename condition="contains">\*lsass*.dmp\</TargetFilename> <!-- Capture LSASS dump from task manager -->
<Image condition="image">taskmgr.exe</Image>
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="and">
<FileCreate onmatch="include">
<TargetFilename condition="contains">\*lsass*.dmp\</TargetFilename> <!-- Capture LSASS dump from task manager -->
<Image condition="image">taskmgr.exe</Image>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_url.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.url</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename condition="end with">.url</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_visual_basic_scripts.xml
+9 -9
View File
@@ -1,11 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting files-->
<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting files-->
</FileCreate>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting files-->
<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting files-->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_wmi_changes.xml
+8 -8
View File
@@ -1,11 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\Windows\System32\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
<TargetFilename name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\Windows\SysWOW64\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
<Image name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\WINDOWS\system32\wbem\scrcons.exe</Image> <!-- https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ -->
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\Windows\System32\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
<TargetFilename name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\Windows\SysWOW64\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
<Image name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\WINDOWS\system32\wbem\scrcons.exe</Image> <!-- https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ -->
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
11_file_create/include_writable_folders.xml
+11 -11
View File
@@ -1,14 +1,14 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename name="technique_id=T1546.008,technique_name=Services File Permissions Weakness" condition="begin with">C:\Windows\Temp\</TargetFilename>
<TargetFilename name="technique_id=T1546.008,technique_name=Services File Permissions Weakness" condition="begin with">C:\Program\</TargetFilename>
<TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\Temp\</TargetFilename>
<TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\PerfLogs\</TargetFilename>
<TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\Users\Public\</TargetFilename>
<TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="contains">\AppData\Temp\</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
<TargetFilename name="technique_id=T1546.008,technique_name=Services File Permissions Weakness" condition="begin with">C:\Windows\Temp\</TargetFilename>
<TargetFilename name="technique_id=T1546.008,technique_name=Services File Permissions Weakness" condition="begin with">C:\Program\</TargetFilename>
<TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\Temp\</TargetFilename>
<TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\PerfLogs\</TargetFilename>
<TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\Users\Public\</TargetFilename>
<TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="contains">\AppData\Temp\</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_cisco_anyconnect.xml
+10 -10
View File
@@ -1,12 +1,12 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--Cisco:Anyconnect ISE Posture module-->
<Image condition="is">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\aciseposture.exe</Image>
<!--Cisco:Anyconnect VPN Agent-->
<Image condition="is">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe</Image>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--Cisco:Anyconnect ISE Posture module-->
<Image condition="is">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\aciseposture.exe</Image>
<!--Cisco:Anyconnect VPN Agent-->
<Image condition="is">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe</Image>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_internet_explorer_settings.xml
+12 -12
View File
@@ -1,14 +1,14 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--SECTION: InternetExplorer-->
<TargetObject condition="end with">Toolbar\WebBrowser</TargetObject> <!--Microsoft:IE: Extraneous activity-->
<TargetObject condition="end with">Toolbar\WebBrowser\ITBar7Height</TargetObject> <!--Microsoft:IE: Extraneous activity-->
<TargetObject condition="end with">Toolbar\ShellBrowser\ITBar7Layout</TargetObject> <!--Microsoft:Windows:Explorer: Extraneous activity-->
<TargetObject condition="end with">Internet Explorer\Toolbar\Locked</TargetObject> <!--Microsoft:Windows:Explorer: Extraneous activity-->
<TargetObject condition="end with">ShellBrowser</TargetObject> <!--Microsoft:InternetExplorer: Noise-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--SECTION: InternetExplorer-->
