diff --git a/10_process_access/exclude_carbon_black_response.xml b/10_process_access/exclude_carbon_black_response.xml index 28d64b4..7e85c9e 100644 --- a/10_process_access/exclude_carbon_black_response.xml +++ b/10_process_access/exclude_carbon_black_response.xml @@ -1,9 +1,9 @@ - - - C:\Windows\CarbonBlack\cb.exe - - - + + + C:\Windows\CarbonBlack\cb.exe + + + diff --git a/10_process_access/exclude_cisco_amp.xml b/10_process_access/exclude_cisco_amp.xml index 3494c32..d1e72b0 100644 --- a/10_process_access/exclude_cisco_amp.xml +++ b/10_process_access/exclude_cisco_amp.xml @@ -1,9 +1,9 @@ - - - - C:\Program Files\Cisco\AMP\;sfc.exe - - - + + + + C:\Program Files\Cisco\AMP\;sfc.exe + + + diff --git a/10_process_access/exclude_couchbase_sigar.xml b/10_process_access/exclude_couchbase_sigar.xml index 0177dad..1f5dfbd 100644 --- a/10_process_access/exclude_couchbase_sigar.xml +++ b/10_process_access/exclude_couchbase_sigar.xml @@ -1,9 +1,9 @@ - - - c:\Program Files\Couchbase\Server\bin\sigar_port.exe - - - + + + c:\Program Files\Couchbase\Server\bin\sigar_port.exe + + + diff --git a/10_process_access/exclude_ivanti.xml b/10_process_access/exclude_ivanti.xml index 8de47b2..f3ceb3c 100644 --- a/10_process_access/exclude_ivanti.xml +++ b/10_process_access/exclude_ivanti.xml @@ -1,12 +1,12 @@ - - + + - C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe - C:\Program Files (x86)\RES Software\Workspace Manager\cpushld.exe - C:\Program Files\Ivanti\Workspace Control\cpushld.exe - C:\Program Files\RES Software\Workspace Manager\cpushld.exe + C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe + C:\Program Files (x86)\RES Software\Workspace Manager\cpushld.exe + C:\Program Files\Ivanti\Workspace Control\cpushld.exe + C:\Program Files\RES Software\Workspace Manager\cpushld.exe - - + + diff --git a/10_process_access/exclude_lsass_noise.xml b/10_process_access/exclude_lsass_noise.xml index 34b7c3e..2267335 100644 --- a/10_process_access/exclude_lsass_noise.xml +++ b/10_process_access/exclude_lsass_noise.xml @@ -1,22 +1,22 @@ - - - - wmiprvse.exe - GoogleUpdate.exe - LTSVC.exe - taskmgr.exe - VBoxService.exe - vmtoolsd.exe - \Citrix\System32\wfshell.exe - C:\Windows\System32\lsm.exe - Microsoft.Identity.AadConnect.Health.AadSync.Host.exe - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection - 0x1000 - 0x1400 - 0x101400 - 0x101000 - - - + + + + wmiprvse.exe + GoogleUpdate.exe + LTSVC.exe + taskmgr.exe + VBoxService.exe + vmtoolsd.exe + \Citrix\System32\wfshell.exe + C:\Windows\System32\lsm.exe + Microsoft.Identity.AadConnect.Health.AadSync.Host.exe + C:\Program Files (x86)\Symantec\Symantec Endpoint Protection + 0x1000 + 0x1400 + 0x101400 + 0x101000 + + + \ No newline at end of file diff --git a/10_process_access/exclude_mcafee_endpoint.xml b/10_process_access/exclude_mcafee_endpoint.xml index 8defcb1..928d4f2 100644 --- a/10_process_access/exclude_mcafee_endpoint.xml +++ b/10_process_access/exclude_mcafee_endpoint.xml @@ -1,10 +1,10 @@ - - - C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe - C:\Program Files\McAfee\Agent\x86\macompatsvc.exe - - - + + + C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe + C:\Program Files\McAfee\Agent\x86\macompatsvc.exe + + + diff --git a/10_process_access/exclude_microsoft_windows_defender.xml b/10_process_access/exclude_microsoft_windows_defender.xml index 36e386c..a3ecbfb 100644 --- a/10_process_access/exclude_microsoft_windows_defender.xml +++ b/10_process_access/exclude_microsoft_windows_defender.xml @@ -1,10 +1,10 @@ - - + + - C:\Program Files\Microsoft Security Client\MsMpEng.exe - C:\Program Files\Windows Defender\MsMpEng.exe + C:\Program Files\Microsoft Security Client\MsMpEng.exe + C:\Program Files\Windows Defender\MsMpEng.exe - - + + diff --git a/10_process_access/exclude_mobaxterm.xml b/10_process_access/exclude_mobaxterm.xml index 02c1569..4fd4a5a 100644 --- a/10_process_access/exclude_mobaxterm.xml +++ b/10_process_access/exclude_mobaxterm.xml @@ -1,9 +1,9 @@ - - - C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe - - - + + + C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe + + + diff --git a/10_process_access/exclude_palo_alto_cortex_xdr.xml b/10_process_access/exclude_palo_alto_cortex_xdr.xml index dd94f72..69da1d2 100644 --- a/10_process_access/exclude_palo_alto_cortex_xdr.xml +++ b/10_process_access/exclude_palo_alto_cortex_xdr.xml @@ -1,9 +1,9 @@ - - - - C:\Program Files\Palo Alto Networks\Traps\cyserver.exe - - - + + + + C:\Program Files\Palo Alto Networks\Traps\cyserver.exe + + + diff --git a/10_process_access/exclude_razr_sdk.xml b/10_process_access/exclude_razr_sdk.xml index 15b17da..feedb8c 100644 --- a/10_process_access/exclude_razr_sdk.xml +++ b/10_process_access/exclude_razr_sdk.xml @@ -1,9 +1,9 @@ - - - C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe - - - + + + C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe + + + diff --git a/10_process_access/exclude_sccm.xml b/10_process_access/exclude_sccm.xml index 6583289..962dbc1 100644 --- a/10_process_access/exclude_sccm.xml +++ b/10_process_access/exclude_sccm.xml @@ -1,9 +1,9 @@ - - - C:\WINDOWS\CCM\CcmExec.exe - - - + + + C:\WINDOWS\CCM\CcmExec.exe + + + diff --git a/10_process_access/exclude_splunk.xml b/10_process_access/exclude_splunk.xml index d08614f..495461b 100644 --- a/10_process_access/exclude_splunk.xml +++ b/10_process_access/exclude_splunk.xml @@ -1,9 +1,9 @@ - - + + - C:\Program Files\Splunk\bin\splunkd.exe + C:\Program Files\Splunk\bin\splunkd.exe - - + + \ No newline at end of file diff --git a/10_process_access/exclude_vmware_player.xml b/10_process_access/exclude_vmware_player.xml index a114858..d192dbf 100644 --- a/10_process_access/exclude_vmware_player.xml +++ b/10_process_access/exclude_vmware_player.xml @@ -1,9 +1,9 @@ - - + + - C:\Program Files (x86)\VMware\VMWare Player\vmware-authd.exe + C:\Program Files (x86)\VMware\VMWare Player\vmware-authd.exe - - + + diff --git a/10_process_access/exclude_vmware_workstation.xml b/10_process_access/exclude_vmware_workstation.xml index 6b7221d..b8eca3f 100644 --- a/10_process_access/exclude_vmware_workstation.xml +++ b/10_process_access/exclude_vmware_workstation.xml @@ -1,9 +1,9 @@ - - + + - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe + C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe - - + + diff --git a/10_process_access/exclude_winzip.xml b/10_process_access/exclude_winzip.xml index 27c5aec..a84d319 100644 --- a/10_process_access/exclude_winzip.xml +++ b/10_process_access/exclude_winzip.xml @@ -1,9 +1,9 @@ - - - C:\Program Files\WinZip\FAHWindow64.exe - - - + + + C:\Program Files\WinZip\FAHWindow64.exe + + + diff --git a/10_process_access/include_debugging.xml b/10_process_access/include_debugging.xml index 001593e..b0a09c9 100644 --- a/10_process_access/include_debugging.xml +++ b/10_process_access/include_debugging.xml @@ -1,10 +1,10 @@ - - + + - dbghelp.dll - dbgcore.dll + dbghelp.dll + dbgcore.dll - - + + diff --git a/10_process_access/include_desktop.xml b/10_process_access/include_desktop.xml index 2a4b2da..105cc1d 100644 --- a/10_process_access/include_desktop.xml +++ b/10_process_access/include_desktop.xml @@ -1,9 +1,9 @@ - - + + - Desktop - - - + Desktop + + + \ No newline at end of file diff --git a/10_process_access/include_dumphashes.xml b/10_process_access/include_dumphashes.xml index 0bb3350..4126d4b 100644 --- a/10_process_access/include_dumphashes.xml +++ b/10_process_access/include_dumphashes.xml @@ -1,24 +1,24 @@ - - - - C:\Windows\system32\csrss.exe - 0x1F1FFF - - - C:\Windows\system32\wininit.exe - 0x1F1FFF - - - C:\Windows\system32\winlogon.exe - 0x1F1FFF - - - C:\Windows\system32\services.exe - 0x1F1FFF - - - - + + + + C:\Windows\system32\csrss.exe + 0x1F1FFF + + + C:\Windows\system32\wininit.exe + 0x1F1FFF + + + C:\Windows\system32\winlogon.exe + 0x1F1FFF + + + C:\Windows\system32\services.exe + 0x1F1FFF + + + + diff --git a/10_process_access/include_hook_check.xml b/10_process_access/include_hook_check.xml index 39524df..ae23350 100644 --- a/10_process_access/include_hook_check.xml +++ b/10_process_access/include_hook_check.xml @@ -1,9 +1,9 @@ - - - 0x21410 - - - + + + 0x21410 + + + diff --git a/10_process_access/include_lsass_access.xml b/10_process_access/include_lsass_access.xml index 486790c..c7a9963 100644 --- a/10_process_access/include_lsass_access.xml +++ b/10_process_access/include_lsass_access.xml @@ -1,25 +1,25 @@ - - + + - - C:\Windows\system32\lsass.exe - 0x1FFFFF - - - C:\Windows\system32\lsass.exe + + C:\Windows\system32\lsass.exe + 0x1FFFFF + + + C:\Windows\system32\lsass.exe 0x1F1FFF - - - C:\Windows\system32\lsass.exe + + + C:\Windows\system32\lsass.exe 0x1010 - - - C:\Windows\system32\lsass.exe + + + C:\Windows\system32\lsass.exe 0x143A - + - - + + diff --git a/10_process_access/include_office_process_injection.xml b/10_process_access/include_office_process_injection.xml index 77c26e9..2241a5f 100644 --- a/10_process_access/include_office_process_injection.xml +++ b/10_process_access/include_office_process_injection.xml @@ -1,12 +1,12 @@ - - - + + + - C:\Program Files;\Microsoft Office\Root\Office - \Microsoft Shared\VBA + C:\Program Files;\Microsoft Office\Root\Office + \Microsoft Shared\VBA - - + + diff --git a/10_process_access/include_process_discovery.xml b/10_process_access/include_process_discovery.xml index 3256805..47e9836 100644 --- a/10_process_access/include_process_discovery.xml +++ b/10_process_access/include_process_discovery.xml @@ -1,9 +1,9 @@ - - + + - + - - + + diff --git a/10_process_access/include_process_suspend_resume.xml b/10_process_access/include_process_suspend_resume.xml index 6dd2456..b9860af 100644 --- a/10_process_access/include_process_suspend_resume.xml +++ b/10_process_access/include_process_suspend_resume.xml @@ -1,14 +1,14 @@ - - - 0x0800 - 0x0810 - 0x0820 - 0x800 - 0x810 - 0x820 - - - + + + 0x0800 + 0x0810 + 0x0820 + 0x800 + 0x810 + 0x820 + + + diff --git a/10_process_access/include_suspicious_locations.xml b/10_process_access/include_suspicious_locations.xml index 4178513..85b4c81 100644 --- a/10_process_access/include_suspicious_locations.xml +++ b/10_process_access/include_suspicious_locations.xml @@ -1,26 +1,26 @@ - - + + - C:\PerfLogs\ - C:\$Recycle.bin\ - C:\Intel\Logs\ - C:\Users\Default\ - C:\Users\Public\ - C:\Users\NetworkService\ - C:\Windows\Fonts\ - C:\Windows\Debug\ - C:\Windows\Media\ - C:\Windows\Help\ - C:\Windows\addins\ - C:\Windows\repair\ - C:\Windows\security\ - C:\Windows\system32\config\systemprofile\ - VolumeShadowCopy - \htdocs\ - \wwwroot\ - \Temp\ + C:\PerfLogs\ + C:\$Recycle.bin\ + C:\Intel\Logs\ + C:\Users\Default\ + C:\Users\Public\ + C:\Users\NetworkService\ + C:\Windows\Fonts\ + C:\Windows\Debug\ + C:\Windows\Media\ + C:\Windows\Help\ + C:\Windows\addins\ + C:\Windows\repair\ + C:\Windows\security\ + C:\Windows\system32\config\systemprofile\ + VolumeShadowCopy + \htdocs\ + \wwwroot\ + \Temp\ - - + + diff --git a/10_process_access/include_suspicious_powershell.xml b/10_process_access/include_suspicious_powershell.xml index b362fed..d937b1e 100644 --- a/10_process_access/include_suspicious_powershell.xml +++ b/10_process_access/include_suspicious_powershell.xml @@ -1,12 +1,12 @@ - - + + System.Management.Automation.ni.dll C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - - + + diff --git a/11_file_create/exclude_dell_process.xml b/11_file_create/exclude_dell_process.xml index 581a2b2..42c69fd 100644 --- a/11_file_create/exclude_dell_process.xml +++ b/11_file_create/exclude_dell_process.xml @@ -1,10 +1,10 @@ - - - - - C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - - - + + + + + C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe + + + diff --git a/11_file_create/exclude_intel_gfx_service.xml b/11_file_create/exclude_intel_gfx_service.xml index 881f7c0..60d0313 100644 --- a/11_file_create/exclude_intel_gfx_service.xml +++ b/11_file_create/exclude_intel_gfx_service.xml @@ -1,10 +1,10 @@ - - - - - C:\Windows\system32\igfxCUIService.exe - - - + + + + + C:\Windows\system32\igfxCUIService.exe + + + \ No newline at end of file diff --git a/11_file_create/exclude_ivanti_res.xml b/11_file_create/exclude_ivanti_res.xml index 0ba311e..b20876b 100644 --- a/11_file_create/exclude_ivanti_res.xml +++ b/11_file_create/exclude_ivanti_res.xml @@ -1,10 +1,10 @@ - - + + - C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe - C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe - - - + C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe + C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe + + + diff --git a/11_file_create/exclude_microsoft_click2run.xml b/11_file_create/exclude_microsoft_click2run.xml index 12a8340..f7ca09b 100644 --- a/11_file_create/exclude_microsoft_click2run.xml +++ b/11_file_create/exclude_microsoft_click2run.xml @@ -1,10 +1,10 @@ - - - - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - - - + + + + + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + + + \ No newline at end of file diff --git a/11_file_create/exclude_microsoft_services.xml b/11_file_create/exclude_microsoft_services.xml index deee498..95acac7 100644 --- a/11_file_create/exclude_microsoft_services.xml +++ b/11_file_create/exclude_microsoft_services.xml @@ -1,14 +1,14 @@ - - - - C:\Windows\System32\smss.exe - C:\Windows\system32\CompatTelRunner.exe - C:\Windows\system32\wbem\WMIADAP.EXE - C:\Windows\System32\DriverStore\Temp\ - C:\Windows\System32\wbem\Performance\ - WRITABLE.TST - - - + + + + C:\Windows\System32\smss.exe + C:\Windows\system32\CompatTelRunner.exe + C:\Windows\system32\wbem\WMIADAP.EXE + C:\Windows\System32\DriverStore\Temp\ + C:\Windows\System32\wbem\Performance\ + WRITABLE.TST + + + diff --git a/11_file_create/exclude_microsoft_windows_recent_files.xml b/11_file_create/exclude_microsoft_windows_recent_files.xml index 487de33..45df8a6 100644 --- a/11_file_create/exclude_microsoft_windows_recent_files.xml +++ b/11_file_create/exclude_microsoft_windows_recent_files.xml @@ -1,9 +1,9 @@ - - - \AppData\Roaming\Microsoft\Windows\Recent\ - - - + + + \AppData\Roaming\Microsoft\Windows\Recent\ + + + diff --git a/11_file_create/exclude_microsoft_windows_update.xml b/11_file_create/exclude_microsoft_windows_update.xml index e4bbb93..26d9670 100644 --- a/11_file_create/exclude_microsoft_windows_update.xml +++ b/11_file_create/exclude_microsoft_windows_update.xml @@ -1,11 +1,11 @@ - - - - - C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ - C:\WINDOWS\winsxs\amd64_microsoft-windows - - - + + + + + C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ + C:\WINDOWS\winsxs\amd64_microsoft-windows + + + \ No newline at end of file diff --git a/11_file_create/exclude_msdatp.xml b/11_file_create/exclude_msdatp.xml index 3b8eb64..608f655 100644 --- a/11_file_create/exclude_msdatp.xml +++ b/11_file_create/exclude_msdatp.xml @@ -1,9 +1,9 @@ - - + + - c:\Program Files\Microsoft Security Client\MsMpEng.exe - - - + c:\Program Files\Microsoft Security Client\MsMpEng.exe + + + diff --git a/11_file_create/exclude_outlook_profile.xml b/11_file_create/exclude_outlook_profile.xml index e9c526f..9faec06 100644 --- a/11_file_create/exclude_outlook_profile.xml +++ b/11_file_create/exclude_outlook_profile.xml @@ -3,8 +3,8 @@ - Outlook.exe - Roaming\Microsoft\Outlook\Outlook.xml + Outlook.exe + Roaming\Microsoft\Outlook\Outlook.xml diff --git a/11_file_create/exclude_provtool.xml b/11_file_create/exclude_provtool.xml index 513d57e..16261fc 100644 --- a/11_file_create/exclude_provtool.xml +++ b/11_file_create/exclude_provtool.xml @@ -1,10 +1,10 @@ - - - - - c:\windows\system32\provtool.exe - - - + + + + + c:\windows\system32\provtool.exe + + + diff --git a/11_file_create/exclude_sccm.xml b/11_file_create/exclude_sccm.xml index bc167a9..fa6dc6e 100644 --- a/11_file_create/exclude_sccm.xml +++ b/11_file_create/exclude_sccm.xml @@ -1,10 +1,10 @@ - - + + - C:\WINDOWS\CCM\CcmExec.exe - C:\Windows\CCM - - - + C:\WINDOWS\CCM\CcmExec.exe + C:\Windows\CCM + + + diff --git a/11_file_create/exclude_scheduled_task_noise.xml b/11_file_create/exclude_scheduled_task_noise.xml index 09c45bb..b7f82a1 100644 --- a/11_file_create/exclude_scheduled_task_noise.xml +++ b/11_file_create/exclude_scheduled_task_noise.xml @@ -1,13 +1,13 @@ - - - - - C:\Windows\System32\Tasks\Microsoft\Windows\PLA\FabricTraces - C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector - C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant - - - + + + + + C:\Windows\System32\Tasks\Microsoft\Windows\PLA\FabricTraces + C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask + C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector + C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant + + + diff --git a/11_file_create/include_appc_shim.xml b/11_file_create/include_appc_shim.xml index 4fe57d3..dff35f4 100644 --- a/11_file_create/include_appc_shim.xml +++ b/11_file_create/include_appc_shim.xml @@ -1,9 +1,9 @@ - - + + - C:\Windows\AppPatch\Custom + C:\Windows\AppPatch\Custom - - + + diff --git a/11_file_create/include_batch_files.xml b/11_file_create/include_batch_files.xml index 5b04101..1be2df6 100644 --- a/11_file_create/include_batch_files.xml +++ b/11_file_create/include_batch_files.xml @@ -1,10 +1,10 @@ - - - - .bat - .cmd - - - + + + + .bat + .cmd + + + \ No newline at end of file diff --git a/11_file_create/include_chm_files.xml b/11_file_create/include_chm_files.xml index f564327..8e09b28 100644 --- a/11_file_create/include_chm_files.xml +++ b/11_file_create/include_chm_files.xml @@ -1,9 +1,9 @@ - - + + - .chm - - - + .chm + + + diff --git a/11_file_create/include_default_profile_changes.xml b/11_file_create/include_default_profile_changes.xml index 1f2eb59..ecc9ec7 100644 --- a/11_file_create/include_default_profile_changes.xml +++ b/11_file_create/include_default_profile_changes.xml @@ -1,9 +1,9 @@ - - + + - C:\Users\Default - - - + C:\Users\Default + + + \ No newline at end of file diff --git a/11_file_create/include_desktop.xml b/11_file_create/include_desktop.xml index 87c599c..d676d97 100644 --- a/11_file_create/include_desktop.xml +++ b/11_file_create/include_desktop.xml @@ -1,9 +1,9 @@ - - + + - Desktop - - - + Desktop + + + \ No newline at end of file diff --git a/11_file_create/include_dotnet.xml b/11_file_create/include_dotnet.xml index 58989ba..13262e3 100644 --- a/11_file_create/include_dotnet.xml +++ b/11_file_create/include_dotnet.xml @@ -1,16 +1,16 @@ - - - - AppData\Local\Microsoft\CLR_v2.0\UsageLogs\ - \UsageLogs\cscript.exe.log - \UsageLogs\wscript.exe.log - \UsageLogs\wmic.exe.log - \UsageLogs\mshta.exe.log - \UsageLogs\svchost.exe.log - \UsageLogs\regsvr32.exe.log - \UsageLogs\rundll32.exe.log - - - + + + + AppData\Local\Microsoft\CLR_v2.0\UsageLogs\ + \UsageLogs\cscript.exe.log + \UsageLogs\wscript.exe.log + \UsageLogs\wmic.exe.log + \UsageLogs\mshta.exe.log + \UsageLogs\svchost.exe.log + \UsageLogs\regsvr32.exe.log + \UsageLogs\rundll32.exe.log + + + \ No newline at end of file diff --git a/11_file_create/include_downloaded_files.xml b/11_file_create/include_downloaded_files.xml index f701b1c..9a6ec1e 100644 --- a/11_file_create/include_downloaded_files.xml +++ b/11_file_create/include_downloaded_files.xml @@ -1,9 +1,9 @@ - - + + - \Downloads\ - - - + \Downloads\ + + + \ No newline at end of file diff --git a/11_file_create/include_drivers_added.xml b/11_file_create/include_drivers_added.xml index 1cef765..28fdf1f 100644 --- a/11_file_create/include_drivers_added.xml +++ b/11_file_create/include_drivers_added.xml @@ -1,10 +1,10 @@ - - - - C:\Windows\System32\Drivers - C:\Windows\SysWOW64\Drivers - - - + + + + C:\Windows\System32\Drivers + C:\Windows\SysWOW64\Drivers + + + \ No newline at end of file diff --git a/11_file_create/include_executables.xml b/11_file_create/include_executables.xml index 93c2754..bb8fd5b 100644 --- a/11_file_create/include_executables.xml +++ b/11_file_create/include_executables.xml @@ -1,9 +1,9 @@ - - + + - .exe - - - + .exe + + + \ No newline at end of file diff --git a/11_file_create/include_group_policy_changes.xml b/11_file_create/include_group_policy_changes.xml index 5136959..64e80b1 100644 --- a/11_file_create/include_group_policy_changes.xml +++ b/11_file_create/include_group_policy_changes.xml @@ -1,10 +1,10 @@ - - - - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - - - + + + + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + + + \ No newline at end of file diff --git a/11_file_create/include_hta_scripts.xml b/11_file_create/include_hta_scripts.xml index 084fb50..d842c5a 100644 --- a/11_file_create/include_hta_scripts.xml +++ b/11_file_create/include_hta_scripts.xml @@ -1,9 +1,9 @@ - - + + - .hta - - - + .hta + + + diff --git a/11_file_create/include_iso.xml b/11_file_create/include_iso.xml index 8051fe4..3ffd4be 100644 --- a/11_file_create/include_iso.xml +++ b/11_file_create/include_iso.xml @@ -1,10 +1,10 @@ - - + + - .iso - .img - - - + .iso + .img + + + diff --git a/11_file_create/include_kirbi.xml b/11_file_create/include_kirbi.xml index 2dd8b8b..aee3afd 100644 --- a/11_file_create/include_kirbi.xml +++ b/11_file_create/include_kirbi.xml @@ -1,9 +1,9 @@ - - + + - .kirbi - - - + .kirbi + + + \ No newline at end of file diff --git a/11_file_create/include_links.xml b/11_file_create/include_links.xml index a098706..1bae66d 100644 --- a/11_file_create/include_links.xml +++ b/11_file_create/include_links.xml @@ -1,10 +1,10 @@ - - + + - .lnk - .scf - - - + .lnk + .scf + + + diff --git a/11_file_create/include_microsoft_clickonce.xml b/11_file_create/include_microsoft_clickonce.xml index 0757061..f256031 100644 --- a/11_file_create/include_microsoft_clickonce.xml +++ b/11_file_create/include_microsoft_clickonce.xml @@ -1,10 +1,10 @@ - - - - .application - .appref-ms - - - + + + + .application + .appref-ms + + + \ No newline at end of file diff --git a/11_file_create/include_microsoft_msbuild_scripts.xml b/11_file_create/include_microsoft_msbuild_scripts.xml index db4972c..9db8580 100644 --- a/11_file_create/include_microsoft_msbuild_scripts.xml +++ b/11_file_create/include_microsoft_msbuild_scripts.xml @@ -1,10 +1,10 @@ - - - - .