<TargetObject condition="end with">Toolbar\WebBrowser</TargetObject> <!--Microsoft:IE: Extraneous activity-->
<TargetObject condition="end with">Toolbar\WebBrowser\ITBar7Height</TargetObject> <!--Microsoft:IE: Extraneous activity-->
<TargetObject condition="end with">Toolbar\ShellBrowser\ITBar7Layout</TargetObject> <!--Microsoft:Windows:Explorer: Extraneous activity-->
<TargetObject condition="end with">Internet Explorer\Toolbar\Locked</TargetObject> <!--Microsoft:Windows:Explorer: Extraneous activity-->
<TargetObject condition="end with">ShellBrowser</TargetObject> <!--Microsoft:InternetExplorer: Noise-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_ivanti.xml
+7 -7
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<Image condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
<Image condition="is">C:\Program Files\RES Software\Workspace Manager\pfwsmgr.exe</Image>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<Image condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
<Image condition="is">C:\Program Files\RES Software\Workspace Manager\pfwsmgr.exe</Image>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_mcafee_endpoint.xml
+28 -28
View File
@@ -1,30 +1,30 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--McAfee:Endpoint Encryption Agent-->
<Image condition="is">C:\Program Files\McAfee\Endpoint Encryption Agent\MfeEpeHost.exe</Image>
<!--McAfee:Endpoint Security Adaptive Threat Protection-->
<Image condition="is">C:\Program Files\McAfee\Endpoint Security\Adaptive Threat Protection\mfeatp.exe</Image>
<!--McAfee:Endpoint Security Platform-->
<Image condition="is">C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe</Image>
<!--McAfee:AMCore Updater-->
<Image condition="is">C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe</Image>
<!--McAfee:Agent-->
<Image condition="is">C:\Program Files\McAfee\Agent\masvc.exe</Image>
<!--McAfee:Agent-->
<Image condition="is">C:\Program Files\McAfee\Agent\x86\mfemactl.exe</Image>
<!--McAfee:Agent-->
<Image condition="is">C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe</Image>
<!--McAfee:Agent Compatibility Service-->
<Image condition="is">C:\Program Files\McAfee\Agent\x86\macompatsvc.exe</Image>
<!--McAfee:Endpoint Security Threat Prevention-->
<Image condition="is">C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe</Image>
<!--McAfee:Scan Engine-->
<Image condition="begin with">C:\Program Files\Common Files\McAfee\Engine\scanners</Image>
<!--McAfee:MCShield-->
<Image condition="is">C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe</Image>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--McAfee:Endpoint Encryption Agent-->
<Image condition="is">C:\Program Files\McAfee\Endpoint Encryption Agent\MfeEpeHost.exe</Image>
<!--McAfee:Endpoint Security Adaptive Threat Protection-->
<Image condition="is">C:\Program Files\McAfee\Endpoint Security\Adaptive Threat Protection\mfeatp.exe</Image>
<!--McAfee:Endpoint Security Platform-->
<Image condition="is">C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe</Image>
<!--McAfee:AMCore Updater-->
<Image condition="is">C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe</Image>
<!--McAfee:Agent-->
<Image condition="is">C:\Program Files\McAfee\Agent\masvc.exe</Image>
<!--McAfee:Agent-->
<Image condition="is">C:\Program Files\McAfee\Agent\x86\mfemactl.exe</Image>
<!--McAfee:Agent-->
<Image condition="is">C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe</Image>
<!--McAfee:Agent Compatibility Service-->
<Image condition="is">C:\Program Files\McAfee\Agent\x86\macompatsvc.exe</Image>
<!--McAfee:Endpoint Security Threat Prevention-->
<Image condition="is">C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe</Image>
<!--McAfee:Scan Engine-->
<Image condition="begin with">C:\Program Files\Common Files\McAfee\Engine\scanners</Image>
<!--McAfee:MCShield-->
<Image condition="is">C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe</Image>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_webroot.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--Webroot-->
<Image condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</Image> <!--Webroot-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--Webroot-->
<Image condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</Image> <!--Webroot-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_widcomm_bt_driver.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--WIDCOMM:Bluetooth-->
<Image condition="is">C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe</Image> <!--Constantly writes to HKLM-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--WIDCOMM:Bluetooth-->
<Image condition="is">C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe</Image> <!--Constantly writes to HKLM-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_windows_bootup_control.xml
+13 -13
View File
@@ -1,15 +1,15 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--Windows:Bootup Control-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--Windows:Bootup Control-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