*proj - .sln - - - + + + + .*proj + .sln + + + diff --git a/11_file_create/include_microsoft_settingcontent-ms.xml b/11_file_create/include_microsoft_settingcontent-ms.xml index d5bbc6b..a8158e4 100644 --- a/11_file_create/include_microsoft_settingcontent-ms.xml +++ b/11_file_create/include_microsoft_settingcontent-ms.xml @@ -1,9 +1,9 @@ - - + + - .settingcontent-ms - - - + .settingcontent-ms + + + \ No newline at end of file diff --git a/11_file_create/include_ms_office_documents_with_macros.xml b/11_file_create/include_ms_office_documents_with_macros.xml index 57441d6..b99c3f7 100644 --- a/11_file_create/include_ms_office_documents_with_macros.xml +++ b/11_file_create/include_ms_office_documents_with_macros.xml @@ -1,19 +1,19 @@ - - - - .docm - .pptm - .xlsm - .xlm - .dotm - .xltm - .potm - .ppsm - .sldm - .xlam - .xla - - - + + + + .docm + .pptm + .xlsm + .xlm + .dotm + .xltm + .potm + .ppsm + .sldm + .xlam + .xla + + + \ No newline at end of file diff --git a/11_file_create/include_ms_office_excel_iqy_slk.xml b/11_file_create/include_ms_office_excel_iqy_slk.xml index 4d04661..5e6b92d 100644 --- a/11_file_create/include_ms_office_excel_iqy_slk.xml +++ b/11_file_create/include_ms_office_excel_iqy_slk.xml @@ -1,11 +1,11 @@ - - - - - .iqy - .slk - - - + + + + + .iqy + .slk + + + \ No newline at end of file diff --git a/11_file_create/include_outlook_attachments.xml b/11_file_create/include_outlook_attachments.xml index 98ece84..489d7bf 100644 --- a/11_file_create/include_outlook_attachments.xml +++ b/11_file_create/include_outlook_attachments.xml @@ -1,9 +1,9 @@ - - + + - \Content.Outlook\ - - - + \Content.Outlook\ + + + \ No newline at end of file diff --git a/11_file_create/include_outlook_persistence.xml b/11_file_create/include_outlook_persistence.xml index 6f85ca7..4496668 100644 --- a/11_file_create/include_outlook_persistence.xml +++ b/11_file_create/include_outlook_persistence.xml @@ -1,11 +1,11 @@ - - + + - Roaming\Microsoft\Outlook\VbaProject.OTM - .rwz - Roaming\Microsoft\Outlook\Outlook.xml - - - + Roaming\Microsoft\Outlook\VbaProject.OTM + .rwz + Roaming\Microsoft\Outlook\Outlook.xml + + + \ No newline at end of file diff --git a/11_file_create/include_overlooked_extensions.xml b/11_file_create/include_overlooked_extensions.xml index 35d4ed1..3a2ce6d 100644 --- a/11_file_create/include_overlooked_extensions.xml +++ b/11_file_create/include_overlooked_extensions.xml @@ -1,16 +1,16 @@ - - - - .rft - .jsp - .jspx - .asp - .aspx - .php - .war - .ace - - - + + + + .rft + .jsp + .jspx + .asp + .aspx + .php + .war + .ace + + + \ No newline at end of file diff --git a/11_file_create/include_powershell_changes.xml b/11_file_create/include_powershell_changes.xml index 186c738..dec3cbe 100644 --- a/11_file_create/include_powershell_changes.xml +++ b/11_file_create/include_powershell_changes.xml @@ -1,10 +1,10 @@ - - - - C:\Windows\System32\WindowsPowerShell - C:\Windows\SysWOW64\WindowsPowerShell - - - + + + + C:\Windows\System32\WindowsPowerShell + C:\Windows\SysWOW64\WindowsPowerShell + + + diff --git a/11_file_create/include_powershell_scripts.xml b/11_file_create/include_powershell_scripts.xml index 7b4a53b..9d817a2 100644 --- a/11_file_create/include_powershell_scripts.xml +++ b/11_file_create/include_powershell_scripts.xml @@ -1,10 +1,10 @@ - - - - .ps1 - .ps2 - - - + + + + .ps1 + .ps2 + + + diff --git a/11_file_create/include_python_scripts.xml b/11_file_create/include_python_scripts.xml index 7ebb434..8254fa1 100644 --- a/11_file_create/include_python_scripts.xml +++ b/11_file_create/include_python_scripts.xml @@ -1,11 +1,11 @@ - - + + - .py - .pyc - .pyw - - - + .py + .pyc + .pyw + + + diff --git a/11_file_create/include_rundll32.xml b/11_file_create/include_rundll32.xml index 61eb051..74a5d1d 100644 --- a/11_file_create/include_rundll32.xml +++ b/11_file_create/include_rundll32.xml @@ -1,9 +1,9 @@ - - - - rundll32.exe - - - + + + + rundll32.exe + + + diff --git a/11_file_create/include_scheduled_task_changes.xml b/11_file_create/include_scheduled_task_changes.xml index b00566f..75752ac 100644 --- a/11_file_create/include_scheduled_task_changes.xml +++ b/11_file_create/include_scheduled_task_changes.xml @@ -1,10 +1,10 @@ - - - - C:\Windows\System32\Tasks - C:\Windows\Tasks\ - - - + + + + C:\Windows\System32\Tasks + C:\Windows\Tasks\ + + + diff --git a/11_file_create/include_start_menu_items.xml b/11_file_create/include_start_menu_items.xml index dbbc653..ebf9530 100644 --- a/11_file_create/include_start_menu_items.xml +++ b/11_file_create/include_start_menu_items.xml @@ -1,9 +1,9 @@ - - + + - \Start Menu - - - + \Start Menu + + + \ No newline at end of file diff --git a/11_file_create/include_startup_items.xml b/11_file_create/include_startup_items.xml index 61054bd..6cdc646 100644 --- a/11_file_create/include_startup_items.xml +++ b/11_file_create/include_startup_items.xml @@ -1,9 +1,9 @@ - - + + - \Startup - - - + \Startup + + + \ No newline at end of file diff --git a/11_file_create/include_system_driver_files.xml b/11_file_create/include_system_driver_files.xml index 0215530..7489e16 100644 --- a/11_file_create/include_system_driver_files.xml +++ b/11_file_create/include_system_driver_files.xml @@ -1,9 +1,9 @@ - - + + - .sys - - - + .sys + + + \ No newline at end of file diff --git a/11_file_create/include_taskmanager_lsass.xml b/11_file_create/include_taskmanager_lsass.xml index 1236c34..4091c05 100644 --- a/11_file_create/include_taskmanager_lsass.xml +++ b/11_file_create/include_taskmanager_lsass.xml @@ -1,10 +1,10 @@ - - - - \*lsass*.dmp\ - taskmgr.exe - - - + + + + \*lsass*.dmp\ + taskmgr.exe + + + \ No newline at end of file diff --git a/11_file_create/include_url.xml b/11_file_create/include_url.xml index a00b2d3..c1e26e0 100644 --- a/11_file_create/include_url.xml +++ b/11_file_create/include_url.xml @@ -1,9 +1,9 @@ - - + + - .url - - - + .url + + + diff --git a/11_file_create/include_visual_basic_scripts.xml b/11_file_create/include_visual_basic_scripts.xml index 2ed01ff..cc93946 100644 --- a/11_file_create/include_visual_basic_scripts.xml +++ b/11_file_create/include_visual_basic_scripts.xml @@ -1,11 +1,11 @@ - - - - .vb - .vbe - .vbs - - - + + + + .vb + .vbe + .vbs + + + \ No newline at end of file diff --git a/11_file_create/include_wmi_changes.xml b/11_file_create/include_wmi_changes.xml index 3aae3a0..846b14e 100644 --- a/11_file_create/include_wmi_changes.xml +++ b/11_file_create/include_wmi_changes.xml @@ -1,11 +1,11 @@ - - + + - C:\Windows\System32\Wbem - C:\Windows\SysWOW64\Wbem - C:\WINDOWS\system32\wbem\scrcons.exe - - - + C:\Windows\System32\Wbem + C:\Windows\SysWOW64\Wbem + C:\WINDOWS\system32\wbem\scrcons.exe + + + diff --git a/11_file_create/include_writable_folders.xml b/11_file_create/include_writable_folders.xml index 6446225..da7e5eb 100644 --- a/11_file_create/include_writable_folders.xml +++ b/11_file_create/include_writable_folders.xml @@ -1,14 +1,14 @@ - - + + - C:\Windows\Temp\ - C:\Program\ - C:\Temp\ - C:\PerfLogs\ - C:\Users\Public\ - \AppData\Temp\ - - - + C:\Windows\Temp\ + C:\Program\ + C:\Temp\ + C:\PerfLogs\ + C:\Users\Public\ + \AppData\Temp\ + + + diff --git a/12_13_14_registry_event/exclude_cisco_anyconnect.xml b/12_13_14_registry_event/exclude_cisco_anyconnect.xml index f9009f6..aff9c66 100644 --- a/12_13_14_registry_event/exclude_cisco_anyconnect.xml +++ b/12_13_14_registry_event/exclude_cisco_anyconnect.xml @@ -1,12 +1,12 @@ - - - - - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\aciseposture.exe - - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe - - - + + + + + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\aciseposture.exe + + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe + + + diff --git a/12_13_14_registry_event/exclude_internet_explorer_settings.xml b/12_13_14_registry_event/exclude_internet_explorer_settings.xml index 33047c9..c205fd2 100644 --- a/12_13_14_registry_event/exclude_internet_explorer_settings.xml +++ b/12_13_14_registry_event/exclude_internet_explorer_settings.xml @@ -1,14 +1,14 @@ - - - - - Toolbar\WebBrowser - Toolbar\WebBrowser\ITBar7Height - Toolbar\ShellBrowser\ITBar7Layout - Internet Explorer\Toolbar\Locked - ShellBrowser - - - + + + + + Toolbar\WebBrowser + Toolbar\WebBrowser\ITBar7Height + Toolbar\ShellBrowser\ITBar7Layout + Internet Explorer\Toolbar\Locked + ShellBrowser + + + \ No newline at end of file diff --git a/12_13_14_registry_event/exclude_ivanti.xml b/12_13_14_registry_event/exclude_ivanti.xml index ee7eb0c..d829459 100644 --- a/12_13_14_registry_event/exclude_ivanti.xml +++ b/12_13_14_registry_event/exclude_ivanti.xml @@ -1,10 +1,10 @@ - - + + - C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe - C:\Program Files\RES Software\Workspace Manager\pfwsmgr.exe - - - + C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe + C:\Program Files\RES Software\Workspace Manager\pfwsmgr.exe + + + diff --git a/12_13_14_registry_event/exclude_mcafee_endpoint.xml b/12_13_14_registry_event/exclude_mcafee_endpoint.xml index 631b7c6..c125f21 100644 --- a/12_13_14_registry_event/exclude_mcafee_endpoint.xml +++ b/12_13_14_registry_event/exclude_mcafee_endpoint.xml @@ -1,30 +1,30 @@ - - - - - C:\Program Files\McAfee\Endpoint Encryption Agent\MfeEpeHost.exe - - C:\Program Files\McAfee\Endpoint Security\Adaptive Threat Protection\mfeatp.exe - - C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe - - C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe - - C:\Program Files\McAfee\Agent\masvc.exe - - C:\Program Files\McAfee\Agent\x86\mfemactl.exe - - C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe - - C:\Program Files\McAfee\Agent\x86\macompatsvc.exe - - C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe - - C:\Program Files\Common Files\McAfee\Engine\scanners - - C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe - - - + + + + + C:\Program Files\McAfee\Endpoint Encryption Agent\MfeEpeHost.exe + + C:\Program Files\McAfee\Endpoint Security\Adaptive Threat Protection\mfeatp.exe + + C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe + + C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe + + C:\Program Files\McAfee\Agent\masvc.exe + + C:\Program Files\McAfee\Agent\x86\mfemactl.exe + + C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe + + C:\Program Files\McAfee\Agent\x86\macompatsvc.exe + + C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe + + C:\Program Files\Common Files\McAfee\Engine\scanners + + C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe + + + diff --git a/12_13_14_registry_event/exclude_webroot.xml b/12_13_14_registry_event/exclude_webroot.xml index f6b02c4..e486cdc 100644 --- a/12_13_14_registry_event/exclude_webroot.xml +++ b/12_13_14_registry_event/exclude_webroot.xml @@ -1,10 +1,10 @@ - - - - - C:\Program Files (x86)\Webroot\WRSA.exe - - - + + + + + C:\Program Files (x86)\Webroot\WRSA.exe + + + \ No newline at end of file diff --git a/12_13_14_registry_event/exclude_widcomm_bt_driver.xml b/12_13_14_registry_event/exclude_widcomm_bt_driver.xml index 9286000..cf82dcf 100644 --- a/12_13_14_registry_event/exclude_widcomm_bt_driver.xml +++ b/12_13_14_registry_event/exclude_widcomm_bt_driver.xml @@ -1,10 +1,10 @@ - - - - - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe - - - + + + + + C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe + + + \ No newline at end of file diff --git a/12_13_14_registry_event/exclude_windows_bootup_control.xml b/12_13_14_registry_event/exclude_windows_bootup_control.xml index f0400af..d400c8a 100644 --- a/12_13_14_registry_event/exclude_windows_bootup_control.xml +++ b/12_13_14_registry_event/exclude_windows_bootup_control.xml @@ -1,15 +1,15 @@ - - - - - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit - - - + + + + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + + + \ No newline at end of file diff --git a/12_13_14_registry_event/exclude_windows_file_exts.xml b/12_13_14_registry_event/exclude_windows_file_exts.xml index 573bc68..8a4e5ef 100644 --- a/12_13_14_registry_event/exclude_windows_file_exts.xml +++ b/12_13_14_registry_event/exclude_windows_file_exts.xml @@ -1,15 +1,15 @@ - - - - \OpenWithProgids - \OpenWithList - \UserChoice - \UserChoice\ProgId - \UserChoice\Hash - \OpenWithList\MRUList - } 0xFFFF - - - + + + + \OpenWithProgids + \OpenWithList + \UserChoice + \UserChoice\ProgId + \UserChoice\Hash + \OpenWithList\MRUList + } 0xFFFF + + + \ No newline at end of file diff --git a/12_13_14_registry_event/exclude_windows_generic_binaries.xml b/12_13_14_registry_event/exclude_windows_generic_binaries.xml index 132d748..e5b54ef 100644 --- a/12_13_14_registry_event/exclude_windows_generic_binaries.xml +++ b/12_13_14_registry_event/exclude_windows_generic_binaries.xml @@ -1,14 +1,14 @@ - - - - Office\root\integration\integrator.exe - C:\WINDOWS\system32\backgroundTaskHost.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files\Windows Defender\MsMpEng.exe - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - C:\Program Files\Microsoft Application Virtualization\Client\AppVClient.exe - - - + + + + Office\root\integration\integrator.exe + C:\WINDOWS\system32\backgroundTaskHost.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Windows Defender\MsMpEng.exe + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + C:\Program Files\Microsoft Application Virtualization\Client\AppVClient.exe + + + \ No newline at end of file diff --git a/12_13_14_registry_event/exclude_windows_misc.xml b/12_13_14_registry_event/exclude_windows_misc.xml index eb6a2e2..0c7d58c 100644 --- a/12_13_14_registry_event/exclude_windows_misc.xml +++ b/12_13_14_registry_event/exclude_windows_misc.xml @@ -1,31 +1,31 @@ - - - - - \CurrentVersion\App Paths - \CurrentVersion\Image File Execution Options - \CurrentVersion\Shell Extensions\Cached - \CurrentVersion\Shell Extensions\Approved - }\PreviousPolicyAreas - \Control\WMI\Autologger\ - HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start - \Lsa\OfflineJoin\CurrentValue - \Components\TrustedInstaller\Events - \Components\TrustedInstaller - \Components\Wlansvc - \Components\Wlansvc\Events - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ - \Directory\shellex - \Directory\shellex\DragDropHandlers - \Drive\shellex - \Drive\shellex\DragDropHandlers - _Classes\AppX - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ - HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - C:\$WINDOWS.~BT\ - - - + + + + + \CurrentVersion\App Paths + \CurrentVersion\Image File Execution Options + \CurrentVersion\Shell Extensions\Cached + \CurrentVersion\Shell Extensions\Approved + }\PreviousPolicyAreas + \Control\WMI\Autologger\ + HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start + \Lsa\OfflineJoin\CurrentValue + \Components\TrustedInstaller\Events + \Components\TrustedInstaller + \Components\Wlansvc + \Components\Wlansvc\Events + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ + \Directory\shellex + \Directory\shellex\DragDropHandlers + \Drive\shellex + \Drive\shellex\DragDropHandlers + _Classes\AppX + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ + HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + C:\$WINDOWS.