<TargetObject condition="end with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_windows_file_exts.xml
+13 -13
View File
@@ -1,15 +1,15 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<TargetObject condition="contains">\OpenWithProgids</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
<TargetObject condition="end with">\OpenWithList</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
<TargetObject condition="end with">\UserChoice</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
<TargetObject condition="end with">\UserChoice\ProgId</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
<TargetObject condition="end with">\UserChoice\Hash</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
<TargetObject condition="end with">\OpenWithList\MRUList</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
<TargetObject condition="end with">} 0xFFFF</TargetObject> <!--Microsoft:Windows: Remove noise from explorer.exe from monitoring ShellCached binary keys--> <!--Win8+-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<TargetObject condition="contains">\OpenWithProgids</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
<TargetObject condition="end with">\OpenWithList</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
<TargetObject condition="end with">\UserChoice</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
<TargetObject condition="end with">\UserChoice\ProgId</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
<TargetObject condition="end with">\UserChoice\Hash</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
<TargetObject condition="end with">\OpenWithList\MRUList</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
<TargetObject condition="end with">} 0xFFFF</TargetObject> <!--Microsoft:Windows: Remove noise from explorer.exe from monitoring ShellCached binary keys--> <!--Win8+-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_windows_generic_binaries.xml
+12 -12
View File
@@ -1,14 +1,14 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<Image condition="end with">Office\root\integration\integrator.exe</Image> <!--Microsoft:Office: C2R client-->
<Image condition="image">C:\WINDOWS\system32\backgroundTaskHost.exe</Image> <!--Microsoft:Windows: Changes association registry keys-->
<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</Image> <!--Microsoft:Office: C2R client-->
<Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image> <!--Microsoft:Windows:Defender-->
<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Cortana-->
<Image condition="is">C:\Program Files\Microsoft Application Virtualization\Client\AppVClient.exe</Image>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<Image condition="end with">Office\root\integration\integrator.exe</Image> <!--Microsoft:Office: C2R client-->
<Image condition="image">C:\WINDOWS\system32\backgroundTaskHost.exe</Image> <!--Microsoft:Windows: Changes association registry keys-->
<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</Image> <!--Microsoft:Office: C2R client-->
<Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image> <!--Microsoft:Windows:Defender-->
<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Cortana-->
<Image condition="is">C:\Program Files\Microsoft Application Virtualization\Client\AppVClient.exe</Image>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_windows_misc.xml
+29 -29
View File
@@ -1,31 +1,31 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--SECTION: Windows:Misc-->
<TargetObject condition="end with">\CurrentVersion\App Paths</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\App Paths" wildcard-->
<TargetObject condition="end with">\CurrentVersion\Image File Execution Options</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\Image File Execution Options" wildcard-->
<TargetObject condition="end with">\CurrentVersion\Shell Extensions\Cached</TargetObject> <!--Microsoft:Windows: Remove noise from the "\CurrentVersion\Shell Extensions\Cached" wildcard-->
<TargetObject condition="end with">\CurrentVersion\Shell Extensions\Approved</TargetObject> <!--Microsoft:Windows: Remove noise from the "\CurrentVersion\Shell Extensions\Approved" wildcard-->
<TargetObject condition="end with">}\PreviousPolicyAreas</TargetObject> <!--Microsoft:Windows: Remove noise from \Winlogon\GPExtensions by svchost.exe-->
<TargetObject condition="contains">\Control\WMI\Autologger\</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\Lsa\OfflineJoin\CurrentValue</TargetObject> <!--Microsoft:Windows: Sensitive value during domain join-->
<TargetObject condition="end with">\Components\TrustedInstaller\Events</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
<TargetObject condition="end with">\Components\TrustedInstaller</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
<TargetObject condition="end with">\Components\Wlansvc</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
<TargetObject condition="end with">\Components\Wlansvc\Events</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\</TargetObject> <!--Microsoft:Windows: Remove noise monitoring installations run as system-->
<TargetObject condition="end with">\Directory\shellex</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
<TargetObject condition="end with">\Directory\shellex\DragDropHandlers</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
<TargetObject condition="end with">\Drive\shellex</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
<TargetObject condition="end with">\Drive\shellex\DragDropHandlers</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
<TargetObject condition="contains">_Classes\AppX</TargetObject> <!--Microsoft:Windows: Remove noise monitoring "Shell\open\command"--> <!--Win8+-->
<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\</TargetObject> <!--Microsoft:Windows: SvcHost Noise-->
<TargetObject condition="is">HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Windows: Remove noise from Windows 10 Cortana | Credit @ion-storm--> <!--Win10-->
<Image condition="begin with">C:\$WINDOWS.~BT\</Image> <!--Microsoft:Windows: Update/Upgrade noise -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--SECTION: Windows:Misc-->
<TargetObject condition="end with">\CurrentVersion\App Paths</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\App Paths" wildcard-->
<TargetObject condition="end with">\CurrentVersion\Image File Execution Options</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\Image File Execution Options" wildcard-->
<TargetObject condition="end with">\CurrentVersion\Shell Extensions\Cached</TargetObject> <!--Microsoft:Windows: Remove noise from the "\CurrentVersion\Shell Extensions\Cached" wildcard-->
<TargetObject condition="end with">\CurrentVersion\Shell Extensions\Approved</TargetObject> <!--Microsoft:Windows: Remove noise from the "\CurrentVersion\Shell Extensions\Approved" wildcard-->
<TargetObject condition="end with">}\PreviousPolicyAreas</TargetObject> <!--Microsoft:Windows: Remove noise from \Winlogon\GPExtensions by svchost.exe-->
<TargetObject condition="contains">\Control\WMI\Autologger\</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\Lsa\OfflineJoin\CurrentValue</TargetObject> <!--Microsoft:Windows: Sensitive value during domain join-->
<TargetObject condition="end with">\Components\TrustedInstaller\Events</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
<TargetObject condition="end with">\Components\TrustedInstaller</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
<TargetObject condition="end with">\Components\Wlansvc</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
<TargetObject condition="end with">\Components\Wlansvc\Events</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\</TargetObject> <!--Microsoft:Windows: Remove noise monitoring installations run as system-->
<TargetObject condition="end with">\Directory\shellex</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
<TargetObject condition="end with">\Directory\shellex\DragDropHandlers</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
<TargetObject condition="end with">\Drive\shellex</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
<TargetObject condition="end with">\Drive\shellex\DragDropHandlers</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
<TargetObject condition="contains">_Classes\AppX</TargetObject> <!--Microsoft:Windows: Remove noise monitoring "Shell\open\command"--> <!--Win8+-->
<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\</TargetObject> <!--Microsoft:Windows: SvcHost Noise-->
<TargetObject condition="is">HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Windows: Remove noise from Windows 10 Cortana | Credit @ion-storm--> <!--Win10-->
<Image condition="begin with">C:\$WINDOWS.~BT\</Image> <!--Microsoft:Windows: Update/Upgrade noise -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/exclude_windows_service_autostart.xml
+16 -16
View File
@@ -1,18 +1,18 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--Sevices autostart-->
<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
<TargetObject condition="end with">\services\DeviceAssociationService\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\services\BITS\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\services\TrustedInstaller\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\services\tunnel\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\services\UsoSvc\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="exclude">
<!--Sevices autostart-->
<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
<TargetObject condition="end with">\services\DeviceAssociationService\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\services\BITS\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\services\TrustedInstaller\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\services\tunnel\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