~BT\ + + + diff --git a/12_13_14_registry_event/exclude_windows_service_autostart.xml b/12_13_14_registry_event/exclude_windows_service_autostart.xml index ac839305..24b31e1 100644 --- a/12_13_14_registry_event/exclude_windows_service_autostart.xml +++ b/12_13_14_registry_event/exclude_windows_service_autostart.xml @@ -1,18 +1,18 @@ - - - - - \services\clr_optimization_v2.0.50727_32\Start - \services\clr_optimization_v2.0.50727_64\Start - \services\clr_optimization_v4.0.30319_32\Start - \services\clr_optimization_v4.0.30319_64\Start - \services\DeviceAssociationService\Start - \services\BITS\Start - \services\TrustedInstaller\Start - \services\tunnel\Start - \services\UsoSvc\Start - - - + + + + + \services\clr_optimization_v2.0.50727_32\Start + \services\clr_optimization_v2.0.50727_64\Start + \services\clr_optimization_v4.0.30319_32\Start + \services\clr_optimization_v4.0.30319_64\Start + \services\DeviceAssociationService\Start + \services\BITS\Start + \services\TrustedInstaller\Start + \services\tunnel\Start + \services\UsoSvc\Start + + + \ No newline at end of file diff --git a/12_13_14_registry_event/include_accessibility_features.xml b/12_13_14_registry_event/include_accessibility_features.xml index e60b4d8..5b85dd0 100644 --- a/12_13_14_registry_event/include_accessibility_features.xml +++ b/12_13_14_registry_event/include_accessibility_features.xml @@ -1,9 +1,9 @@ - - + + - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - - + + diff --git a/12_13_14_registry_event/include_appc_shim.xml b/12_13_14_registry_event/include_appc_shim.xml index 03e7823..737888c 100644 --- a/12_13_14_registry_event/include_appc_shim.xml +++ b/12_13_14_registry_event/include_appc_shim.xml @@ -1,10 +1,10 @@ - - + + - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - - + + diff --git a/12_13_14_registry_event/include_authentication_package.xml b/12_13_14_registry_event/include_authentication_package.xml index 564739b..cc9079f 100644 --- a/12_13_14_registry_event/include_authentication_package.xml +++ b/12_13_14_registry_event/include_authentication_package.xml @@ -1,10 +1,10 @@ - - + + - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - - + + diff --git a/12_13_14_registry_event/include_autoruns_and_startup_keys.xml b/12_13_14_registry_event/include_autoruns_and_startup_keys.xml index 03a823d..4fbd76e 100644 --- a/12_13_14_registry_event/include_autoruns_and_startup_keys.xml +++ b/12_13_14_registry_event/include_autoruns_and_startup_keys.xml @@ -1,28 +1,28 @@ - - - + + + - \CurrentVersion\Run - \Group Policy\Scripts - \Windows\System\Scripts - \Policies\Explorer\Run - \ServiceDll - \ImagePath - \Start - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - \Explorer\FileExts - \shell\install\command - \shell\open\command - \shell\open\ddeexec - Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup - - - + \CurrentVersion\Run + \Group Policy\Scripts + \Windows\System\Scripts + \Policies\Explorer\Run + \ServiceDll + \ImagePath + \Start + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + \Explorer\FileExts + \shell\install\command + \shell\open\command + \shell\open\ddeexec + Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + + + diff --git a/12_13_14_registry_event/include_bypass_uac.xml b/12_13_14_registry_event/include_bypass_uac.xml index 28e3d62..f6f6d35 100644 --- a/12_13_14_registry_event/include_bypass_uac.xml +++ b/12_13_14_registry_event/include_bypass_uac.xml @@ -1,11 +1,11 @@ - - + + - \mscfile\shell\open\command - ms-settings\shell\open\command - Classes\exefile\shell\runas\command\isolatedCommand + \mscfile\shell\open\command + ms-settings\shell\open\command + Classes\exefile\shell\runas\command\isolatedCommand - - + + diff --git a/12_13_14_registry_event/include_com_hijack.xml b/12_13_14_registry_event/include_com_hijack.xml index 493f6f1..c6e3d73 100644 --- a/12_13_14_registry_event/include_com_hijack.xml +++ b/12_13_14_registry_event/include_com_hijack.xml @@ -1,9 +1,9 @@ - - + + - Software\Classes\CLSID - - - + Software\Classes\CLSID + + + diff --git a/12_13_14_registry_event/include_disable_password_change.xml b/12_13_14_registry_event/include_disable_password_change.xml index 34edf38..10fb620 100644 --- a/12_13_14_registry_event/include_disable_password_change.xml +++ b/12_13_14_registry_event/include_disable_password_change.xml @@ -1,9 +1,9 @@ - - + + - \services\Netlogon\Parameters\DisablePasswordChange + \services\Netlogon\Parameters\DisablePasswordChange - - + + diff --git a/12_13_14_registry_event/include_dll_injection_at_process_launch.xml b/12_13_14_registry_event/include_dll_injection_at_process_launch.xml index ee91686..1884bda 100644 --- a/12_13_14_registry_event/include_dll_injection_at_process_launch.xml +++ b/12_13_14_registry_event/include_dll_injection_at_process_launch.xml @@ -1,10 +1,10 @@ - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls - - - + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls + + + diff --git a/12_13_14_registry_event/include_dns_serverdll_injection.xml b/12_13_14_registry_event/include_dns_serverdll_injection.xml index 6368d33..1f43a7f 100644 --- a/12_13_14_registry_event/include_dns_serverdll_injection.xml +++ b/12_13_14_registry_event/include_dns_serverdll_injection.xml @@ -1,9 +1,9 @@ - - + + - REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DNS\Parameters\ServerLevelPluginDll + REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DNS\Parameters\ServerLevelPluginDll - - + + diff --git a/12_13_14_registry_event/include_dotnet_ETW_tampering.xml b/12_13_14_registry_event/include_dotnet_ETW_tampering.xml index 752f548..53c2c76 100644 --- a/12_13_14_registry_event/include_dotnet_ETW_tampering.xml +++ b/12_13_14_registry_event/include_dotnet_ETW_tampering.xml @@ -1,9 +1,9 @@ - - + + - SOFTWARE\Microsoft\.NETFramework\ETWEnabled - - - + SOFTWARE\Microsoft\.NETFramework\ETWEnabled + + + diff --git a/12_13_14_registry_event/include_eventlog.xml b/12_13_14_registry_event/include_eventlog.xml index fe45854..49ee47c 100644 --- a/12_13_14_registry_event/include_eventlog.xml +++ b/12_13_14_registry_event/include_eventlog.xml @@ -1,10 +1,10 @@ - - + + - REGISTRY\MACHINE\SYSTEM\ControlSet001\Service\EventLog;Retention - REGISTRY\MACHINE\SYSTEM\ControlSet001\Service\EventLog;MaxSize - - - + REGISTRY\MACHINE\SYSTEM\ControlSet001\Service\EventLog;Retention + REGISTRY\MACHINE\SYSTEM\ControlSet001\Service\EventLog;MaxSize + + + diff --git a/12_13_14_registry_event/include_group_policy_integrity.xml b/12_13_14_registry_event/include_group_policy_integrity.xml index 86a0c3b..b545ebb 100644 --- a/12_13_14_registry_event/include_group_policy_integrity.xml +++ b/12_13_14_registry_event/include_group_policy_integrity.xml @@ -1,10 +1,10 @@ - - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions - - - + + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions + + + diff --git a/12_13_14_registry_event/include_image_file_exec_options.xml b/12_13_14_registry_event/include_image_file_exec_options.xml index d4d3b7a..abec9f0 100644 --- a/12_13_14_registry_event/include_image_file_exec_options.xml +++ b/12_13_14_registry_event/include_image_file_exec_options.xml @@ -1,10 +1,10 @@ - - + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - - - + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + + + diff --git a/12_13_14_registry_event/include_internet_explorer_extentions_helpers_or_toolbars.xml b/12_13_14_registry_event/include_internet_explorer_extentions_helpers_or_toolbars.xml index 29166e7..3a28854 100644 --- a/12_13_14_registry_event/include_internet_explorer_extentions_helpers_or_toolbars.xml +++ b/12_13_14_registry_event/include_internet_explorer_extentions_helpers_or_toolbars.xml @@ -1,11 +1,11 @@ - - - - \Internet Explorer\Toolbar - \Internet Explorer\Extensions - \Browser Helper Objects - - - + + + + \Internet Explorer\Toolbar + \Internet Explorer\Extensions + \Browser Helper Objects + + + diff --git a/12_13_14_registry_event/include_local_port_monitor.xml b/12_13_14_registry_event/include_local_port_monitor.xml index 2d23aee..d75a057 100644 --- a/12_13_14_registry_event/include_local_port_monitor.xml +++ b/12_13_14_registry_event/include_local_port_monitor.xml @@ -1,9 +1,9 @@ - - + + - HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors + HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors - - + + diff --git a/12_13_14_registry_event/include_netsh.xml b/12_13_14_registry_event/include_netsh.xml index f8858c9..66bfde5 100644 --- a/12_13_14_registry_event/include_netsh.xml +++ b/12_13_14_registry_event/include_netsh.xml @@ -1,9 +1,9 @@ - - + + - SOFTWARE\Microsoft\Netsh - - - + SOFTWARE\Microsoft\Netsh + + + diff --git a/12_13_14_registry_event/include_office_clickonce.xml b/12_13_14_registry_event/include_office_clickonce.xml index bed37aa..f392220 100644 --- a/12_13_14_registry_event/include_office_clickonce.xml +++ b/12_13_14_registry_event/include_office_clickonce.xml @@ -1,10 +1,10 @@ - - - - - \UrlUpdateInfo - - - + + + + + \UrlUpdateInfo + + + \ No newline at end of file diff --git a/12_13_14_registry_event/include_office_macros.xml b/12_13_14_registry_event/include_office_macros.xml index e5ba45c..d79e37e 100644 --- a/12_13_14_registry_event/include_office_macros.xml +++ b/12_13_14_registry_event/include_office_macros.xml @@ -1,9 +1,9 @@ - - + + - \Security\Trusted Documents\TrustRecords - - - + \Security\Trusted Documents\TrustRecords + + + diff --git a/12_13_14_registry_event/include_office_oulook_addins.xml b/12_13_14_registry_event/include_office_oulook_addins.xml index 8ad71ee..fce1fae 100644 --- a/12_13_14_registry_event/include_office_oulook_addins.xml +++ b/12_13_14_registry_event/include_office_oulook_addins.xml @@ -1,12 +1,12 @@ - - + + - \Microsoft\Office\Outlook\Addins - \Software\Microsoft\VSTO\Security\Inclusion - \Software\Microsoft\VSTO\SolutionMetadata - \Software\Microsoft\Office\16.0\Outlook\Security - - - + \Microsoft\Office\Outlook\Addins + \Software\Microsoft\VSTO\Security\Inclusion + \Software\Microsoft\VSTO\SolutionMetadata + \Software\Microsoft\Office\16.0\Outlook\Security + + + diff --git a/12_13_14_registry_event/include_rdp_logon_execution.xml b/12_13_14_registry_event/include_rdp_logon_execution.xml index e34b47a..8960df0 100644 --- a/12_13_14_registry_event/include_rdp_logon_execution.xml +++ b/12_13_14_registry_event/include_rdp_logon_execution.xml @@ -1,9 +1,9 @@ - - + + - HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services - - + + diff --git a/12_13_14_registry_event/include_scheduled_tasks_path.xml b/12_13_14_registry_event/include_scheduled_tasks_path.xml index 8c5af05..07d4241 100644 --- a/12_13_14_registry_event/include_scheduled_tasks_path.xml +++ b/12_13_14_registry_event/include_scheduled_tasks_path.xml @@ -1,10 +1,10 @@ - - + + - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - - + + \ No newline at end of file diff --git a/12_13_14_registry_event/include_security_support_provider.xml b/12_13_14_registry_event/include_security_support_provider.xml index e8a9fdf..5380592 100644 --- a/12_13_14_registry_event/include_security_support_provider.xml +++ b/12_13_14_registry_event/include_security_support_provider.xml @@ -1,9 +1,9 @@ - - + + - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe - - - + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe + + + diff --git a/12_13_14_registry_event/include_services.xml b/12_13_14_registry_event/include_services.xml index a721496..4c0b2dc 100644 --- a/12_13_14_registry_event/include_services.xml +++ b/12_13_14_registry_event/include_services.xml @@ -1,9 +1,9 @@ - - + + - HKLM\SYSTEM\CurrentControlSet\Services + HKLM\SYSTEM\CurrentControlSet\Services - - + + \ No newline at end of file diff --git a/12_13_14_registry_event/include_sip_trust_provider_hijacking.xml b/12_13_14_registry_event/include_sip_trust_provider_hijacking.xml index 0233cf6..29a1b61 100644 --- a/12_13_14_registry_event/include_sip_trust_provider_hijacking.xml +++ b/12_13_14_registry_event/include_sip_trust_provider_hijacking.xml @@ -1,12 +1,12 @@ - - - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - - - + + + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + + + diff --git a/12_13_14_registry_event/include_sysinternals.xml b/12_13_14_registry_event/include_sysinternals.xml index e1f67cf..812672c 100644 --- a/12_13_14_registry_event/include_sysinternals.xml +++ b/12_13_14_registry_event/include_sysinternals.xml @@ -1,20 +1,20 @@ - - - \PsExec\EulaAccepted - \PsFile\EulaAccepted - \PsGetSID\EulaAccepted - \PsInfo\EulaAccepted - \PsKill\EulaAccepted - \PsList\EulaAccepted - \PsLoggedOn\EulaAccepted - \PsLogList\EulaAccepted - \PsPasswd\EulaAccepted - \PsService\EulaAccepted - \PsShutDown\EulaAccepted - \PsSuspend\EulaAccepted - - - + + + \PsExec\EulaAccepted + \PsFile\EulaAccepted + \PsGetSID\EulaAccepted + \PsInfo\EulaAccepted + \PsKill\EulaAccepted + \PsList\EulaAccepted + \PsLoggedOn\EulaAccepted + \PsLogList\EulaAccepted + \PsPasswd\EulaAccepted + \PsService\EulaAccepted + \PsShutDown\EulaAccepted + \PsSuspend\EulaAccepted + + + diff --git a/12_13_14_registry_event/include_sysmon.xml b/12_13_14_registry_event/include_sysmon.xml index e927e5b..d290038 100644 --- a/12_13_14_registry_event/include_sysmon.xml +++ b/12_13_14_registry_event/include_sysmon.xml @@ -1,10 +1,10 @@ - - + + - SYSTEM\CurrentControlSet\services\SysmonDrv - SYSTEM\CurrentControlSet\services\Sysmon - - - + SYSTEM\CurrentControlSet\services\SysmonDrv + SYSTEM\CurrentControlSet\services\Sysmon + + + diff --git a/12_13_14_registry_event/include_terminal_service_execution.xml b/12_13_14_registry_event/include_terminal_service_execution.xml index 0924285..68083bf 100644 --- a/12_13_14_registry_event/include_terminal_service_execution.xml +++ b/12_13_14_registry_event/include_terminal_service_execution.xml @@ -1,10 +1,10 @@ - - - - - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - - - + + + + + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + + + diff --git a/12_13_14_registry_event/include_w32time_provider.xml b/12_13_14_registry_event/include_w32time_provider.xml index 6f2bf63..efd4c23 100644 --- a/12_13_14_registry_event/include_w32time_provider.xml +++ b/12_13_14_registry_event/include_w32time_provider.xml @@ -1,9 +1,9 @@ - - + + - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders - - + + diff --git a/12_13_14_registry_event/include_windows_address_book.xml b/12_13_14_registry_event/include_windows_address_book.xml index dec1c7e..b4b0274 100644 --- a/12_13_14_registry_event/include_windows_address_book.xml +++ b/12_13_14_registry_event/include_windows_address_book.xml @@ -1,9 +1,9 @@ - - - - HKLM\Software\Microsoft\WAB\DLLPath - - + + + + HKLM\Software\Microsoft\WAB\DLLPath + + diff --git a/12_13_14_registry_event/include_windows_app_path_hijack.xml b/12_13_14_registry_event/include_windows_app_path_hijack.xml index 3465a21..ad5e17e 100644 --- a/12_13_14_registry_event/include_windows_app_path_hijack.xml +++ b/12_13_14_registry_event/include_windows_app_path_hijack.xml @@ -1,11 +1,11 @@ - - - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls - - - + + + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls + + + diff --git a/12_13_14_registry_event/include_windows_com_objects.xml b/12_13_14_registry_event/include_windows_com_objects.xml index 3b65c22..b2a3162 100644 --- a/12_13_14_registry_event/include_windows_com_objects.xml +++ b/12_13_14_registry_event/include_windows_com_objects.xml @@ -1,10 +1,10 @@ - - - - \InprocServer32\(Default) - Classes\CLSID\;TreatAs - - - + + + + \InprocServer32\(Default) + Classes\CLSID\;TreatAs + + + \ No newline at end of file diff --git a/12_13_14_registry_event/include_windows_consent.xml b/12_13_14_registry_event/include_windows_consent.xml index 315f91c..d428483 100644 --- a/12_13_14_registry_event/include_windows_consent.xml +++ b/12_13_14_registry_event/include_windows_consent.xml @@ -1,15 +1,15 @@ - - - - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\bluetooth - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\usb - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\hunmanInterfaceDevice - - + + + + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\bluetooth + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\usb + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts + \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\hunmanInterfaceDevice + + diff --git a/12_13_14_registry_event/include_windows_credential_providers.xml b/12_13_14_registry_event/include_windows_credential_providers.xml index 0c77cf1..bd0a6ad 100644 --- a/12_13_14_registry_event/include_windows_credential_providers.xml +++ b/12_13_14_registry_event/include_windows_credential_providers.xml @@ -1,13 +1,13 @@ - - - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SYSTEM\CurrentControlSet\Control\Lsa - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\ - \Control\SecurityProviders\WDigest - - - + + + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SYSTEM\CurrentControlSet\Control\Lsa + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\ + \Control\SecurityProviders\WDigest + + + diff --git a/12_13_14_registry_event/include_windows_defender_tampering.xml b/12_13_14_registry_event/include_windows_defender_tampering.xml index dc730f4..31f75c3 100644 --- a/12_13_14_registry_event/include_windows_defender_tampering.xml +++ b/12_13_14_registry_event/include_windows_defender_tampering.xml @@ -1,17 +1,17 @@ - - - - - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender - - - + + + + + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender + + + diff --git a/12_13_14_registry_event/include_windows_firewall_tampering.xml b/12_13_14_registry_event/include_windows_firewall_tampering.xml index e4fbe57..176e00b 100644 --- a/12_13_14_registry_event/include_windows_firewall_tampering.xml +++ b/12_13_14_registry_event/include_windows_firewall_tampering.xml @@ -1,12 +1,12 @@ - - - - - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - - - + + + + + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + + + diff --git a/12_13_14_registry_event/include_windows_integrity_monitoring.xml b/12_13_14_registry_event/include_windows_integrity_monitoring.xml index f041de2..830e383 100644 --- a/12_13_14_registry_event/include_windows_integrity_monitoring.xml +++ b/12_13_14_registry_event/include_windows_integrity_monitoring.xml @@ -1,19 +1,19 @@ - - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon - \FriendlyName - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - C:\Windows\System32\svchost.exe - - - - + + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon + \FriendlyName + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + C:\Windows\System32\svchost.exe + + + + diff --git a/12_13_14_registry_event/include_windows_networking.xml b/12_13_14_registry_event/include_windows_networking.xml index c9546e9..19df364 100644 --- a/12_13_14_registry_event/include_windows_networking.xml +++ b/12_13_14_registry_event/include_windows_networking.xml @@ -1,11 +1,11 @@ - - - - - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - - - + + + + + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + + + diff --git a/12_13_14_registry_event/include_windows_port_changes.xml b/12_13_14_registry_event/include_windows_port_changes.xml index 8eca4ec..bad6bfd 100644 --- a/12_13_14_registry_event/include_windows_port_changes.xml +++ b/12_13_14_registry_event/include_windows_port_changes.xml @@ -1,10 +1,10 @@ - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports - HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports - - - + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports + HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports + + + diff --git a/12_13_14_registry_event/include_windows_powershell_logging_tampering.xml b/12_13_14_registry_event/include_windows_powershell_logging_tampering.xml index 153601a..6d29cd2 100644 --- a/12_13_14_registry_event/include_windows_powershell_logging_tampering.xml +++ b/12_13_14_registry_event/include_windows_powershell_logging_tampering.xml @@ -1,12 +1,12 @@ - - - - - HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging - HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging - HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription - - - + + + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging + HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging + HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription + + + diff --git a/12_13_14_registry_event/include_windows_root_certs.xml b/12_13_14_registry_event/include_windows_root_certs.xml index 2216ee6..910b012 100644 --- a/12_13_14_registry_event/include_windows_root_certs.xml +++ b/12_13_14_registry_event/include_windows_root_certs.xml @@ -1,10 +1,10 @@ - - - - HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates - \Microsoft\SystemCertificates\Root\Certificates - - - + + + + HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates + \Microsoft\SystemCertificates\Root\Certificates + + + diff --git a/12_13_14_registry_event/include_windows_security_center_tampering.xml b/12_13_14_registry_event/include_windows_security_center_tampering.xml index 89be7e8..2fbd107 100644 --- a/12_13_14_registry_event/include_windows_security_center_tampering.xml +++ b/12_13_14_registry_event/include_windows_security_center_tampering.xml @@ -1,11 +1,11 @@ - - - - - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - - - + + + + + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + + + diff --git a/12_13_14_registry_event/include_windows_shell_hijack.xml b/12_13_14_registry_event/include_windows_shell_hijack.xml index 508d55d..662f7cc 100644 --- a/12_13_14_registry_event/include_windows_shell_hijack.xml +++ b/12_13_14_registry_event/include_windows_shell_hijack.xml @@ -1,17 +1,17 @@ - - - - - \Classes\AllFilesystemObjects - \Classes\Directory - \Classes\Drive - \Classes\Folder - \ContextMenuHandlers - \CurrentVersion\Shell - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad - - - + + + + + \Classes\AllFilesystemObjects + \Classes\Directory + \Classes\Drive + \Classes\Folder + \ContextMenuHandlers + \CurrentVersion\Shell + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad + + + diff --git a/12_13_14_registry_event/include_windows_store_tampering.xml b/12_13_14_registry_event/include_windows_store_tampering.xml index 34b78df..0c98faf 100644 --- a/12_13_14_registry_event/include_windows_store_tampering.xml +++ b/12_13_14_registry_event/include_windows_store_tampering.xml @@ -1,9 +1,9 @@ - - - - HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command - - + + + + HKCU\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command + + diff --git a/12_13_14_registry_event/include_windows_thumbnail_autostart.xml b/12_13_14_registry_event/include_windows_thumbnail_autostart.xml index b9a0163..7c64f8d 100644 --- a/12_13_14_registry_event/include_windows_thumbnail_autostart.xml +++ b/12_13_14_registry_event/include_windows_thumbnail_autostart.xml @@ -1,10 +1,10 @@ - - - - - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} - - - + + + + + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} + + + diff --git a/12_13_14_registry_event/include_windows_uac_tampering.xml b/12_13_14_registry_event/include_windows_uac_tampering.xml index 6d5cbb8..004d63d 100644 --- a/12_13_14_registry_event/include_windows_uac_tampering.xml +++ b/12_13_14_registry_event/include_windows_uac_tampering.xml @@ -1,13 +1,13 @@ - - - - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - - - + + + + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + + + diff --git a/12_13_14_registry_event/include_windowsupdate_autostart.xml b/12_13_14_registry_event/include_windowsupdate_autostart.xml index eafb9ae..f3e382a 100644 --- a/12_13_14_registry_event/include_windowsupdate_autostart.xml +++ b/12_13_14_registry_event/include_windowsupdate_autostart.xml @@ -1,12 +1,12 @@ - - * - - - + + * + + + - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup - - + + \ No newline at end of file diff --git a/12_13_14_registry_event/include_winsock.xml b/12_13_14_registry_event/include_winsock.xml index a85d021..154d7fc 100644 --- a/12_13_14_registry_event/include_winsock.xml +++ b/12_13_14_registry_event/include_winsock.xml @@ -1,11 +1,11 @@ - - - - - HKLM\SYSTEM\CurrentControlSet\Services\WinSock - \ProxyServer - - - + + + + + HKLM\SYSTEM\CurrentControlSet\Services\WinSock + \ProxyServer + + + diff --git a/12_13_14_registry_event/include_wmi_implant.xml b/12_13_14_registry_event/include_wmi_implant.xml index 3ad8a07..1523f9e 100644 --- a/12_13_14_registry_event/include_wmi_implant.xml +++ b/12_13_14_registry_event/include_wmi_implant.xml @@ -1,10 +1,10 @@ - - + + - - SYSTEM\CurrentControlSet\Control\CrashControl + + SYSTEM\CurrentControlSet\Control\CrashControl - - + + diff --git a/15_file_create_stream_hash/include_7zip_extractions.xml b/15_file_create_stream_hash/include_7zip_extractions.xml index f42c8de..8b1c0d3 100644 --- a/15_file_create_stream_hash/include_7zip_extractions.xml +++ b/15_file_create_stream_hash/include_7zip_extractions.xml @@ -1,9 +1,9 @@ - - - Temp\7z - - - + + + Temp\7z + + + \ No newline at end of file diff --git a/15_file_create_stream_hash/include_batch_scripts.xml b/15_file_create_stream_hash/include_batch_scripts.xml index eb0f0cd..edadaff 100644 --- a/15_file_create_stream_hash/include_batch_scripts.xml +++ b/15_file_create_stream_hash/include_batch_scripts.xml @@ -1,10 +1,10 @@ - - - - .bat - .cmd - - - + + + + .bat + .cmd + + + \ No newline at end of file diff --git a/15_file_create_stream_hash/include_bin_files.xml b/15_file_create_stream_hash/include_bin_files.xml index 165ee60..7b8b19a 100644 --- a/15_file_create_stream_hash/include_bin_files.xml +++ b/15_file_create_stream_hash/include_bin_files.xml @@ -1,9 +1,9 @@ - - + + - Temp\debug.bin - - - + Temp\debug.bin + + + diff --git a/15_file_create_stream_hash/include_desktop.xml b/15_file_create_stream_hash/include_desktop.xml index bf9906b..b54b0d7 100644 --- a/15_file_create_stream_hash/include_desktop.xml +++ b/15_file_create_stream_hash/include_desktop.xml @@ -1,9 +1,9 @@ - - + + - Downloads - - - + Downloads + + + \ No newline at end of file diff --git a/15_file_create_stream_hash/include_dll_files.xml b/15_file_create_stream_hash/include_dll_files.xml new file mode 100644 index 0000000..3fcb98f --- /dev/null +++ b/15_file_create_stream_hash/include_dll_files.xml @@ -0,0 +1,9 @@ + + + + + .dll + + + + diff --git a/15_file_create_stream_hash/include_downloads.xml b/15_file_create_stream_hash/include_downloads.xml index bf9906b..b54b0d7 100644 --- a/15_file_create_stream_hash/include_downloads.xml +++ b/15_file_create_stream_hash/include_downloads.xml @@ -1,9 +1,9 @@ - - + + - Downloads - - - + Downloads + + + \ No newline at end of file diff --git a/15_file_create_stream_hash/include_exe_files.xml b/15_file_create_stream_hash/include_exe_files.xml index 67505b0..9aa0b72 100644 --- a/15_file_create_stream_hash/include_exe_files.xml +++ b/15_file_create_stream_hash/include_exe_files.xml @@ -1,9 +1,9 @@ - - + + - .exe - - - + .exe + + + diff --git a/15_file_create_stream_hash/include_general_commment.xml b/15_file_create_stream_hash/include_general_commment.xml index 4258c86..5094bef 100644 --- a/15_file_create_stream_hash/include_general_commment.xml +++ b/15_file_create_stream_hash/include_general_commment.xml @@ -1,12 +1,12 @@ - - - - - - - + + + \ No newline at end of file diff --git a/15_file_create_stream_hash/include_hta_scripts.xml b/15_file_create_stream_hash/include_hta_scripts.xml index 2d8503e..dded9c5 100644 --- a/15_file_create_stream_hash/include_hta_scripts.xml +++ b/15_file_create_stream_hash/include_hta_scripts.xml @@ -1,9 +1,9 @@ - - + + - .hta + .hta - - + + diff --git a/15_file_create_stream_hash/include_lnk_shortcuts.xml b/15_file_create_stream_hash/include_lnk_shortcuts.xml index 963b3a8..bc1ee4f 100644 --- a/15_file_create_stream_hash/include_lnk_shortcuts.xml +++ b/15_file_create_stream_hash/include_lnk_shortcuts.xml @@ -1,9 +1,9 @@ - - + + - .lnk - - - + .lnk + + + \ No newline at end of file diff --git a/15_file_create_stream_hash/include_outlook_attachments.xml b/15_file_create_stream_hash/include_outlook_attachments.xml index a4682eb..fc295db 100644 --- a/15_file_create_stream_hash/include_outlook_attachments.xml +++ b/15_file_create_stream_hash/include_outlook_attachments.xml @@ -1,9 +1,9 @@ - - + + - Content.Outlook - - - + Content.Outlook + + + \ No newline at end of file diff --git a/15_file_create_stream_hash/include_powershell_scripts.xml b/15_file_create_stream_hash/include_powershell_scripts.xml index 61aa5e3..b27264c 100644 --- a/15_file_create_stream_hash/include_powershell_scripts.xml +++ b/15_file_create_stream_hash/include_powershell_scripts.xml @@ -1,10 +1,10 @@ - - - - .ps1 - .ps2 - - - + + + + .ps1 + .ps2 + + + diff --git a/15_file_create_stream_hash/include_registry_file.xml b/15_file_create_stream_hash/include_registry_file.xml index 230eb2d..157be48 100644 --- a/15_file_create_stream_hash/include_registry_file.xml +++ b/15_file_create_stream_hash/include_registry_file.xml @@ -1,9 +1,9 @@ - - + + - .reg - - - + .reg + + + \ No newline at end of file diff --git a/15_file_create_stream_hash/include_visual_basic_scripts.xml b/15_file_create_stream_hash/include_visual_basic_scripts.xml index babdf96..6ac2bed 100644 --- a/15_file_create_stream_hash/include_visual_basic_scripts.xml +++ b/15_file_create_stream_hash/include_visual_basic_scripts.xml @@ -1,11 +1,11 @@ - - - - .vb - .vbe - .vbs - - - + + + + .vb + .vbe + .vbs + + + \ No newline at end of file diff --git a/17_18_pipe_event/exclude_MSSQL.xml b/17_18_pipe_event/exclude_MSSQL.xml index 6b5c13e..49c26b4 100644 --- a/17_18_pipe_event/exclude_MSSQL.xml +++ b/17_18_pipe_event/exclude_MSSQL.xml @@ -1,16 +1,16 @@ - - + + - \SQLLocal\MSSQLSERVER - \SQLLocal\INSTANCE01 - \SQLLocal\SQLEXPRESS - \SQLLocal\COMMVAULT - \SQLLocal\RTCLOCAL - \SQLLocal\RTC - \SQLLocal\TMSM - Program Files (x86)\Microsoft SQL Server\110\DTS\binn\dtexec.exe + \SQLLocal\MSSQLSERVER + \SQLLocal\INSTANCE01 + \SQLLocal\SQLEXPRESS + \SQLLocal\COMMVAULT + \SQLLocal\RTCLOCAL + \SQLLocal\RTC + \SQLLocal\TMSM + Program Files (x86)\Microsoft SQL Server\110\DTS\binn\dtexec.exe - - + + \ No newline at end of file diff --git a/17_18_pipe_event/exclude_azure_sentinel_agent.xml b/17_18_pipe_event/exclude_azure_sentinel_agent.xml index f1d0875..9a05855 100644 --- a/17_18_pipe_event/exclude_azure_sentinel_agent.xml +++ b/17_18_pipe_event/exclude_azure_sentinel_agent.xml @@ -1,9 +1,9 @@ - - + + - "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" + "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" - - + + diff --git a/17_18_pipe_event/exclude_citrix.xml b/17_18_pipe_event/exclude_citrix.xml index a24185f..a2334bd 100644 --- a/17_18_pipe_event/exclude_citrix.xml +++ b/17_18_pipe_event/exclude_citrix.xml @@ -1,12 +1,12 @@ - - + + - Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfService.exe - Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe - Program Files (x86)\Citrix\ICA Client\wfcrun32.exe - Program Files (x86)\Citrix\ICA Client\concentr.exe + Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfService.exe + Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe + Program Files (x86)\Citrix\ICA Client\wfcrun32.exe + Program Files (x86)\Citrix\ICA Client\concentr.exe - - + + \ No newline at end of file diff --git a/17_18_pipe_event/exclude_ibm_watson_explorer.xml b/17_18_pipe_event/exclude_ibm_watson_explorer.xml index b74c696..438f860 100644 --- a/17_18_pipe_event/exclude_ibm_watson_explorer.xml +++ b/17_18_pipe_event/exclude_ibm_watson_explorer.xml @@ -1,9 +1,9 @@ - - + + - \Vivisimo Velocity + \Vivisimo Velocity - - + + \ No newline at end of file diff --git a/17_18_pipe_event/exclude_postgres.xml b/17_18_pipe_event/exclude_postgres.xml index 4a2d380..b0089f5 100644 --- a/17_18_pipe_event/exclude_postgres.xml +++ b/17_18_pipe_event/exclude_postgres.xml @@ -1,10 +1,10 @@ - - + + - PostgreSQL\9.6\bin\postgres.exe - \pgsignal_ + PostgreSQL\9.6\bin\postgres.exe + \pgsignal_ - - + + diff --git a/17_18_pipe_event/exclude_qlik_sense.xml b/17_18_pipe_event/exclude_qlik_sense.xml index 0bc5081..c746b11 100644 --- a/17_18_pipe_event/exclude_qlik_sense.xml +++ b/17_18_pipe_event/exclude_qlik_sense.xml @@ -1,9 +1,9 @@ - - + + - Program Files\Qlik\Sense\Engine\Engine.exe + Program Files\Qlik\Sense\Engine\Engine.exe - - + + \ No newline at end of file diff --git a/17_18_pipe_event/exclude_splunk.xml b/17_18_pipe_event/exclude_splunk.xml index b45dfb5..27741fa 100644 --- a/17_18_pipe_event/exclude_splunk.xml +++ b/17_18_pipe_event/exclude_splunk.xml @@ -1,11 +1,11 @@ - - + + - Program Files\SplunkUniversalForwarder\bin\splunkd.exe - Program Files\SplunkUniversalForwarder\bin\splunk.exe - Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe + Program Files\SplunkUniversalForwarder\bin\splunkd.exe + Program Files\SplunkUniversalForwarder\bin\splunk.exe + Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe - - + + diff --git a/17_18_pipe_event/exclude_trend_micro.xml b/17_18_pipe_event/exclude_trend_micro.xml index 1c1a3d9..8e8cb49 100644 --- a/17_18_pipe_event/exclude_trend_micro.xml +++ b/17_18_pipe_event/exclude_trend_micro.xml @@ -1,24 +1,24 @@ - - + + - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\CMAgent\OfcCMAgent.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\Service\DbServer.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\verconn.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiOnClose.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiRqHotFix.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\LWCS\LWCSService.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WSS\iCRCService.exe - Program Files\Trend\SPROTECT\x64\tsc.exe - Program Files\Trend\SPROTECT\x64\tsc64.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\osceintegrationservice.exe - Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\OfcLogReceiverSvc.exe - \Trend Micro OSCE Command Handler Manager - \Trend Micro OSCE Command Handler2 Manager - \Trend Micro Endpoint Encryption ToolBox Command Handler Manager - \OfcServerNamePipe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\CMAgent\OfcCMAgent.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\Service\DbServer.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\verconn.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiOnClose.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiRqHotFix.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\LWCS\LWCSService.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WSS\iCRCService.exe + Program Files\Trend\SPROTECT\x64\tsc.exe + Program Files\Trend\SPROTECT\x64\tsc64.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\osceintegrationservice.exe + Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\OfcLogReceiverSvc.exe + \Trend Micro OSCE Command Handler Manager + \Trend Micro OSCE Command Handler2 Manager + \Trend Micro Endpoint Encryption ToolBox Command Handler Manager + \OfcServerNamePipe - - + + \ No newline at end of file diff --git a/17_18_pipe_event/exclude_windows_generic.xml b/17_18_pipe_event/exclude_windows_generic.xml index fca78b9..ca7ae53 100644 --- a/17_18_pipe_event/exclude_windows_generic.xml +++ b/17_18_pipe_event/exclude_windows_generic.xml @@ -1,16 +1,16 @@ - - + + - \ntapvsrq - \srvsvc - \wkssvc - \lsass - \winreg - \spoolss - Anonymous Pipe - c:\windows\system32\inetsrv\w3wp.exe + \ntapvsrq + \srvsvc + \wkssvc + \lsass + \winreg + \spoolss + Anonymous Pipe + c:\windows\system32\inetsrv\w3wp.exe - - + + \ No newline at end of file diff --git a/17_18_pipe_event/include_atsvc.xml b/17_18_pipe_event/include_atsvc.xml index 00594b0..be7289e 100644 --- a/17_18_pipe_event/include_atsvc.xml +++ b/17_18_pipe_event/include_atsvc.xml @@ -1,9 +1,9 @@ - - + + - \atsvc + \atsvc - - + + \ No newline at end of file diff --git a/17_18_pipe_event/include_cobaltstrike.xml b/17_18_pipe_event/include_cobaltstrike.xml index fd656be..2efbb2e 100644 --- a/17_18_pipe_event/include_cobaltstrike.xml +++ b/17_18_pipe_event/include_cobaltstrike.xml @@ -1,9 +1,9 @@ - - + + - \msagent_ + \msagent_ - - + + \ No newline at end of file diff --git a/17_18_pipe_event/include_metaspliot.xml b/17_18_pipe_event/include_metaspliot.xml index 752ab17..483c0fe 100644 --- a/17_18_pipe_event/include_metaspliot.xml +++ b/17_18_pipe_event/include_metaspliot.xml @@ -1,9 +1,9 @@ - - + + - \msf-pipe + \msf-pipe - - + + \ No newline at end of file diff --git a/17_18_pipe_event/include_psexec.xml b/17_18_pipe_event/include_psexec.xml index c12a176..ab19452 100644 --- a/17_18_pipe_event/include_psexec.xml +++ b/17_18_pipe_event/include_psexec.xml @@ -1,9 +1,9 @@ - - + + - \PSEXESVC + \PSEXESVC - - + + \ No newline at end of file diff --git a/17_18_pipe_event/include_srvsvc.xml b/17_18_pipe_event/include_srvsvc.xml index 772e57c..bbded46 100644 --- a/17_18_pipe_event/include_srvsvc.xml +++ b/17_18_pipe_event/include_srvsvc.xml @@ -1,9 +1,9 @@ - - + + - \srvsvc + \srvsvc - - + + \ No newline at end of file diff --git a/17_18_pipe_event/include_winreg.xml b/17_18_pipe_event/include_winreg.xml index 6b2140e..2c6cb1f 100644 --- a/17_18_pipe_event/include_winreg.xml +++ b/17_18_pipe_event/include_winreg.xml @@ -1,9 +1,9 @@ - - + + - \winreg + \winreg - - + + \ No newline at end of file diff --git a/19_20_21_wmi_event/include_wmi_create.xml b/19_20_21_wmi_event/include_wmi_create.xml index f67a65b..ffbd55e 100644 --- a/19_20_21_wmi_event/include_wmi_create.xml +++ b/19_20_21_wmi_event/include_wmi_create.xml @@ -1,9 +1,9 @@ - - - - Created - - - + + + + Created + + + diff --git a/1_process_creation/exclude_adobe_acrobat.xml b/1_process_creation/exclude_adobe_acrobat.xml index 6217ca9..8269971 100644 --- a/1_process_creation/exclude_adobe_acrobat.xml +++ b/1_process_creation/exclude_adobe_acrobat.xml @@ -1,18 +1,18 @@ - + - - AcroRd32.exe - /CR;channel= - - - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + + AcroRd32.exe + /CR;channel= - - - + + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + + + + diff --git a/1_process_creation/exclude_adobe_creative_cloud.xml b/1_process_creation/exclude_adobe_creative_cloud.xml index b738e74..b694840 100644 --- a/1_process_creation/exclude_adobe_creative_cloud.xml +++ b/1_process_creation/exclude_adobe_creative_cloud.xml @@ -1,12 +1,12 @@ - - - - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe + + + + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe - - + + diff --git a/1_process_creation/exclude_adobe_flash.xml b/1_process_creation/exclude_adobe_flash.xml index 7060323..920a412 100644 --- a/1_process_creation/exclude_adobe_flash.xml +++ b/1_process_creation/exclude_adobe_flash.xml @@ -1,9 +1,9 @@ - - + + - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - - - + C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + + + \ No newline at end of file diff --git a/1_process_creation/exclude_adobe_supporting_processes.xml b/1_process_creation/exclude_adobe_supporting_processes.xml index f5a761b..e469605 100644 --- a/1_process_creation/exclude_adobe_supporting_processes.xml +++ b/1_process_creation/exclude_adobe_supporting_processes.xml @@ -1,19 +1,19 @@ - - - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + + + + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe + C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_azure_sentinel_agent.xml b/1_process_creation/exclude_azure_sentinel_agent.xml index 18dee56..5cdd826 100644 --- a/1_process_creation/exclude_azure_sentinel_agent.xml +++ b/1_process_creation/exclude_azure_sentinel_agent.xml @@ -1,13 +1,13 @@ - - - - "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -Embedding - - "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" - C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs - - - + + + + "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -Embedding + + "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" + C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs + + + \ No newline at end of file diff --git a/1_process_creation/exclude_cisco_anyconnect.xml b/1_process_creation/exclude_cisco_anyconnect.xml index da41a79..4cfc07e 