<TargetObject condition="end with">\services\UsoSvc\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_accessibility_features.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1015,technique_name=Accessibility Features" condition="is">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
<TargetObject name="technique_id=T1015,technique_name=Accessibility Features" condition="is">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_appc_shim.xml
+6 -6
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB</TargetObject>
<TargetObject name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom</TargetObject>
<TargetObject name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB</TargetObject>
<TargetObject name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_authentication_package.xml
+6 -6
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1547.002,technique_name=Authentication Package" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication</TargetObject>
<TargetObject name="technique_id=T1547.002,technique_name=Authentication Package" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL</TargetObject><!--When set, forces and dll loaded by lsass to be MS signed, monitor for change-->
<TargetObject name="technique_id=T1547.002,technique_name=Authentication Package" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication</TargetObject>
<TargetObject name="technique_id=T1547.002,technique_name=Authentication Package" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL</TargetObject> <!--When set, forces and dll loaded by lsass to be MS signed, monitor for change-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_autoruns_and_startup_keys.xml
+23 -23
View File
@@ -1,28 +1,28 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<!--ADDITIONAL REFERENCE: [ http://www.ghacks.net/2016/06/04/windows-automatic-startup-locations/ ] -->
<!--ADDITIONAL REFERENCE: [ https://view.officeapps.live.com/op/view.aspx?src=https://arsenalrecon.com/downloads/resources/Registry_Keys_Related_to_Autorun.ods ] -->
<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
<TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">\CurrentVersion\Run</TargetObject><!--Microsoft:Windows: Run keys, incld RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
<TargetObject condition="contains">\Group Policy\Scripts</TargetObject> <!--Microsoft:Windows: Group policy scripts-->
<TargetObject name="technique_id=T1037,technique_name=Boot or Logon Initialization Scripts" condition="contains">\Windows\System\Scripts</TargetObject> <!--Microsoft:Windows: Logon, Loggoff, Shutdown-->
<TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">\Policies\Explorer\Run</TargetObject><!--Microsoft:Windows -->
<TargetObject condition="end with">\ServiceDll</TargetObject> <!--Microsoft:Windows: Points to a service's DLL [ https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services ] -->
<TargetObject condition="end with">\ImagePath</TargetObject> <!--Microsoft:Windows: Points to a service's EXE [ https://github.com/crypsisgroup/Splunkmon/blob/master/sysmon.cfg ] -->
<TargetObject condition="end with">\Start</TargetObject> <!--Microsoft:Windows: Services start mode changes (Disabled, Automatically, Manual)-->
<TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify</TargetObject><!--Microsoft:Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
<TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</TargetObject> <!--Microsoft:Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
<TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</TargetObject>
<TargetObject condition="begin with">HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject> <!--Microsoft:Windows: Legacy driver loading | Credit @ion-storm -->
<TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject> <!--Microsoft:Windows: Autorun | Credit @ion-storm | [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
<TargetObject name="technique_id=T1546.001,technique_name=Change Default File Association" condition="contains">\Explorer\FileExts</TargetObject><!--Microsoft:Windows: Changes to file extension mapping-->
<TargetObject condition="contains">\shell\install\command</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
<TargetObject condition="contains">\shell\open\command</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
<TargetObject condition="contains">\shell\open\ddeexec</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
<TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">\CurrentVersion\Run</TargetObject> <!--Microsoft:Windows: Run keys, incld RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
<TargetObject condition="contains">\Group Policy\Scripts</TargetObject> <!--Microsoft:Windows: Group policy scripts-->
<TargetObject name="technique_id=T1037,technique_name=Boot or Logon Initialization Scripts" condition="contains">\Windows\System\Scripts</TargetObject> <!--Microsoft:Windows: Logon, Loggoff, Shutdown-->
<TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">\Policies\Explorer\Run</TargetObject> <!--Microsoft:Windows -->
<TargetObject condition="end with">\ServiceDll</TargetObject> <!--Microsoft:Windows: Points to a service's DLL [ https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services ] -->
<TargetObject condition="end with">\ImagePath</TargetObject> <!--Microsoft:Windows: Points to a service's EXE [ https://github.com/crypsisgroup/Splunkmon/blob/master/sysmon.cfg ] -->
<TargetObject condition="end with">\Start</TargetObject> <!--Microsoft:Windows: Services start mode changes (Disabled, Automatically, Manual)-->
<TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify</TargetObject> <!--Microsoft:Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
<TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</TargetObject> <!--Microsoft:Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
<TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</TargetObject>
<TargetObject condition="begin with">HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject> <!--Microsoft:Windows: Legacy driver loading | Credit @ion-storm -->
<TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject> <!--Microsoft:Windows: Autorun | Credit @ion-storm | [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
<TargetObject name="technique_id=T1546.001,technique_name=Change Default File Association" condition="contains">\Explorer\FileExts</TargetObject> <!--Microsoft:Windows: Changes to file extension mapping-->
<TargetObject condition="contains">\shell\install\command</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
<TargetObject condition="contains">\shell\open\command</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
<TargetObject condition="contains">\shell\open\ddeexec</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
<TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_bypass_uac.xml
+7 -7
View File
@@ -1,11 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">\mscfile\shell\open\command</TargetObject>
<TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">ms-settings\shell\open\command</TargetObject>
<TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">Classes\exefile\shell\runas\command\isolatedCommand</TargetObject> <!-- Credit cyb3rop -->
<TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">\mscfile\shell\open\command</TargetObject>
<TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">ms-settings\shell\open\command</TargetObject>
<TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">Classes\exefile\shell\runas\command\isolatedCommand</TargetObject> <!-- Credit cyb3rop -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_com_hijack.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1546.015,technique_name=Component Object Model Hijacking" condition="contains">Software\Classes\CLSID</TargetObject><!--Appears in HKLM and HKCU-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<TargetObject name="technique_id=T1546.015,technique_name=Component Object Model Hijacking" condition="contains">Software\Classes\CLSID</TargetObject> <!--Appears in HKLM and HKCU-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_disable_password_change.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1098,technique_name=Account Manipulation" condition="contains">\services\Netlogon\Parameters\DisablePasswordChange</TargetObject>
<TargetObject name="technique_id=T1098,technique_name=Account Manipulation" condition="contains">\services\Netlogon\Parameters\DisablePasswordChange</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_dll_injection_at_process_launch.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject><!--Microsoft:Windows: [ https://msdn.microsoft.com/en-us/library/windows/desktop/dd744762(v=vs.85).aspx ] -->
<TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="begin with">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject><!--Microsoft:Windows: [ https://msdn.microsoft.com/en-us/library/windows/desktop/dn280412(v=vs.85).aspx ] -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject> <!--Microsoft:Windows: [ https://msdn.microsoft.com/en-us/library/windows/desktop/dd744762(v=vs.85).aspx ] -->
<TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="begin with">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject> <!--Microsoft:Windows: [ https://msdn.microsoft.com/en-us/library/windows/desktop/dn280412(v=vs.85).aspx ] -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_dns_serverdll_injection.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="is">REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DNS\Parameters\ServerLevelPluginDll</TargetObject>
<TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="is">REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DNS\Parameters\ServerLevelPluginDll</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_dotnet_ETW_tampering.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1562.006,technique_name=Impair Defenses - Indicator Blocking" condition="end with">SOFTWARE\Microsoft\.NETFramework\ETWEnabled</TargetObject> <!-- @Cyb3rWard0g and https://twitter.com/_xpn_/status/1268712093928378368-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<TargetObject name="technique_id=T1562.006,technique_name=Impair Defenses - Indicator Blocking" condition="end with">SOFTWARE\Microsoft\.NETFramework\ETWEnabled</TargetObject> <!-- @Cyb3rWard0g and https://twitter.com/_xpn_/status/1268712093928378368-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_eventlog.xml