100644 --- a/1_process_creation/exclude_cisco_anyconnect.xml +++ b/1_process_creation/exclude_cisco_anyconnect.xml @@ -1,9 +1,9 @@ - - + + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe - - - + + + diff --git a/1_process_creation/exclude_dotnet-3-or-4.xml b/1_process_creation/exclude_dotnet-3-or-4.xml index fbbc807..b849b0c 100644 --- a/1_process_creation/exclude_dotnet-3-or-4.xml +++ b/1_process_creation/exclude_dotnet-3-or-4.xml @@ -1,19 +1,19 @@ - - - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + + + + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_drivers.xml b/1_process_creation/exclude_drivers.xml index 469bbb2..190ce9b 100644 --- a/1_process_creation/exclude_drivers.xml +++ b/1_process_creation/exclude_drivers.xml @@ -1,11 +1,11 @@ - - - - C:\Program Files\NVIDIA Corporation\ - C:\Program Files\Realtek\ - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe + + + + C:\Program Files\NVIDIA Corporation\ + C:\Program Files\Realtek\ + C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_dropbox.xml b/1_process_creation/exclude_dropbox.xml index baeab1b..6538436 100644 --- a/1_process_creation/exclude_dropbox.xml +++ b/1_process_creation/exclude_dropbox.xml @@ -1,10 +1,10 @@ - - - - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + + + + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_eset.xml b/1_process_creation/exclude_eset.xml index 34bb966..dca4b0a 100644 --- a/1_process_creation/exclude_eset.xml +++ b/1_process_creation/exclude_eset.xml @@ -1,9 +1,9 @@ - - + + - C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe - - - + C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe + + + diff --git a/1_process_creation/exclude_google_chrome.xml b/1_process_creation/exclude_google_chrome.xml index 41206a3..eb991e8 100644 --- a/1_process_creation/exclude_google_chrome.xml +++ b/1_process_creation/exclude_google_chrome.xml @@ -1,12 +1,12 @@ - - - - "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= - "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= - C:\Program Files (x86)\Google\Update\ - C:\Program Files (x86)\Google\Update\ + + + + "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= + "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= + C:\Program Files (x86)\Google\Update\ + C:\Program Files (x86)\Google\Update\ - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_ivanti_res.xml b/1_process_creation/exclude_ivanti_res.xml index cf196b2..ff59291 100644 --- a/1_process_creation/exclude_ivanti_res.xml +++ b/1_process_creation/exclude_ivanti_res.xml @@ -1,14 +1,14 @@ - - - - C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe - C:\Program Files (x86)\RES Software\Workspace Manager\respesvc64.exe - C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe - C:\Program Files (x86)\RES Software\Workspace Manager\ResPesvc64.exe - C:\Program Files\RES Software\Workspace Manager\respesvc.exe - C:\Program Files\Ivanti\Workspace Control\ResPesvc.exe + + + + C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe + C:\Program Files (x86)\RES Software\Workspace Manager\respesvc64.exe + C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe + C:\Program Files (x86)\RES Software\Workspace Manager\ResPesvc64.exe + C:\Program Files\RES Software\Workspace Manager\respesvc.exe + C:\Program Files\Ivanti\Workspace Control\ResPesvc.exe - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_malwarebytes.xml b/1_process_creation/exclude_malwarebytes.xml index a04e340..2fbbd28 100644 --- a/1_process_creation/exclude_malwarebytes.xml +++ b/1_process_creation/exclude_malwarebytes.xml @@ -1,11 +1,11 @@ - - + + - C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe - C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe - - - + C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe + C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe + C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe + + + diff --git a/1_process_creation/exclude_microsoft_office_click2run.xml b/1_process_creation/exclude_microsoft_office_click2run.xml index b9a66ac..ff4b623 100644 --- a/1_process_creation/exclude_microsoft_office_click2run.xml +++ b/1_process_creation/exclude_microsoft_office_click2run.xml @@ -1,11 +1,11 @@ - - - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + + + + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_microsoft_office_services.xml b/1_process_creation/exclude_microsoft_office_services.xml index be6e5a8..2b8b353 100644 --- a/1_process_creation/exclude_microsoft_office_services.xml +++ b/1_process_creation/exclude_microsoft_office_services.xml @@ -1,10 +1,10 @@ - - - - C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE + + + + C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_mozilla_firefox.xml b/1_process_creation/exclude_mozilla_firefox.xml index 1240ba2..5c5de26 100644 --- a/1_process_creation/exclude_mozilla_firefox.xml +++ b/1_process_creation/exclude_mozilla_firefox.xml @@ -1,10 +1,10 @@ - - - - "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel - "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel + + + + "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel + "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_sophos.xml b/1_process_creation/exclude_sophos.xml index a44d53c..8968efd 100644 --- a/1_process_creation/exclude_sophos.xml +++ b/1_process_creation/exclude_sophos.xml @@ -1,15 +1,15 @@ - - + + - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe - C:\Program Files (x86)\Sophos\Sophos System Protection\ssp.exe - C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe - C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe - C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe - - - + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe + C:\Program Files (x86)\Sophos\Sophos System Protection\ssp.exe + C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe + C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe + C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe + + + diff --git a/1_process_creation/exclude_splunk.xml b/1_process_creation/exclude_splunk.xml index f027328..44cb926 100644 --- a/1_process_creation/exclude_splunk.xml +++ b/1_process_creation/exclude_splunk.xml @@ -1,14 +1,14 @@ - - - - C:\Program Files\Splunk\bin\ - C:\Program Files\Splunk\bin\splunkd.exe - C:\Program Files\Splunk\bin\splunk.exe - D:\Program Files\Splunk\bin\ - D:\Program Files\Splunk\bin\splunkd.exe - D:\Program Files\Splunk\bin\splunk.exe + + + + C:\Program Files\Splunk\bin\ + C:\Program Files\Splunk\bin\splunkd.exe + C:\Program Files\Splunk\bin\splunk.exe + D:\Program Files\Splunk\bin\ + D:\Program Files\Splunk\bin\splunkd.exe + D:\Program Files\Splunk\bin\splunk.exe - - + + \ No newline at end of file diff --git a/1_process_creation/exclude_splunk_universal_forwarder.xml b/1_process_creation/exclude_splunk_universal_forwarder.xml index bd3c21f..58c1853 100644 --- a/1_process_creation/exclude_splunk_universal_forwarder.xml +++ b/1_process_creation/exclude_splunk_universal_forwarder.xml @@ -1,14 +1,14 @@ - - - - C:\Program Files\SplunkUniversalForwarder\bin\ - C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - D:\Program Files\SplunkUniversalForwarder\bin\ - D:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe - D:\Program Files\SplunkUniversalForwarder\bin\splunk.exe + + + + C:\Program Files\SplunkUniversalForwarder\bin\ + C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe + C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe + D:\Program Files\SplunkUniversalForwarder\bin\ + D:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe + D:\Program Files\SplunkUniversalForwarder\bin\splunk.exe - - + + diff --git a/1_process_creation/exclude_svchost.xml b/1_process_creation/exclude_svchost.xml index e6ac01b..9e87224 100644 --- a/1_process_creation/exclude_svchost.xml +++ b/1_process_creation/exclude_svchost.xml @@ -1,74 +1,74 @@ - - - - - C:\Windows\system32\svchost.exe -k appmodel -s StateRepository - C:\Windows\system32\svchost.exe -k appmodel - C:\WINDOWS\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc - C:\Windows\system32\svchost.exe -k camera -s FrameServer - C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM - C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay - C:\Windows\system32\svchost.exe -k defragsvc - C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc - C:\Windows\system32\svchost.exe -k imgsvc - C:\Windows\system32\svchost.exe -k localService -s EventSystem - C:\Windows\system32\svchost.exe -k localService -s bthserv - C:\Windows\system32\svchost.exe -k localService -s nsi - C:\Windows\system32\svchost.exe -k localService -s w32Time - C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc - C:\Windows\system32\svchost.exe -k localServiceNoNetwork - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost - C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted - C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc - C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc - C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC - C:\Windows\system32\svchost.exe -k netsvcs -s BITS - C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc - C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc - C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc - C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc - C:\Windows\system32\svchost.exe -k netsvcs -s SENS - C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv - C:\Windows\system32\svchost.exe -k netsvcs -s Themes - C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt - C:\Windows\system32\svchost.exe -k netsvcs - C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc - C:\Windows\system32\svchost.exe -k networkService -s Dnscache - C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation - C:\Windows\system32\svchost.exe -k networkService -s NlaSvc - C:\Windows\system32\svchost.exe -k networkService -s TermService - C:\Windows\system32\svchost.exe -k networkService - C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k rPCSS - C:\Windows\system32\svchost.exe -k secsvcs - C:\Windows\system32\svchost.exe -k swprv - C:\Windows\system32\svchost.exe -k unistackSvcGroup - C:\Windows\system32\svchost.exe -k utcsvc - C:\Windows\system32\svchost.exe -k wbioSvcGroup - C:\Windows\system32\svchost.exe -k werSvcGroup - C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC - C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc - C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC - C:\Windows\system32\svchost.exe -k wsappx - C:\Windows\system32\svchost.exe -k netsvcs - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + + + + + C:\Windows\system32\svchost.exe -k appmodel -s StateRepository + C:\Windows\system32\svchost.exe -k appmodel + C:\WINDOWS\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc + C:\Windows\system32\svchost.exe -k camera -s FrameServer + C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM + C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay + C:\Windows\system32\svchost.exe -k defragsvc + C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc + C:\Windows\system32\svchost.exe -k imgsvc + C:\Windows\system32\svchost.exe -k localService -s EventSystem + C:\Windows\system32\svchost.exe -k localService -s bthserv + C:\Windows\system32\svchost.exe -k localService -s nsi + C:\Windows\system32\svchost.exe -k localService -s w32Time + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc + C:\Windows\system32\svchost.exe -k localServiceNoNetwork + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost + C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc + C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc + C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC + C:\Windows\system32\svchost.exe -k netsvcs -s BITS + C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc + C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc + C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc + C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc + C:\Windows\system32\svchost.exe -k netsvcs -s SENS + C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv + C:\Windows\system32\svchost.exe -k netsvcs -s Themes + C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc + C:\Windows\system32\svchost.exe -k networkService -s Dnscache + C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation + C:\Windows\system32\svchost.exe -k networkService -s NlaSvc + C:\Windows\system32\svchost.exe -k networkService -s TermService + C:\Windows\system32\svchost.exe -k networkService + C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k rPCSS + C:\Windows\system32\svchost.exe -k secsvcs + C:\Windows\system32\svchost.exe -k swprv + C:\Windows\system32\svchost.exe -k unistackSvcGroup + C:\Windows\system32\svchost.exe -k utcsvc + C:\Windows\system32\svchost.exe -k wbioSvcGroup + C:\Windows\system32\svchost.exe -k werSvcGroup + C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC + C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc + C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC + C:\Windows\system32\svchost.exe -k wsappx + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted - - + + diff --git a/1_process_creation/exclude_trend_micro.xml b/1_process_creation/exclude_trend_micro.xml index a9ec730..12a0ec5 100644 --- a/1_process_creation/exclude_trend_micro.xml +++ b/1_process_creation/exclude_trend_micro.xml @@ -1,17 +1,17 @@ - - + + - C:\Program Files\Trend Micro\Deep Security Agent\ds_monitor.exe - C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe - C:\Program Files\Trend Micro\Deep Security Agent\dsuam.exe - C:\Program Files\Trend Micro\Deep Security Agent\Notifier.exe - C:\Program Files\Trend Micro\Deep Security Agent\lib\Patch.exe - C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe - C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmopExtIns32.exe - C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmExtIns.exe - C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmListen.exe - - - + C:\Program Files\Trend Micro\Deep Security Agent\ds_monitor.exe + C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe + C:\Program Files\Trend Micro\Deep Security Agent\dsuam.exe + C:\Program Files\Trend Micro\Deep Security Agent\Notifier.exe + C:\Program Files\Trend Micro\Deep Security Agent\lib\Patch.exe + C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe + C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmopExtIns32.exe + C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmExtIns.exe + C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmListen.exe + + + diff --git a/1_process_creation/exclude_windows_defender.xml b/1_process_creation/exclude_windows_defender.xml index 0e28938..9187d6d 100644 --- a/1_process_creation/exclude_windows_defender.xml +++ b/1_process_creation/exclude_windows_defender.xml @@ -1,12 +1,12 @@ - - + + - C:\Program Files\Windows Defender\ - C:\Windows\system32\MpSigStub.exe - C:\Windows\SoftwareDistribution\Download\Install\AM_ + C:\Program Files\Windows Defender\ + C:\Windows\system32\MpSigStub.exe + C:\Windows\SoftwareDistribution\Download\Install\AM_ C:\Program Files\Microsoft Security Client\MpCmdRun.exe - - - + + + diff --git a/1_process_creation/exclude_windows_generic_processes.xml b/1_process_creation/exclude_windows_generic_processes.xml index 9ec3e66..151d998 100644 --- a/1_process_creation/exclude_windows_generic_processes.xml +++ b/1_process_creation/exclude_windows_generic_processes.xml @@ -1,24 +1,24 @@ - - - - - C:\Windows\system32\DllHost.exe /Processid - C:\Windows\system32\SearchIndexer.exe /Embedding - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\MusNotification.exe - C:\Windows\System32\MusNotificationUx.exe - C:\Windows\System32\audiodg.exe - C:\Windows\System32\conhost.exe - C:\Windows\System32\powercfg.exe - C:\Windows\System32\wbem\WmiApSrv.exe - C:\Windows\System32\wermgr.exe - C:\Windows\SysWOW64\wermgr.exe - C:\Windows\system32\sppsvc.exe - AppContainer - %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows - C:\Windows\system32\SearchIndexer.exe + + + + + C:\Windows\system32\DllHost.exe /Processid + C:\Windows\system32\SearchIndexer.exe /Embedding + C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\MusNotification.exe + C:\Windows\System32\MusNotificationUx.exe + C:\Windows\System32\audiodg.exe + C:\Windows\System32\conhost.exe + C:\Windows\System32\powercfg.exe + C:\Windows\System32\wbem\WmiApSrv.exe + C:\Windows\System32\wermgr.exe + C:\Windows\SysWOW64\wermgr.exe + C:\Windows\system32\sppsvc.exe + AppContainer + %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows + C:\Windows\system32\SearchIndexer.exe - - + + \ No newline at end of file diff --git a/1_process_creation/include_accessibility_features.xml b/1_process_creation/include_accessibility_features.xml index b2c0635..624766a 100644 --- a/1_process_creation/include_accessibility_features.xml +++ b/1_process_creation/include_accessibility_features.xml @@ -1,15 +1,15 @@ - - + + - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe - - + + diff --git a/1_process_creation/include_appc_shim.xml b/1_process_creation/include_appc_shim.xml index f037236..0bb2305 100644 --- a/1_process_creation/include_appc_shim.xml +++ b/1_process_creation/include_appc_shim.xml @@ -1,9 +1,9 @@ - - + + - sdbinst.exe + sdbinst.exe - - + + diff --git a/1_process_creation/include_bitsadmin.xml b/1_process_creation/include_bitsadmin.xml index 415cc33..4cb80a9 100644 --- a/1_process_creation/include_bitsadmin.xml +++ b/1_process_creation/include_bitsadmin.xml @@ -1,9 +1,9 @@ - - + + - bitsadmin.exe + bitsadmin.exe - - + + diff --git a/1_process_creation/include_bypass_uac.xml b/1_process_creation/include_bypass_uac.xml index 0c2b3c5..02b8aea 100644 --- a/1_process_creation/include_bypass_uac.xml +++ b/1_process_creation/include_bypass_uac.xml @@ -1,13 +1,13 @@ - - + + - eventvwr.exe + eventvwr.exe c:\windows\system32\mmc.exe - fodhelper.exe + fodhelper.exe - - + + diff --git a/1_process_creation/include_dosfuscation.xml b/1_process_creation/include_dosfuscation.xml index 9b24d73..8b881a1 100644 --- a/1_process_creation/include_dosfuscation.xml +++ b/1_process_creation/include_dosfuscation.xml @@ -1,10 +1,10 @@ - - + + - ^ - ../../ + ^ + ../../ - - + + diff --git a/1_process_creation/include_explorer.xml b/1_process_creation/include_explorer.xml index c1ebbeb..cee793e 100644 --- a/1_process_creation/include_explorer.xml +++ b/1_process_creation/include_explorer.xml @@ -1,9 +1,9 @@ - - + + C:\Windows\explorer.exe - - + + \ No newline at end of file diff --git a/1_process_creation/include_fltmc.xml b/1_process_creation/include_fltmc.xml index 6f30eac..fe51c08 100644 --- a/1_process_creation/include_fltmc.xml +++ b/1_process_creation/include_fltmc.xml @@ -1,6 +1,6 @@ - - + + fltMC.exe @@ -11,6 +11,6 @@ misc::mflt - - + + diff --git a/1_process_creation/include_installutil.xml b/1_process_creation/include_installutil.xml index 810efd4..7810e62 100644 --- a/1_process_creation/include_installutil.xml +++ b/1_process_creation/include_installutil.xml @@ -1,12 +1,12 @@ - - + + InstallUtil.exe /logfile=;/LogToConsole=false;/U - - + + diff --git a/1_process_creation/include_living_of_the_land.xml b/1_process_creation/include_living_of_the_land.xml index cb30004..04f68dd 100644 --- a/1_process_creation/include_living_of_the_land.xml +++ b/1_process_creation/include_living_of_the_land.xml @@ -1,121 +1,121 @@ - - + + - - whoami.exe - ipconfig.exe - tasklist.exe - taskmgr.exe - systeminfo.exe;sysinfo.exe - netstat.exe - qprocess.exe - nslookup.exe - net.exe;net1.exe - quser.exe - query.exe - tracert.exe - tree.com - route.exe - runas.exe - reg.exe - regedit.exe - taskkill.exe - netsh.exe - klist.exe - wevtutil.exe - taskeng.exe - regsvr32.exe - wmiprvse.exe - wmiprvse.exe - hh.exe - cmd.exe - cmd.exe - powershell.exe - powershell.exe - powershell_ise.exe - bash.exe - odbcconf.exe - pcalua.exe - cscript.exe - wscript.exe - pcalua.exe - cscript.exe - wscript.exe - mshta.exe - control.exe - mshta.exe - attrib.exe - cmdkey.exe - nbtstat.exe;nbtinfo.exe - qwinsta.exe - rwinsta.exe - schtasks.exe;sctasks.exe - replace.exe - jjs.exe - appcmd.exe - sc.exe - certutil.exe - desktopimgdownldr.exe - findstr.exe - where.exe - forfiles.exe - icacls.exe;cacls.exe - xcopy.exe - robocopy.exe - takeown.exe - makecab.exe - wusa.exe - vassadmin.exe - nltest.exe;nltestk.exe - winrs.exe - computerdefaults.exe - dism.exe - fodhelper.exe - djoin.exe - PktMon.exe - mofcomp.exe - C:\WINDOWS\system32\wbem\scrcons.exe - ScrCons - - esentutl.exe - /y;/vss/d - - - nltestrk.exe - /domain_trusts - - ATBroker.exe - csc.exe - dfsvc.exe - dnscmd.exe - esentutl.exe - expand - extexport.exe - extrac32.exe - IEExec.exe - ilasm.exe - InfDefaultInstall.EXE - jsc.exe - vbc.exe - Microsoft.Workflow.Compiler.exe - msconfig.EXE - Msdt.exe - msiexec.exe - odbcconf.exe - PresentationHost.exe - Print.Exe - rasdlui.exe - RegisterCimProvider2.exe - RegisterCimProvider.exe - RpcPing.exe - ScriptRunner.exe - TTTracer.exe - verclsid.exe - wab.exe - WSReset.exe - xwizard.exe - - - + + whoami.exe + ipconfig.exe + tasklist.exe + taskmgr.exe + systeminfo.exe;sysinfo.exe + netstat.exe + qprocess.exe + nslookup.exe + net.exe;net1.exe + quser.exe + query.exe + tracert.exe + tree.com + route.exe + runas.exe + reg.exe + regedit.exe + taskkill.exe + netsh.exe + klist.exe + wevtutil.exe + taskeng.exe + regsvr32.exe + wmiprvse.exe + wmiprvse.exe + hh.exe + cmd.exe + cmd.exe + powershell.exe + powershell.exe + powershell_ise.exe + bash.exe + odbcconf.exe + pcalua.exe + cscript.exe + wscript.exe + pcalua.exe + cscript.exe + wscript.exe + mshta.exe + control.exe + mshta.exe + attrib.exe + cmdkey.exe + nbtstat.exe;nbtinfo.exe + qwinsta.exe + rwinsta.exe + schtasks.exe;sctasks.exe + replace.exe + jjs.exe + appcmd.exe + sc.exe + certutil.exe + desktopimgdownldr.exe + findstr.exe + where.exe + forfiles.exe + icacls.exe;cacls.exe + xcopy.exe + robocopy.exe + takeown.exe + makecab.exe + wusa.exe + vassadmin.exe + nltest.exe;nltestk.exe + winrs.exe + computerdefaults.exe + dism.exe + fodhelper.exe + djoin.exe + PktMon.exe + mofcomp.exe + C:\WINDOWS\system32\wbem\scrcons.exe + ScrCons + + esentutl.exe + /y;/vss/d + + + nltestrk.exe + /domain_trusts + + ATBroker.exe + csc.exe + dfsvc.exe + dnscmd.exe + esentutl.exe + expand + extexport.exe + extrac32.exe + IEExec.exe + ilasm.exe + InfDefaultInstall.EXE + jsc.exe + vbc.exe + Microsoft.Workflow.Compiler.exe + msconfig.EXE + Msdt.exe + msiexec.exe + odbcconf.exe + PresentationHost.exe + Print.Exe + rasdlui.exe + RegisterCimProvider2.exe + RegisterCimProvider.exe + RpcPing.exe + ScriptRunner.exe + TTTracer.exe + verclsid.exe + wab.exe + WSReset.exe + xwizard.exe + + + diff --git a/1_process_creation/include_mavinject.xml b/1_process_creation/include_mavinject.xml index 39d460c..4870de2 100644 --- a/1_process_creation/include_mavinject.xml +++ b/1_process_creation/include_mavinject.xml @@ -1,12 +1,12 @@ - - + + - Mavinject.exe;mavinject64.exe - /INJECTRUNNING - + Mavinject.exe;mavinject64.exe + /INJECTRUNNING + - - + + diff --git a/1_process_creation/include_microsoft_cmstp.xml b/1_process_creation/include_microsoft_cmstp.xml index 32d883d..71c17b8 100644 --- a/1_process_creation/include_microsoft_cmstp.xml +++ b/1_process_creation/include_microsoft_cmstp.xml @@ -1,12 +1,12 @@ - - + + - CMSTP.exe + CMSTP.exe /ni;/s - - + + diff --git a/1_process_creation/include_msbuild.xml b/1_process_creation/include_msbuild.xml index 55ed8c6..fe64f25 100644 --- a/1_process_creation/include_msbuild.xml +++ b/1_process_creation/include_msbuild.xml @@ -1,9 +1,9 @@ - - + + - MSBuild.exe + MSBuild.exe - - + + diff --git a/1_process_creation/include_msoffice.xml b/1_process_creation/include_msoffice.xml index aed65c5..7944c0e 100644 --- a/1_process_creation/include_msoffice.xml +++ b/1_process_creation/include_msoffice.xml @@ -1,14 +1,14 @@ - - - - excel.exe - winword.exe - powerpnt.exe - outlook.exe - msaccess.exe - mspub.exe - - - + + + + excel.exe + winword.exe + powerpnt.exe + outlook.exe + msaccess.exe + mspub.exe + + + diff --git a/1_process_creation/include_regsvcs_regasm.xml b/1_process_creation/include_regsvcs_regasm.xml index e89442f..edc66c4 100644 --- a/1_process_creation/include_regsvcs_regasm.xml +++ b/1_process_creation/include_regsvcs_regasm.xml @@ -1,9 +1,9 @@ - - + + - regsvcs.exe;regasm.exe + regsvcs.exe;regasm.exe - - + + diff --git a/1_process_creation/include_syncappvpublishingserver.xml b/1_process_creation/include_syncappvpublishingserver.xml index 334c842..bd43d29 100644 --- a/1_process_creation/include_syncappvpublishingserver.xml +++ b/1_process_creation/include_syncappvpublishingserver.xml @@ -1,9 +1,9 @@ - - + + - SyncAppvPublishingServer.exe + SyncAppvPublishingServer.exe - - + + diff --git a/1_process_creation/include_sysinternals.xml b/1_process_creation/include_sysinternals.xml index 3da035a..a2e672a 100644 --- a/1_process_creation/include_sysinternals.xml +++ b/1_process_creation/include_sysinternals.xml @@ -1,32 +1,32 @@ - - + + - PsList.exe + PsList.exe PsService.exe PsExec.exe - PsExec.c + PsExec.c PsGetSID.exe PsKill.exe - PKill.exe - ProcDump + PKill.exe + ProcDump PsLoggedOn.exe PsFile.exe - ShellRunas + ShellRunas PipeList.exe AccessChk.exe AccessEnum.exe LogonSessions.exe PsLogList.exe PsInfo.exe - LoadOrd + LoadOrd PsPasswd.exe ru.exe Regsize - ProcDump - -ma lsass.exe + ProcDump + -ma lsass.exe - - + + diff --git a/1_process_creation/include_system_recovery.xml b/1_process_creation/include_system_recovery.xml index 1cb4b61..0bc1e15 100644 --- a/1_process_creation/include_system_recovery.xml +++ b/1_process_creation/include_system_recovery.xml @@ -1,6 +1,6 @@ - - + + vssadmin.exe @@ -17,7 +17,7 @@ wbadmin.exe delete;catalog - + bcdedit.exe recoveryenabled;no diff --git a/1_process_creation/include_uncommon_locations.xml b/1_process_creation/include_uncommon_locations.xml index 9f39ff1..8323b38 100644 --- a/1_process_creation/include_uncommon_locations.xml +++ b/1_process_creation/include_uncommon_locations.xml @@ -1,27 +1,27 @@ - - + + - C:\PerfLogs\ - C:\$Recycle.bin\ - C:\Intel\Logs\ - C:\Users\Default\ - C:\Users\Public\ - C:\Users\NetworkService\ - C:\Windows\Fonts\ - C:\Windows\Debug\ - C:\Windows\Media\ - C:\Windows\Help\ - C:\Windows\addins\ - C:\Windows\repair\ - C:\Windows\security\ - C:\Windows\system32\config\systemprofile\ - VolumeShadowCopy - \htdocs\ - \wwwroot\ - \Temp\ - \Appdata\Local\ + C:\PerfLogs\ + C:\$Recycle.bin\ + C:\Intel\Logs\ + C:\Users\Default\ + C:\Users\Public\ + C:\Users\NetworkService\ + C:\Windows\Fonts\ + C:\Windows\Debug\ + C:\Windows\Media\ + C:\Windows\Help\ + C:\Windows\addins\ + C:\Windows\repair\ + C:\Windows\security\ + C:\Windows\system32\config\systemprofile\ + VolumeShadowCopy + \htdocs\ + \wwwroot\ + \Temp\ + \Appdata\Local\ - - + + diff --git a/1_process_creation/include_windows_control_panel.xml b/1_process_creation/include_windows_control_panel.xml index 61359e5..6d53a1e 100644 --- a/1_process_creation/include_windows_control_panel.xml +++ b/1_process_creation/include_windows_control_panel.xml @@ -1,12 +1,12 @@ - - + + control;/name rundll32.exe;shell32.dll;Control_RunDLL - - + + diff --git a/1_process_creation/include_windows_defender_tampering.xml b/1_process_creation/include_windows_defender_tampering.xml index 921f221..bb9b52f 100644 --- a/1_process_creation/include_windows_defender_tampering.xml +++ b/1_process_creation/include_windows_defender_tampering.xml @@ -1,12 +1,12 @@ - - + + - MpCmdRun.exe - Add-MpPreference;RemoveDefinitions;DisableIOAVProtection - + MpCmdRun.exe + Add-MpPreference;RemoveDefinitions;DisableIOAVProtection + - - + + diff --git a/1_process_creation/include_windows_remote_management.xml b/1_process_creation/include_windows_remote_management.xml index 52bc25a..9b228cb 100644 --- a/1_process_creation/include_windows_remote_management.xml +++ b/1_process_creation/include_windows_remote_management.xml @@ -1,10 +1,10 @@ - + - wsmprovhost.exe - winrshost.exe - winrm.cmd + wsmprovhost.exe + winrshost.exe + winrm.cmd diff --git a/22_dns_query/exclude_ads.xml b/22_dns_query/exclude_ads.xml index 65c7066..0aa4205 100644 --- a/22_dns_query/exclude_ads.xml +++ b/22_dns_query/exclude_ads.xml @@ -1,104 +1,104 @@ - - - - - .1rx.io - .2mdn.net - .adadvisor.net - .adap.tv - .addthis.com - .adform.net - .adnxs.com - .adroll.com - .adrta.com - .adsafeprotected.com - .adsrvr.org - .advertising.com - .amazon-adsystem.com - .amazon-adsystem.com - .analytics.yahoo.com - .aol.com - .betrad.com - .bidswitch.net - .casalemedia.com - .chartbeat.net - .cnn.com - .convertro.com - .criteo.com - .criteo.net - .crwdcntrl.net - .demdex.net - .domdex.com - .dotomi.com - .doubleclick.net - .doubleverify.com - .emxdgt.com - .exelator.com - .google-analytics.com - .googleadservices.com - .googlesyndication.com - .googletagmanager.com - .googlevideo.com - .gstatic.com - .gvt1.com - .gvt2.com - .ib-ibi.com - .jivox.com - .mathtag.com - .moatads.com - .moatpixel.com - .mookie1.com - .myvisualiq.net - .netmng.com - .nexac.com - .openx.net - .optimizely.com - .outbrain.com - .pardot.com - .phx.gbl - .pinterest.com - .pubmatic.com - .quantcount.com - .quantserve.com - .revsci.net - .rfihub.net - .rlcdn.com - .rubiconproject.com - .scdn.co - .scorecardresearch.com - .serving-sys.com - .sharethrough.com - .simpli.fi - .sitescout.com - .smartadserver.com - .snapads.com - .spotxchange.com - .taboola.com - .taboola.map.fastly.net - .tapad.com - .tidaltv.com - .trafficmanager.net - .tremorhub.com - .tribalfusion.com - .turn.com - .twimg.com - .tynt.com - .w55c.net - .ytimg.com - .zorosrv.com - 1rx.io - adservice.google.com - ampcid.google.com - clientservices.googleapis.com - googleadapis.l.google.com - imasdk.googleapis.com - l.google.com - ml314.com - mtalk.google.com - update.googleapis.com - www.googletagservices.com - - - + + + + + .1rx.io + .2mdn.net + .adadvisor.net + .adap.tv + .addthis.com + .adform.net + .adnxs.com + .adroll.com + .adrta.com + .adsafeprotected.com + .adsrvr.org + .advertising.com + .amazon-adsystem.com + .amazon-adsystem.com + .analytics.yahoo.com + .aol.com + .betrad.com + .bidswitch.net + .casalemedia.com + .chartbeat.net + .cnn.com + .convertro.com + .criteo.com + .criteo.net + .crwdcntrl.net + .demdex.net + .domdex.com + .dotomi.com + .doubleclick.net + .doubleverify.com + .emxdgt.com + .exelator.com + .google-analytics.com + .googleadservices.com + .googlesyndication.com + .googletagmanager.com + .googlevideo.com + .gstatic.com + .gvt1.com + .gvt2.com + .ib-ibi.com + .jivox.com + .mathtag.com + .moatads.com + .moatpixel.com + .mookie1.com + .myvisualiq.net + .netmng.com + .nexac.com + .openx.net + .optimizely.com + .outbrain.com + .pardot.com + .phx.gbl + .pinterest.com + .pubmatic.com + .quantcount.com + .quantserve.com + .revsci.net + .rfihub.net + .rlcdn.com + .rubiconproject.com + .scdn.co + .scorecardresearch.com + .serving-sys.com + .sharethrough.com + .simpli.fi + .sitescout.com + .smartadserver.com + .snapads.com + .spotxchange.com + .taboola.com + .taboola.map.fastly.net + .tapad.com + .tidaltv.com + .trafficmanager.net + .tremorhub.com + .tribalfusion.com + .turn.com + .twimg.com + .tynt.com + .w55c.net + .ytimg.com + .zorosrv.com + 1rx.io + adservice.google.com + ampcid.google.com + clientservices.googleapis.com + googleadapis.l.google.com + imasdk.googleapis.com + l.google.com + ml314.com + mtalk.google.com + update.googleapis.com + www.googletagservices.com + + + diff --git a/22_dns_query/exclude_browser_updates.xml b/22_dns_query/exclude_browser_updates.xml index dfc4aee..864a046 100644 --- a/22_dns_query/exclude_browser_updates.xml +++ b/22_dns_query/exclude_browser_updates.xml @@ -1,20 +1,20 @@ - - - - - .mozaws.net - .mozilla.com - .mozilla.net - .mozilla.org - clients1.google.com - clients2.google.com - clients3.google.com - clients4.google.com - clients5.google.com - clients6.google.com - safebrowsing.googleapis.com - - - + + + + + .mozaws.net + .mozilla.com + .mozilla.net + .mozilla.org + clients1.google.com + clients2.google.com + clients3.google.com + clients4.google.com + clients5.google.com + clients6.google.com + safebrowsing.googleapis.com + + + diff --git a/22_dns_query/exclude_cdn_networks.xml b/22_dns_query/exclude_cdn_networks.xml index 56d8a2a..1ca4946 100644 --- a/22_dns_query/exclude_cdn_networks.xml +++ b/22_dns_query/exclude_cdn_networks.xml @@ -1,19 +1,19 @@ - - - - - .akadns.net - .netflix.com - .aspnetcdn.com - ajax.googleapis.com - cdnjs.cloudflare.com - fonts.googleapis.com - .typekit.net - cdnjs.cloudflare.com - .stackassets.com - .steamcontent.com - - - + + + + + .akadns.net + .netflix.com + .aspnetcdn.com + ajax.googleapis.com + cdnjs.cloudflare.com + fonts.googleapis.com + .typekit.net + cdnjs.cloudflare.com + .stackassets.com + .steamcontent.com + + + diff --git a/22_dns_query/exclude_local_machine.xml b/22_dns_query/exclude_local_machine.xml index 8b6e6c8..7e89446 100644 --- a/22_dns_query/exclude_local_machine.xml +++ b/22_dns_query/exclude_local_machine.xml @@ -1,14 +1,14 @@ - - - + + + - .arpa. - .arpa - .msftncsi.com - .localmachine - localhost + .arpa. + .arpa + .msftncsi.com + .localmachine + localhost - - + + diff --git a/22_dns_query/exclude_logitech.xml b/22_dns_query/exclude_logitech.xml index eedda08..224164c 100644 --- a/22_dns_query/exclude_logitech.xml +++ b/22_dns_query/exclude_logitech.xml @@ -1,12 +1,12 @@ - + - C:\ProgramData\LogiShrd\LogiOptions\Software\Current\updater.exe - .logitech.com - + C:\ProgramData\LogiShrd\LogiOptions\Software\Current\updater.exe + .logitech.com + - - + + diff --git a/22_dns_query/exclude_microsoft_defender_atp.xml b/22_dns_query/exclude_microsoft_defender_atp.xml index ef18d6c..4e776f0 100644 --- a/22_dns_query/exclude_microsoft_defender_atp.xml +++ b/22_dns_query/exclude_microsoft_defender_atp.xml @@ -1,9 +1,9 @@ - - - C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe - - - + + + C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe + + + diff --git a/22_dns_query/exclude_microsoft_domains.xml b/22_dns_query/exclude_microsoft_domains.xml index 67dba64..1f74cbf 100644 --- a/22_dns_query/exclude_microsoft_domains.xml +++ b/22_dns_query/exclude_microsoft_domains.xml @@ -1,30 +1,30 @@ - - - - - -pushp.svc.ms - .b-msedge.net - .bing.com - .hotmail.com - .live.com - .live.net - .s-microsoft.com - .microsoft.com - .microsoftonline.com - .microsoftstore.com - .ms-acdc.office.com - .msedge.net - .msn.com - .msocdn.com - .skype.com - .skype.net - .windows.com - .windows.net.nsatc.net - .windowsupdate.com - .xboxlive.com - login.windows.net - - - + + + + + -pushp.svc.ms + .b-msedge.net + .bing.com + .hotmail.com + .live.com + .live.net + .s-microsoft.com + .microsoft.com + .microsoftonline.com + .microsoftstore.com + .ms-acdc.office.com + .msedge.net + .msn.com + .msocdn.com + .skype.com + .skype.net + .windows.com + .windows.net.nsatc.net + .windowsupdate.com + .xboxlive.com + login.windows.net + + + diff --git a/22_dns_query/exclude_o365_azure.xml b/22_dns_query/exclude_o365_azure.xml index 365357c..9a723f1 100644 --- a/22_dns_query/exclude_o365_azure.xml +++ b/22_dns_query/exclude_o365_azure.xml @@ -1,19 +1,19 @@ - - - - - .activedirectory.windowsazure.com - .aria.microsoft.com - .msauth.net - .msftauth.net - .opinsights.azure.com - management.azure.com - outlook.office365.com - portal.azure.com - substrate.office.com - osi.office.net - - - + + + + + .activedirectory.windowsazure.com + .aria.microsoft.com + .msauth.net + .msftauth.net + .opinsights.azure.com + management.azure.com + outlook.office365.com + portal.azure.com + substrate.office.com + osi.office.net + + + diff --git a/22_dns_query/exclude_ocsp_domains.xml b/22_dns_query/exclude_ocsp_domains.xml index 9cb4b11..c707d85 100644 --- a/22_dns_query/exclude_ocsp_domains.xml +++ b/22_dns_query/exclude_ocsp_domains.xml @@ -1,31 +1,31 @@ - - - - .digicert.com - .globalsign.com - .globalsign.net - msocsp.com - ocsp.msocsp.com - pki.goog - .pki.goog - ocsp.godaddy.com - amazontrust.com - .amazontrust.com - ocsp.sectigo.com - pki-goog.l.google.com - .usertrust.com - ocsp.comodoca.com - ocsp.verisign.com - ocsp.entrust.net - ocsp.identrust.com - status.rapidssl.com - status.thawte.com - ocsp.int-x3.letsencrypt.org - subca.ocsp-certum.com - cscasha2.ocsp-certum.com - crl.verisign.com - - - + + + + .digicert.com + .globalsign.com + .globalsign.net + msocsp.com + ocsp.msocsp.com + pki.goog + .pki.goog + ocsp.godaddy.com + amazontrust.com + .amazontrust.com + ocsp.sectigo.com + pki-goog.l.google.com + .usertrust.com + ocsp.comodoca.com + ocsp.verisign.com + ocsp.entrust.net + ocsp.identrust.com + status.rapidssl.com + status.thawte.com + ocsp.int-x3.letsencrypt.org + subca.ocsp-certum.com + cscasha2.ocsp-certum.com + crl.verisign.com + + + diff --git a/22_dns_query/exclude_sentinelone.xml b/22_dns_query/exclude_sentinelone.xml index b3d07d9..ecc5a27 100644 --- a/22_dns_query/exclude_sentinelone.xml +++ b/22_dns_query/exclude_sentinelone.xml @@ -1,9 +1,9 @@ - - - C:\Program Files\SentinelOne\Sentinel Agent;\SentinelAgent.exe - - - + + + C:\Program Files\SentinelOne\Sentinel Agent;\SentinelAgent.exe + + + diff --git a/22_dns_query/exclude_spotify.xml b/22_dns_query/exclude_spotify.xml index a36612b..f784906 100644 --- a/22_dns_query/exclude_spotify.xml +++ b/22_dns_query/exclude_spotify.xml @@ -1,11 +1,11 @@ - - - + + + - .spotify.com - .spotify.map.fastly.net + .spotify.com + .spotify.map.fastly.net - - + + diff --git a/23_file_delete/exclude_google_chrome.xml b/23_file_delete/exclude_google_chrome.xml index dfe3ab6..9a61e09 100644 --- a/23_file_delete/exclude_google_chrome.xml +++ b/23_file_delete/exclude_google_chrome.xml @@ -2,9 +2,9 @@ - \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - + \ No newline at end of file diff --git a/23_file_delete/exclude_windows_services.xml b/23_file_delete/exclude_windows_services.xml index 93b6cd9..c4058bc 100644 --- a/23_file_delete/exclude_windows_services.xml +++ b/23_file_delete/exclude_windows_services.xml @@ -2,8 +2,8 @@ - NETWORK SERVICE; LOCAL SERVICE + NETWORK SERVICE; LOCAL SERVICE - + diff --git a/23_file_delete/include_microsoft_sql_server.xml b/23_file_delete/include_microsoft_sql_server.xml index 3d6c1e4..d9680d6 100644 --- a/23_file_delete/include_microsoft_sql_server.xml +++ b/23_file_delete/include_microsoft_sql_server.xml @@ -1,11 +1,11 @@ - - C:\Program Files\Microsoft SQL Server;\Shared\ErrorDumps - C:\Program Files\Microsoft SQL Server;\DataDumps - C:\Program Files (X86)\Microsoft SQL Server\;Shared\ErrorDumps - - - + + C:\Program Files\Microsoft SQL Server;\Shared\ErrorDumps + C:\Program Files\Microsoft SQL Server;\DataDumps + C:\Program Files (X86)\Microsoft SQL Server\;Shared\ErrorDumps + + + \ No newline at end of file diff --git a/23_file_delete/include_qualys.xml b/23_file_delete/include_qualys.xml index 5ba30e5..2514f7d 100644 --- a/23_file_delete/include_qualys.xml +++ b/23_file_delete/include_qualys.xml @@ -1,12 +1,12 @@ - - - C:\Program Files\Qualys\QualysAgent - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - - + + + C:\Program Files\Qualys\QualysAgent + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + + diff --git a/23_file_delete/include_user_writable_folders.xml b/23_file_delete/include_user_writable_folders.xml index d47b973..d7d5d74 100644 --- a/23_file_delete/include_user_writable_folders.xml +++ b/23_file_delete/include_user_writable_folders.xml @@ -1,20 +1,20 @@ - - - - \Downloads\ - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - \Appdata\Local\Temp\ - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - \Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\ - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - + + + + \Downloads\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \Appdata\Local\Temp\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \ No newline at end of file diff --git a/23_file_delete/include_writable_folders.xml b/23_file_delete/include_writable_folders.xml index 9bfd0d2..c3e6e14 100644 --- a/23_file_delete/include_writable_folders.xml +++ b/23_file_delete/include_writable_folders.xml @@ -1,152 +1,152 @@ - - - - C:\ProgramData\Intel - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Mozilla - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\chocolatey\logs - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\DeviceSync - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\PlayReady - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\User Account Pictures - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Office\Heartbeat - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\ReportQueue - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Intel - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Mozilla - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\chocolatey\logs - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\DeviceSync - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\PlayReady - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\User Account Pictures - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Crypto\DSS\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\NetFramework\BreadcrumbStore - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Office\Heartbeat - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Windows\WER\ReportArchive - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Windows\WER\ReportQueue - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\Tasks - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\tracing - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\Registration\CRMLog - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\System32\Tasks - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\System32\spool\drivers\color - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\SysWOW64\Tasks - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - + + + + C:\ProgramData\Intel + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Mozilla + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\chocolatey\logs + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\DeviceSync + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\PlayReady + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\User Account Pictures + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Office\Heartbeat + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\ReportQueue + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Intel + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Mozilla + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\chocolatey\logs + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\DeviceSync + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\PlayReady + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\User Account Pictures + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Crypto\DSS\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\NetFramework\BreadcrumbStore + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Office\Heartbeat + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\ReportArchive + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\ReportQueue + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\tracing + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\Registration\CRMLog + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\spool\drivers\color + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\SysWOW64\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + diff --git a/24_clipboard_change/exclude_all.xml b/24_clipboard_change/exclude_all.xml index 522739f..f154247 100644 --- a/24_clipboard_change/exclude_all.xml +++ b/24_clipboard_change/exclude_all.xml @@ -4,5 +4,5 @@ - + diff --git a/25_process_tampering/exclude_microsoft_edge.xml b/25_process_tampering/exclude_microsoft_edge.xml index 7bc09e9..6f9ffc2 100644 --- a/25_process_tampering/exclude_microsoft_edge.xml +++ b/25_process_tampering/exclude_microsoft_edge.xml @@ -10,11 +10,11 @@ C:\Program Files (x86)\Microsoft\Edge\Application\ \identity_helper.exe - + C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\ \MicrosoftEdge_X64_ - + diff --git a/26_file_delete_deteted/exclude_google_chrome.xml b/26_file_delete_deteted/exclude_google_chrome.xml index e74a1f9..8ab8ce9 100644 --- a/26_file_delete_deteted/exclude_google_chrome.xml +++ b/26_file_delete_deteted/exclude_google_chrome.xml @@ -2,9 +2,9 @@ - \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - + \ No newline at end of file diff --git a/26_file_delete_deteted/exclude_windows_services.xml b/26_file_delete_deteted/exclude_windows_services.xml index 6cda3a1..3f92a1a 100644 --- a/26_file_delete_deteted/exclude_windows_services.xml +++ b/26_file_delete_deteted/exclude_windows_services.xml @@ -2,8 +2,8 @@ - NETWORK SERVICE; LOCAL SERVICE + NETWORK SERVICE; LOCAL SERVICE - + diff --git a/26_file_delete_deteted/include_microsoft_sql_server.xml b/26_file_delete_deteted/include_microsoft_sql_server.xml index b7541e7..c78e56f 100644 --- a/26_file_delete_deteted/include_microsoft_sql_server.xml +++ b/26_file_delete_deteted/include_microsoft_sql_server.xml @@ -1,11 +1,11 @@ - - C:\Program Files\Microsoft SQL Server;\Shared\ErrorDumps - C:\Program Files\Microsoft SQL Server;\DataDumps - C:\Program Files (X86)\Microsoft SQL Server\;Shared\ErrorDumps - - - + + C:\Program Files\Microsoft SQL Server;\Shared\ErrorDumps + C:\Program Files\Microsoft SQL Server;\DataDumps + C:\Program Files (X86)\Microsoft SQL Server\;Shared\ErrorDumps + + + \ No newline at end of file diff --git a/26_file_delete_deteted/include_qualys.xml b/26_file_delete_deteted/include_qualys.xml index c853279..53153b0 100644 --- a/26_file_delete_deteted/include_qualys.xml +++ b/26_file_delete_deteted/include_qualys.xml @@ -1,12 +1,12 @@ - - - C:\Program Files\Qualys\QualysAgent - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - + + + C:\Program Files\Qualys\QualysAgent + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + diff --git a/26_file_delete_deteted/include_user_writable_folders.xml b/26_file_delete_deteted/include_user_writable_folders.xml index d8fc948..7c92502 100644 --- a/26_file_delete_deteted/include_user_writable_folders.xml +++ b/26_file_delete_deteted/include_user_writable_folders.xml @@ -1,20 +1,20 @@ - - - - \Downloads\ - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - \Appdata\Local\Temp\ - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - \Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\ - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - + + + + \Downloads\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \Appdata\Local\Temp\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\ + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + \ No newline at end of file diff --git a/26_file_delete_deteted/include_writable_folders.xml b/26_file_delete_deteted/include_writable_folders.xml index 5b9f47f..f3a593c 100644 --- a/26_file_delete_deteted/include_writable_folders.xml +++ b/26_file_delete_deteted/include_writable_folders.xml @@ -1,152 +1,152 @@ - - - - C:\ProgramData\Intel - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Mozilla - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\chocolatey\logs - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\DeviceSync - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\PlayReady - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\User Account Pictures - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Office\Heartbeat - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\ReportQueue - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\ProgramData\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Intel - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Mozilla - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\chocolatey\logs - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\DeviceSync - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\PlayReady - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\User Account Pictures - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Crypto\DSS\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\NetFramework\BreadcrumbStore - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Office\Heartbeat - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Windows\WER\ReportArchive - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Windows\WER\ReportQueue - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Users\All Users\Microsoft\Windows\WER\Temp - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\Tasks - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\tracing - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\Registration\CRMLog - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\System32\Tasks - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\System32\spool\drivers\color - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - C:\Windows\SysWOW64\Tasks - .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct - - - + + + + C:\ProgramData\Intel + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Mozilla + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\chocolatey\logs + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\DeviceSync + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\PlayReady + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\User Account Pictures + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Office\Heartbeat + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\ReportQueue + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\ProgramData\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Intel + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Mozilla + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\chocolatey\logs + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\DeviceSync + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\PlayReady + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\User Account Pictures + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Crypto\DSS\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\NetFramework\BreadcrumbStore + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Office\Heartbeat + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\ReportArchive + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\ReportQueue + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Users\All Users\Microsoft\Windows\WER\Temp + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\tracing + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\Registration\CRMLog + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\System32\spool\drivers\color + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + C:\Windows\SysWOW64\Tasks + .com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct + + + diff --git a/2_file_create_time/exclude_chrome.xml b/2_file_create_time/exclude_chrome.xml index f62be2e..8f50aa0 100644 --- a/2_file_create_time/exclude_chrome.xml +++ b/2_file_create_time/exclude_chrome.xml @@ -1,10 +1,10 @@ - - - - AppData\Local\Google\Chrome\Application\chrome.exe - Root\VFS\ProgramFilesX86\Google\Chrome\Application\chrome.exe - - - + + + + AppData\Local\Google\Chrome\Application\chrome.exe + Root\VFS\ProgramFilesX86\Google\Chrome\Application\chrome.exe + + + diff --git a/2_file_create_time/exclude_onedrive.xml b/2_file_create_time/exclude_onedrive.xml index bbf16ab..35c8c19 100644 --- a/2_file_create_time/exclude_onedrive.xml +++ b/2_file_create_time/exclude_onedrive.xml @@ -1,9 +1,9 @@ - - + + - OneDrive.exe - - - + OneDrive.exe + + + \ No newline at end of file diff --git a/2_file_create_time/exclude_setups.xml b/2_file_create_time/exclude_setups.xml index 555cfaa..caa4cdd 100644 --- a/2_file_create_time/exclude_setups.xml +++ b/2_file_create_time/exclude_setups.xml @@ -1,9 +1,9 @@ - - + + - setup - - - + setup + + + \ No newline at end of file diff --git a/2_file_create_time/exclude_slack.xml b/2_file_create_time/exclude_slack.xml index c25fb38..c142660 100644 --- a/2_file_create_time/exclude_slack.xml +++ b/2_file_create_time/exclude_slack.xml @@ -1,9 +1,9 @@ - - + + - slack.exe - - - + slack.exe + + + diff --git a/2_file_create_time/exclude_teams.xml b/2_file_create_time/exclude_teams.xml index 242916d..64c0377 100644 --- a/2_file_create_time/exclude_teams.xml +++ b/2_file_create_time/exclude_teams.xml @@ -1,9 +1,9 @@ - - + + - AppData\Local\Microsoft\Teams\current\Teams.exe - - - + AppData\Local\Microsoft\Teams\current\Teams.exe + + + diff --git a/2_file_create_time/include_temp_folder.xml b/2_file_create_time/include_temp_folder.xml index 2037b86..3c96bb3 100644 --- a/2_file_create_time/include_temp_folder.xml +++ b/2_file_create_time/include_temp_folder.xml @@ -1,11 +1,11 @@ - - + + - C:\Temp - C:\Windows\Temp - C:\Tmp - - - + C:\Temp + C:\Windows\Temp + C:\Tmp + + + diff --git a/2_file_create_time/include_users_folder.xml b/2_file_create_time/include_users_folder.xml index ed1e8f1..23a2f4e 100644 --- a/2_file_create_time/include_users_folder.xml +++ b/2_file_create_time/include_users_folder.xml @@ -1,9 +1,9 @@ - - + + - C:\Users - - - + C:\Users + + + diff --git a/3_network_connection_initiated/exclude_dropbox.xml b/3_network_connection_initiated/exclude_dropbox.xml index 82bf032..cb65eba 100644 --- a/3_network_connection_initiated/exclude_dropbox.xml +++ b/3_network_connection_initiated/exclude_dropbox.xml @@ -1,9 +1,9 @@ - - + + - AppData\Roaming\Dropbox\bin\Dropbox.exe - - - + AppData\Roaming\Dropbox\bin\Dropbox.exe + + + \ No newline at end of file diff --git a/3_network_connection_initiated/exclude_eset.xml b/3_network_connection_initiated/exclude_eset.xml index c85c00a..856726c 100644 --- a/3_network_connection_initiated/exclude_eset.xml +++ b/3_network_connection_initiated/exclude_eset.xml @@ -1,9 +1,9 @@ - - + + - C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe - - - + C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe + + + diff --git a/3_network_connection_initiated/exclude_lsass_kerberos.xml b/3_network_connection_initiated/exclude_lsass_kerberos.xml index e41b7dc..e7cd8ba 100644 --- a/3_network_connection_initiated/exclude_lsass_kerberos.xml +++ b/3_network_connection_initiated/exclude_lsass_kerberos.xml @@ -1,12 +1,12 @@ - + - - C:\Windows\System32\lsass.exe - 88 - - - + + C:\Windows\System32\lsass.exe + 88 + + + diff --git a/3_network_connection_initiated/exclude_microsoft_onedrive.xml b/3_network_connection_initiated/exclude_microsoft_onedrive.xml index 9e5fec7..c3a8d10 100644 --- a/3_network_connection_initiated/exclude_microsoft_onedrive.xml +++ b/3_network_connection_initiated/exclude_microsoft_onedrive.xml @@ -1,10 +1,10 @@ - - - - OneDrive.exe - OneDriveStandaloneUpdater.exe - - - + + + + OneDrive.exe + OneDriveStandaloneUpdater.exe + + + \ No newline at end of file diff --git a/3_network_connection_initiated/exclude_palo_alto_cortex.xml b/3_network_connection_initiated/exclude_palo_alto_cortex.xml index 7dcb234..e883cf8 100644 --- a/3_network_connection_initiated/exclude_palo_alto_cortex.xml +++ b/3_network_connection_initiated/exclude_palo_alto_cortex.xml @@ -1,9 +1,9 @@ - - + + - C:\Program Files\Palo Alto Networks\Traps\cyserver.exe - - - + C:\Program Files\Palo Alto Networks\Traps\cyserver.exe + + + diff --git a/3_network_connection_initiated/exclude_sophos.xml b/3_network_connection_initiated/exclude_sophos.xml index 8ca713a..c1ab404 100644 --- a/3_network_connection_initiated/exclude_sophos.xml +++ b/3_network_connection_initiated/exclude_sophos.xml @@ -1,14 +1,14 @@ - - + + - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe - C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe - C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe - C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe - - - + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe + C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe + C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe + C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe + C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe + + + diff --git a/3_network_connection_initiated/exclude_spotify.xml b/3_network_connection_initiated/exclude_spotify.xml index 405a57d..205d050 100644 --- a/3_network_connection_initiated/exclude_spotify.xml +++ b/3_network_connection_initiated/exclude_spotify.xml @@ -1,9 +1,9 @@ - - + + - AppData\Roaming\Spotify\Spotify.exe - - - + AppData\Roaming\Spotify\Spotify.exe + + + \ No newline at end of file diff --git a/3_network_connection_initiated/exclude_trend_micro.xml b/3_network_connection_initiated/exclude_trend_micro.xml index f061e50..dae1346 100644 --- a/3_network_connection_initiated/exclude_trend_micro.xml +++ b/3_network_connection_initiated/exclude_trend_micro.xml @@ -1,10 +1,10 @@ - - + + - C:\Program files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe - C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe - - - + C:\Program files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe + C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe + + + diff --git a/3_network_connection_initiated/exclude_windows_update.xml b/3_network_connection_initiated/exclude_windows_update.xml index 1905c8b..ab017fb 100644 --- a/3_network_connection_initiated/exclude_windows_update.xml +++ b/3_network_connection_initiated/exclude_windows_update.xml @@ -1,17 +1,17 @@ - - - - - .windowsupdate.microsoft.com - .windowsupdate.com - wustat.windows.com - go.microsoft.com - .update.microsoft.com - download.microsoft.com - microsoft.com.akadns.net - microsoft.com.nsatc.net - - - + + + + + .windowsupdate.microsoft.com + .windowsupdate.com + wustat.windows.com + go.microsoft.com + .update.microsoft.com + download.microsoft.com + microsoft.com.akadns.net + microsoft.com.nsatc.net + + + \ No newline at end of file diff --git a/3_network_connection_initiated/include_3rd_party_remote_management.xml b/3_network_connection_initiated/include_3rd_party_remote_management.xml index eb28860..2c5f91f 100644 --- a/3_network_connection_initiated/include_3rd_party_remote_management.xml +++ b/3_network_connection_initiated/include_3rd_party_remote_management.xml @@ -1,13 +1,13 @@ - - - - - vnc.exe - vncviewer.exe - vncservice.exe - winexesvc.exe - - - + + + + + vnc.exe + vncviewer.exe + vncservice.exe + winexesvc.exe + + + diff --git a/3_network_connection_initiated/include_bitsadmin.xml b/3_network_connection_initiated/include_bitsadmin.xml index c9e6a2b..fbe8e4b 100644 --- a/3_network_connection_initiated/include_bitsadmin.xml +++ b/3_network_connection_initiated/include_bitsadmin.xml @@ -1,9 +1,9 @@ - - + + bitsadmin.exe - - + + diff --git a/3_network_connection_initiated/include_hp_critical_services.xml b/3_network_connection_initiated/include_hp_critical_services.xml index db05cb6..2f2b3c0 100644 --- a/3_network_connection_initiated/include_hp_critical_services.xml +++ b/3_network_connection_initiated/include_hp_critical_services.xml @@ -1,11 +1,11 @@ - - - - - omniinet.exe - hpsmhd.exe - - - + + + + + omniinet.exe + hpsmhd.exe + + + diff --git a/3_network_connection_initiated/include_hybrid_connection_manager.xml b/3_network_connection_initiated/include_hybrid_connection_manager.xml index 11fd0b6..fb80b04 100644 --- a/3_network_connection_initiated/include_hybrid_connection_manager.xml +++ b/3_network_connection_initiated/include_hybrid_connection_manager.xml @@ -1,9 +1,9 @@ - - + + - C:\Program Files\Microsoft\HybridConnectionManager + C:\Program Files\Microsoft\HybridConnectionManager - - + + diff --git a/3_network_connection_initiated/include_living_of_the_land.xml b/3_network_connection_initiated/include_living_of_the_land.xml index bdf0ccd..35f108d 100644 --- a/3_network_connection_initiated/include_living_of_the_land.xml +++ b/3_network_connection_initiated/include_living_of_the_land.xml @@ -1,55 +1,55 @@ - - + + - - ipconfig.exe - tasklist.exe - netstat.exe - qprocess.exe - nslookup.exe - quser.exe - query.exe - runas.exe - reg.exe - netsh.exe - klist.exe - wevtutil.exe - taskeng.exe - regsvr32.exe - cmd.exe - powershell.exe - bash.exe - pcalua.exe - cscript.exe - wscript.exe - mshta.exe - nbtstat.exe - net1.exe - nslookup.exe - qwinsta.exe - rwinsta.exe - sc.exe - nltest.exe - winrs.exe - dfsvc.exe - dnscmd.exe - esentutl.exe - expand.exe - extrac32.exe - IEExec.exe - Msdt.exe - msiexec.exe - Print.Exe - RegisterCimProvider.exe - RpcPing.exe - ScriptRunner.exe - xwizard.exe - desktopimgdownldr.exe - OpenConsole.exe - WindowsTerminal.exe - dllhost.exe - - - + + ipconfig.exe + tasklist.exe + netstat.exe + qprocess.exe + nslookup.exe + quser.exe + query.exe + runas.exe + reg.exe + netsh.exe + klist.exe + wevtutil.exe + taskeng.exe + regsvr32.exe + cmd.exe + powershell.exe + bash.exe + pcalua.exe + cscript.exe + wscript.exe + mshta.exe + nbtstat.exe + net1.exe + nslookup.exe + qwinsta.exe + rwinsta.exe + sc.exe + nltest.exe + winrs.exe + dfsvc.exe + dnscmd.exe + esentutl.exe + expand.exe + extrac32.exe + IEExec.exe + Msdt.exe + msiexec.exe + Print.Exe + RegisterCimProvider.exe + RpcPing.exe + ScriptRunner.exe + xwizard.exe + desktopimgdownldr.exe + OpenConsole.exe + WindowsTerminal.exe + dllhost.exe + + + diff --git a/3_network_connection_initiated/include_mavinject.xml b/3_network_connection_initiated/include_mavinject.xml index 266a636..a735e6b 100644 --- a/3_network_connection_initiated/include_mavinject.xml +++ b/3_network_connection_initiated/include_mavinject.xml @@ -1,9 +1,9 @@ - - + + Mavinject.exe - - + + diff --git a/3_network_connection_initiated/include_native_windows_tools.xml b/3_network_connection_initiated/include_native_windows_tools.xml index 325b04d..3daf81f 100644 --- a/3_network_connection_initiated/include_native_windows_tools.xml +++ b/3_network_connection_initiated/include_native_windows_tools.xml @@ -1,41 +1,41 @@ - - - - - at.exe - certutil.exe - cscript.exe - java.exe - mshta.exe - msiexec.exe - net.exe - notepad.exe - reg.exe - regsvr32.exe - rundll32.exe - sc.exe - wmic.exe - wscript.exe - driverquery.exe - dsquery.exe - AdFind.exe - hh.exe - infDefaultInstall.exe - javaw.exe - javaws.exe - mmc.exe - msbuild.exe - nbtstat.exe - nslookup.exe - qprocess.exe - qwinsta.exe - regsvcs.exe - rwinsta.exe - schtasks.exe - taskkill.exe - replace.exe - - - + + + + + at.exe + certutil.exe + cscript.exe + java.exe + mshta.exe + msiexec.exe + net.exe + notepad.exe + reg.exe + regsvr32.exe + rundll32.exe + sc.exe + wmic.exe + wscript.exe + driverquery.exe + dsquery.exe + AdFind.exe + hh.exe + infDefaultInstall.exe + javaw.exe + javaws.exe + mmc.exe + msbuild.exe + nbtstat.exe + nslookup.exe + qprocess.exe + qwinsta.exe + regsvcs.exe + rwinsta.exe + schtasks.exe + taskkill.exe + replace.exe + + + diff --git a/3_network_connection_initiated/include_ports_proxies.xml b/3_network_connection_initiated/include_ports_proxies.xml index b766314..bec3ecb 100644 --- a/3_network_connection_initiated/include_ports_proxies.xml +++ b/3_network_connection_initiated/include_ports_proxies.xml @@ -1,12 +1,12 @@ - - - - - 1080 - 3128 - 8080 - - - + + + + + 1080 + 3128 + 8080 + + + diff --git a/3_network_connection_initiated/include_ports_suspicous.xml b/3_network_connection_initiated/include_ports_suspicous.xml index 5b26116..f038da5 100644 --- a/3_network_connection_initiated/include_ports_suspicous.xml +++ b/3_network_connection_initiated/include_ports_suspicous.xml @@ -1,16 +1,16 @@ - - - - - 22 - 23 - 25 - 88 - 3389 - 5800 - 5900 - - - + + + + + 22 + 23 + 25 + 88 + 3389 + 5800 + 5900 + + + diff --git a/3_network_connection_initiated/include_psexec.xml b/3_network_connection_initiated/include_psexec.xml index 845e46f..e2a4b11 100644 --- a/3_network_connection_initiated/include_psexec.xml +++ b/3_network_connection_initiated/include_psexec.xml @@ -1,10 +1,10 @@ - - + + - psexec.exe - psexesvc.exe - - - + psexec.exe + psexesvc.exe + + + diff --git a/3_network_connection_initiated/include_suspicious_sources.xml b/3_network_connection_initiated/include_suspicious_sources.xml index 1ab37f8..ae83537 100644 --- a/3_network_connection_initiated/include_suspicious_sources.xml +++ b/3_network_connection_initiated/include_suspicious_sources.xml @@ -1,28 +1,28 @@ - - + + - C:\Users - C:\ProgramData - C:\Windows\Temp - C:\Temp - C:\PerfLogs\ - C:\$Recycle.bin\ - C:\Intel\Logs\ - C:\Users\Default\ - C:\Users\Public\ - C:\Users\NetworkService\ - C:\Windows\Fonts\ - C:\Windows\Debug\ - C:\Windows\Media\ - C:\Windows\Help\ - C:\Windows\addins\ - C:\Windows\repair\ - C:\Windows\security\ - C:\Windows\system32\config\systemprofile\ - \htdocs\ - \wwwroot\ - - - + C:\Users + C:\ProgramData + C:\Windows\Temp + C:\Temp + C:\PerfLogs\ + C:\$Recycle.bin\ + C:\Intel\Logs\ + C:\Users\Default\ + C:\Users\Public\ + C:\Users\NetworkService\ + C:\Windows\Fonts\ + C:\Windows\Debug\ + C:\Windows\Media\ + C:\Windows\Help\ + C:\Windows\addins\ + C:\Windows\repair\ + C:\Windows\security\ + C:\Windows\system32\config\systemprofile\ + \htdocs\ + \wwwroot\ + + + diff --git a/3_network_connection_initiated/include_syncappvpublishingserver.xml b/3_network_connection_initiated/include_syncappvpublishingserver.xml index 39511c9..a80b0fa 100644 --- a/3_network_connection_initiated/include_syncappvpublishingserver.xml +++ b/3_network_connection_initiated/include_syncappvpublishingserver.xml @@ -1,9 +1,9 @@ - - + + SyncAppvPublishingServer.exe - - + + diff --git a/3_network_connection_initiated/include_tor.xml b/3_network_connection_initiated/include_tor.xml index 98f428e..4e9e6c8 100644 --- a/3_network_connection_initiated/include_tor.xml +++ b/3_network_connection_initiated/include_tor.xml @@ -1,15 +1,15 @@ - - - - - tor.exe - - 1723 - 4500 - 9001 - 9030 - - - + + + + + tor.exe + + 1723 + 4500 + 9001 + 9030 + + + diff --git a/3_network_connection_initiated/include_windows_remote_management.xml b/3_network_connection_initiated/include_windows_remote_management.xml index 5b05855..80be504 100644 --- a/3_network_connection_initiated/include_windows_remote_management.xml +++ b/3_network_connection_initiated/include_windows_remote_management.xml @@ -1,10 +1,10 @@ - - + + - 5985 - 5986 - - - + 5985 + 5986 + + + diff --git a/5_process_ended/include_users_and_temp_folders.xml b/5_process_ended/include_users_and_temp_folders.xml index 64eb834..242b03e 100644 --- a/5_process_ended/include_users_and_temp_folders.xml +++ b/5_process_ended/include_users_and_temp_folders.xml @@ -1,11 +1,11 @@ - - - - C:\Users - C:\Temp - C:\Windows\Temp - - - + + + + C:\Users + C:\Temp + C:\Windows\Temp + + + diff --git a/6_driver_loaded_into_kernel/exclude_intel_drivers.xml b/6_driver_loaded_into_kernel/exclude_intel_drivers.xml index 1f2c605..45f8f17 100644 --- a/6_driver_loaded_into_kernel/exclude_intel_drivers.xml +++ b/6_driver_loaded_into_kernel/exclude_intel_drivers.xml @@ -1,13 +1,13 @@ - - + + - Intel - Valid + Intel + Valid - - - + + + \ No newline at end of file diff --git a/6_driver_loaded_into_kernel/exclude_microsoft_drivers.xml b/6_driver_loaded_into_kernel/exclude_microsoft_drivers.xml index c5010c1..7c9af32 100644 --- a/6_driver_loaded_into_kernel/exclude_microsoft_drivers.xml +++ b/6_driver_loaded_into_kernel/exclude_microsoft_drivers.xml @@ -1,15 +1,15 @@ - - - - Microsoft Valid - - - + + + \ No newline at end of file diff --git a/7_image_load/exclude_office_vsto_plugins.xml b/7_image_load/exclude_office_vsto_plugins.xml index ef275d9..0770716 100644 --- a/7_image_load/exclude_office_vsto_plugins.xml +++ b/7_image_load/exclude_office_vsto_plugins.xml @@ -1,11 +1,11 @@ - + - - VSTOInstaller.exe - C:\Windows\ - + + VSTOInstaller.exe + C:\Windows\ + diff --git a/7_image_load/include_bginfo_abuse.xml b/7_image_load/include_bginfo_abuse.xml index aa9dc52..3d36e69 100644 --- a/7_image_load/include_bginfo_abuse.xml +++ b/7_image_load/include_bginfo_abuse.xml @@ -1,10 +1,10 @@ - + - bginfo.exe - System.ni.dll;System.Core.ni.dll;System.Management.Automation.ni.dll;wmiutils.dll + bginfo.exe + System.ni.dll;System.Core.ni.dll;System.Management.Automation.ni.dll;wmiutils.dll diff --git a/7_image_load/include_general_warning.xml b/7_image_load/include_general_warning.xml index bcea114..53401ed 100644 --- a/7_image_load/include_general_warning.xml +++ b/7_image_load/include_general_warning.xml @@ -1,9 +1,9 @@ - - - - - - + + + + + + diff --git a/7_image_load/include_macros.xml b/7_image_load/include_macros.xml index b39989e..4f5a56c 100644 --- a/7_image_load/include_macros.xml +++ b/7_image_load/include_macros.xml @@ -1,12 +1,12 @@ - - + + - - wshom.ocx - scrrun.dll - vbscript.dll + + wshom.ocx + scrrun.dll + vbscript.dll - - + + diff --git a/7_image_load/include_mshta_amsi_bypass.xml b/7_image_load/include_mshta_amsi_bypass.xml index a0b86d5..7fba53b 100644 --- a/7_image_load/include_mshta_amsi_bypass.xml +++ b/7_image_load/include_mshta_amsi_bypass.xml @@ -1,16 +1,16 @@ - - + + - - - - - jscript9.dll - jscript.dll - mshta.exe - + + + + + jscript9.dll + jscript.dll + mshta.exe + - - + + \ No newline at end of file diff --git a/7_image_load/include_office_addins.xml b/7_image_load/include_office_addins.xml index 0af0e7d..2039806 100644 --- a/7_image_load/include_office_addins.xml +++ b/7_image_load/include_office_addins.xml @@ -1,10 +1,10 @@ - - + + - .wll - .xll + .wll + .xll - - + + diff --git a/7_image_load/include_office_com_load.xml b/7_image_load/include_office_com_load.xml index 50cf66a..fa774a2 100644 --- a/7_image_load/include_office_com_load.xml +++ b/7_image_load/include_office_com_load.xml @@ -1,20 +1,20 @@ - + - + - C:\Program Files;\Microsoft Office\root\Office - combase.dll + C:\Program Files;\Microsoft Office\root\Office + combase.dll - C:\Program Files;\Microsoft Office\root\Office - coml2.dll + C:\Program Files;\Microsoft Office\root\Office + coml2.dll - C:\Program Files;\Microsoft Office\root\Office - comsvcs.dll - + C:\Program Files;\Microsoft Office\root\Office + comsvcs.dll + - + diff --git a/7_image_load/include_office_dotnet_load.xml b/7_image_load/include_office_dotnet_load.xml index 8e1d9d7..6720bb3 100644 --- a/7_image_load/include_office_dotnet_load.xml +++ b/7_image_load/include_office_dotnet_load.xml @@ -1,20 +1,20 @@ - - - + + + - C:\Program Files;\Microsoft Office\root\Office - C:\Windows\assembly\ + C:\Program Files;\Microsoft Office\root\Office + C:\Windows\assembly\ - C:\Program Files;\Microsoft Office\root\Office - C:\Windows\Microsoft.NET\assembly\GAC_MSIL + C:\Program Files;\Microsoft Office\root\Office + C:\Windows\Microsoft.NET\assembly\GAC_MSIL - C:\Program Files;\Microsoft Office\root\Office - clr.dll - + C:\Program Files;\Microsoft Office\root\Office + clr.dll + - - + + diff --git a/7_image_load/include_office_vb_load.xml b/7_image_load/include_office_vb_load.xml index ead2fd2..ae059d6 100644 --- a/7_image_load/include_office_vb_load.xml +++ b/7_image_load/include_office_vb_load.xml @@ -1,20 +1,20 @@ - - - + + + - C:\Program Files;\Microsoft Office\root\Office - VBE7INTL.DLL + C:\Program Files;\Microsoft Office\root\Office + VBE7INTL.DLL - C:\Program Files;\Microsoft Office\root\Office - VBE7.DLL + C:\Program Files;\Microsoft Office\root\Office + VBE7.DLL - C:\Program Files;\Microsoft Office\root\Office - VBEUI.DLL - + C:\Program Files;\Microsoft Office\root\Office + VBEUI.DLL + - - + + diff --git a/7_image_load/include_office_vsto_plugins.xml b/7_image_load/include_office_vsto_plugins.xml index fd56d63..26cdca4 100644 --- a/7_image_load/include_office_vsto_plugins.xml +++ b/7_image_load/include_office_vsto_plugins.xml @@ -1,5 +1,5 @@ - + VSTOInstaller.exe diff --git a/7_image_load/include_office_wmi_load.xml b/7_image_load/include_office_wmi_load.xml index f85f13f..88bcebc 100644 --- a/7_image_load/include_office_wmi_load.xml +++ b/7_image_load/include_office_wmi_load.xml @@ -1,12 +1,12 @@ - - + + - + C:\Program Files;\Microsoft Office\root\Office C:\Windows\SysWOW64\wbem\wbemdisp.dll - - + + diff --git a/7_image_load/include_powershell.xml b/7_image_load/include_powershell.xml index ce4122b..739ad28 100644 --- a/7_image_load/include_powershell.xml +++ b/7_image_load/include_powershell.xml @@ -1,15 +1,15 @@ - - - - system.management.automation.ni.dll - system.management.automation.dll - Microsoft.PowerShell.Commands.Diagnostics.dll - Microsoft.PowerShell.Commands.Management.dll - Microsoft.PowerShell.Commands.Utility.dll - Microsoft.PowerShell.ConsoleHost.dll - Microsoft.PowerShell.Security.dll - - - + + + + system.management.automation.ni.dll + system.management.automation.dll + Microsoft.PowerShell.Commands.Diagnostics.dll + Microsoft.PowerShell.Commands.Management.dll + Microsoft.PowerShell.Commands.Utility.dll + Microsoft.PowerShell.ConsoleHost.dll + Microsoft.PowerShell.Security.dll + + + diff --git a/7_image_load/include_regsvc.xml b/7_image_load/include_regsvc.xml index 3d50c88..344ede9 100644 --- a/7_image_load/include_regsvc.xml +++ b/7_image_load/include_regsvc.xml @@ -1,9 +1,9 @@ - - + + - regsvc.dll + regsvc.dll - - + + \ No newline at end of file diff --git a/7_image_load/include_rundll32_minidump.xml b/7_image_load/include_rundll32_minidump.xml index 6df1ab0..267d590 100644 --- a/7_image_load/include_rundll32_minidump.xml +++ b/7_image_load/include_rundll32_minidump.xml @@ -1,11 +1,11 @@ - + - rundll32.exe - comsvcs.dll - + rundll32.exe + comsvcs.dll + diff --git a/7_image_load/include_scheduledtask.xml b/7_image_load/include_scheduledtask.xml index c2c028b..c259430 100644 --- a/7_image_load/include_scheduledtask.xml +++ b/7_image_load/include_scheduledtask.xml @@ -1,9 +1,9 @@ - - + + taskschd.dll - - + + diff --git a/7_image_load/include_squiblydoo.xml b/7_image_load/include_squiblydoo.xml index 3436923..01594d8 100644 --- a/7_image_load/include_squiblydoo.xml +++ b/7_image_load/include_squiblydoo.xml @@ -1,10 +1,10 @@ - - + + scrobj.dll scrobj.dll - - + + \ No newline at end of file diff --git a/7_image_load/include_suspicious_location.xml b/7_image_load/include_suspicious_location.xml index 4a4b110..11fcf9a 100644 --- a/7_image_load/include_suspicious_location.xml +++ b/7_image_load/include_suspicious_location.xml @@ -1,25 +1,25 @@ - - - - admin$;c$;\\;\appdata\;\temp\ - c:\programdata\ - C:\Windows\Media\ - C:\Windows\addins\ - C:\Windows\system32\config\systemprofile\ - C:\Windows\Debug\ - C:\Windows\Temp - C:\PerfLogs\ - C:\Windows\Help\ - C:\Intel\Logs\ - C:\Temp - C:\Windows\repair\ - C:\Windows\security\ - C:\Windows\Fonts\ - file: - $Recycle.bin\ - \Windows\IME\ - - - + + + + admin$;c$;\\;\appdata\;\temp\ + c:\programdata\ + C:\Windows\Media\ + C:\Windows\addins\ + C:\Windows\system32\config\systemprofile\ + C:\Windows\Debug\ + C:\Windows\Temp + C:\PerfLogs\ + C:\Windows\Help\ + C:\Intel\Logs\ + C:\Temp + C:\Windows\repair\ + C:\Windows\security\ + C:\Windows\Fonts\ + file: + $Recycle.bin\ + \Windows\IME\ + + + diff --git a/7_image_load/include_urlmonitor.xml b/7_image_load/include_urlmonitor.xml index 178e90a..1f526ce 100644 --- a/7_image_load/include_urlmonitor.xml +++ b/7_image_load/include_urlmonitor.xml @@ -1,10 +1,10 @@ - - + + - - urlmon.dll - + + urlmon.dll + diff --git a/7_image_load/include_wmi.xml b/7_image_load/include_wmi.xml index 59b1985..b5ab9a7 100644 --- a/7_image_load/include_wmi.xml +++ b/7_image_load/include_wmi.xml @@ -1,9 +1,9 @@ - - + + - wmiutils.dll + wmiutils.dll - - + + diff --git a/8_create_remote_thread/exclude_generic_windows_processes.xml b/8_create_remote_thread/exclude_generic_windows_processes.xml index e8cc202..1634221 100644 --- a/8_create_remote_thread/exclude_generic_windows_processes.xml +++ b/8_create_remote_thread/exclude_generic_windows_processes.xml @@ -1,21 +1,21 @@ - - - - - C:\Windows\System32\svchost.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\services.exe - C:\Windows\System32\winlogon.exe - C:\Windows\System32\audiodg.exe - C:\windows\system32\kernel32.dll - - C:\Windows\System32\dwm.exe - C:\Windows\System32\csrss.exe - - - - + C:\Windows\System32\svchost.exe + C:\Windows\System32\wininit.exe + C:\Windows\System32\csrss.exe + C:\Windows\System32\services.exe + C:\Windows\System32\winlogon.exe + C:\Windows\System32\audiodg.exe + C:\windows\system32\kernel32.dll + + C:\Windows\System32\dwm.exe + C:\Windows\System32\csrss.exe + + + + \ No newline at end of file diff --git a/8_create_remote_thread/exclude_google_chrome.xml b/8_create_remote_thread/exclude_google_chrome.xml index fdedeff..3a8c269 100644 --- a/8_create_remote_thread/exclude_google_chrome.xml +++ b/8_create_remote_thread/exclude_google_chrome.xml @@ -1,11 +1,11 @@ - - - - - Google\Chrome\Application\chrome.exe - - - + Google\Chrome\Application\chrome.exe + + + \ No newline at end of file diff --git a/8_create_remote_thread/exclude_wmi.xml b/8_create_remote_thread/exclude_wmi.xml index f3647a5..2ba7ad8 100644 --- a/8_create_remote_thread/exclude_wmi.xml +++ b/8_create_remote_thread/exclude_wmi.xml @@ -1,11 +1,11 @@ - - - - - C:\Windows\System32\wbem\WmiPrvSE.exe - - - + C:\Windows\System32\wbem\WmiPrvSE.exe + + + \ No newline at end of file diff --git a/9_raw_access_read/include_general_commment.xml b/9_raw_access_read/include_general_commment.xml index 6217761..4c9280a 100644 --- a/9_raw_access_read/include_general_commment.xml +++ b/9_raw_access_read/include_general_commment.xml @@ -1,12 +1,12 @@ - - - - - - - - + + + + \ No newline at end of file diff --git a/exclude_rules.txt b/exclude_rules.txt new file mode 100644 index 0000000..9358a4c --- /dev/null +++ b/exclude_rules.txt @@ -0,0 +1 @@ +/Users/olafhartong/tools/sysmon-modular/8_create_remote_thread/exclude_generic_windows_processes.xml