+7 -7
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1562.002,technique_name=Disable Windows Event Logging" condition="contains all">REGISTRY\MACHINE\SYSTEM\ControlSet001\Service\EventLog;Retention</TargetObject>
<TargetObject name="technique_id=T1562.002,technique_name=Disable Windows Event Logging" condition="contains all">REGISTRY\MACHINE\SYSTEM\ControlSet001\Service\EventLog;MaxSize</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<TargetObject name="technique_id=T1562.002,technique_name=Disable Windows Event Logging" condition="contains all">REGISTRY\MACHINE\SYSTEM\ControlSet001\Service\EventLog;Retention</TargetObject>
<TargetObject name="technique_id=T1562.002,technique_name=Disable Windows Event Logging" condition="contains all">REGISTRY\MACHINE\SYSTEM\ControlSet001\Service\EventLog;MaxSize</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_group_policy_integrity.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<!--Group Policy integrity-->
<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions</TargetObject> <!--Microsoft:Windows: Group Policy internally uses a plugin architecture that nothing should be modifying-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<!--Group Policy integrity-->
<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions</TargetObject> <!--Microsoft:Windows: Group Policy internally uses a plugin architecture that nothing should be modifying-->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_image_file_exec_options.xml
+6 -6
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1546.012,technique_name=Image File Execution Options Injection" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
<TargetObject name="technique_id=T1546.012,technique_name=Image File Execution Options Injection" condition="begin with">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<TargetObject name="technique_id=T1546.012,technique_name=Image File Execution Options Injection" condition="begin with">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_internet_explorer_extentions_helpers_or_toolbars.xml
+9 -9
View File
@@ -1,11 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject condition="contains">\Internet Explorer\Toolbar</TargetObject> <!--Microsoft:InternetExplorer: Machine and user-->
<TargetObject condition="contains">\Internet Explorer\Extensions</TargetObject> <!--Microsoft:InternetExplorer: Machine and user-->
<TargetObject condition="contains">\Browser Helper Objects</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ https://msdn.microsoft.com/en-us/library/bb250436(v=vs.85).aspx ] -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject condition="contains">\Internet Explorer\Toolbar</TargetObject> <!--Microsoft:InternetExplorer: Machine and user-->
<TargetObject condition="contains">\Internet Explorer\Extensions</TargetObject> <!--Microsoft:InternetExplorer: Machine and user-->
<TargetObject condition="contains">\Browser Helper Objects</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ https://msdn.microsoft.com/en-us/library/bb250436(v=vs.85).aspx ] -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_local_port_monitor.xml
+5 -5
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=Port Monitors,technique_name=Port Monitors" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</TargetObject>
<TargetObject name="technique_id=Port Monitors,technique_name=Port Monitors" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_netsh.xml
+6 -6
View File
@@ -1,9 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<TargetObject name="technique_id=T1546.007,technique_name=Netsh Helper DLL" condition="contains">SOFTWARE\Microsoft\Netsh</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<TargetObject name="technique_id=T1546.007,technique_name=Netsh Helper DLL" condition="contains">SOFTWARE\Microsoft\Netsh</TargetObject>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
12_13_14_registry_event/include_office_clickonce.xml
+8 -8
View File
@@ -1,10 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<!--Microsoft:Office:ClickOnce-->
<TargetObject condition="end with">\UrlUpdateInfo</TargetObject> <!--Microsoft:Office:ClickOnce: [ https://subt0x10.blogspot.com/2016/12/mimikatz-delivery-via-clickonce-with.html ] -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<RegistryEvent onmatch="include">
<!--Microsoft:Office:ClickOnce-->
<TargetObject condition="end with">\UrlUpdateInfo</TargetObject> <!--Microsoft:Office:ClickOnce: [ https://subt0x10.blogspot.com/2016/12/mimikatz-delivery-via-clickonce-with.html ] -->
</RegistryEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>

Some files were not shown because too many files have changed in this diff Show More