admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

FileExeDetect added

Browse Source
This commit is contained in:
Olaf Hartong
2023-06-22 16:48:38 +00:00
parent 13168af9c9
commit 0b05ee9ce1
10 changed files with 236 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
26_file_delete_detected/exclude_microsoft_prefetch.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileDeleteDetected onmatch="exclude">
<TargetFilename condition="contains all">C:\Windows\Prefetch;.pf</TargetFilename>
</FileDeleteDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
29_file_executable_detected/include_living_off_the_land.xml
+83
View File
@@ -0,0 +1,83 @@
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileExecutableDetected onmatch="include">
<Image name="technique_id=T1546.008,technique_name=Windows Error Reporting" condition="contains">werfault.exe</Image>
<Image name="technique_id=T1574.002,technique_name=DLL Side-Loading" condition="is">odbcconf.exe</Image> <!--Microsoft:Windows: allows for driver loads -->
<Image name="technique_id=T1027.004,technique_name=Compile After Delivery" condition="is">csc.exe</Image>
<Image name="technique_id=T1543.003,technique_name=Windows Service" condition="is">sc.exe</Image>
<Image name="technique_id=T1489,technique_name=Service Stop" condition="is">taskkill.exe</Image>
<Image name="technique_id=T1074,technique_name=Data Staged" condition="is">xcopy.exe</Image>
<Image name="technique_id=T1074,technique_name=Data Staged" condition="is">robocopy.exe</Image>
<Image name="technique_id=T,technique_name=" condition="is">makecab.exe</Image>
<Image name="technique_id=T1105,technique_name=Remote File Copy" condition="is">GfxDownloadWrapper.exe</Image>
<Image name="technique_id=T1105,technique_name=Remote File Copy" condition="is">expand.exe</Image>
<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="is">curl.exe</Image>
<Image name="technique=T1105,technique_name=Ingress Tool Transfer" condition="is">ftp.exe</Image>
<Image name="technique_id=T1564.004,technique_name=NTFS File Attributes" condition="is">extrac32.exe</Image>
<Image name="technique_id=T1053.005,technique_name=Scheduled Task/Job" condition="contains any">schtasks.exe;sctasks.exe</Image>
<Image name="technique=T1053.002,technique_name=At" condition="contains any">at.exe;At.exe</Image>
<Image name="technique_id=T1053,technique_name=Scheduled Task/Job" condition="is">taskeng.exe</Image>
<Image name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\WINDOWS\system32\wbem\scrcons.exe</Image>
<Image name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="is">wmiprvse.exe</Image>
<Image condition="is">wevtutil.exe</Image>
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">pcalua.exe</Image> <!--Microsoft:Windows: Program Compatibility Assistant)-->
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">cscript.exe</Image>
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">wscript.exe</Image>
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">bash.exe</Image> <!--Microsoft:Windows: bash on Windows, Linux subsystem-->
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">certutil.exe</Image>
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">winrs.exe</Image>
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">control.exe</Image> <!-- https://twitter.com/rikvduijn/status/853251879320662017 -->
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">desktopimgdownldr.exe</Image>
<Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">wsl.exe</Image>
<Image name="technique_id=T1218.001,technique_name=Compiled HTML File" condition="is">hh.exe</Image> <!--Microsoft:Windows: HTML Helper-->
<Image name="technique_id=T1218.004,technique_name=InstallUtil" condition="is">installutil.exe</Image>
<Image name="technique_id=T1218.005,technique_name=Mshta" condition="image">mshta.exe</Image>
<Image name="technique_id=T1218.005,technique_name=Mshta" condition="is">mshta.exe</Image>
<Image name="technique_id=T1218.010,technique_name=Regsvr32" condition="is">regsvr32.exe</Image> <!--Mitre T1218.010--> <!--Mitre T1085--> <!--Microsoft:Windows: [ https://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html ] -->
<Image name="technique_id=T1218.011,technique_name=rundll32.exe" condition="contains">rundll32.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">InfDefaultInstall.EXE</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">extexport.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">msconfig.EXE</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">msiexec.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">odbcconf.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">PresentationHost.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">rasdlui.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">RegisterCimProvider2.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">RegisterCimProvider.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">ScriptRunner.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">verclsid.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">wab.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">wab.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">wsreset.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">Appvlp.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">csi.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">devtoolslauncher.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">Scriptrunner.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">tttracer.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">msdt.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">rasautou.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">Register-cimprovider.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">diskshadow.exe</Image> <!--This only applies to versions of Windows Server-->
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">replace.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="image">jjs.exe</Image>
<Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="image">appcmd.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains">vbc.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">csc.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">dfsvc.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">mftrace.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">dxcap.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">ilasm.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">jsc.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">vbc.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">Microsoft.Workflow.Compiler.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">vsjitdebugger.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">tracker.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">te.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">rcsi.exe</Image>
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">Microsoft.Workflow.Compiler.exe</Image> <!--https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/-->
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">jsc.exe</Image> <!-- https://lolbas-project.github.io/lolbas/Binaries/Jsc/ -->
</FileExecutableDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
29_file_executable_detected/include_msbuild.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileExecutableDetected onmatch="include">
<Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">MSBuild.exe</Image>
</FileExecutableDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
29_file_executable_detected/include_msoffice.xml
+14
View File
@@ -0,0 +1,14 @@
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileExecutableDetected onmatch="include">
<Image name="technique_id=T1137,technique_name=Office Application Startup" condition="image">excel.exe</Image>
<Image name="technique_id=T1137,technique_name=Office Application Startup" condition="image">winword.exe</Image>
<Image name="technique_id=T1137,technique_name=Office Application Startup" condition="image">powerpnt.exe</Image>
<Image name="technique_id=T1137,technique_name=Office Application Startup" condition="image">outlook.exe</Image>
<Image name="technique_id=T1137,technique_name=Office Application Startup" condition="image">msaccess.exe</Image>
<Image name="technique_id=T1137,technique_name=Office Application Startup" condition="image">mspub.exe</Image>
</FileExecutableDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
29_file_executable_detected/include_qualys.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileExecutableDetected onmatch="include">
<TargetFilename condition="begin with">C:\Program Files\Qualys\QualysAgent</TargetFilename> <!--Writable for all users-->
</FileExecutableDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
29_file_executable_detected/include_shells.xml
+13
View File
@@ -0,0 +1,13 @@
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileExecutableDetected onmatch="include">
<Image name="technique_id=T1059.003,technique_name=Windows Command Shell" condition="is">cmd.exe</Image>
<Image name="technique_id=T1059.001,technique_name=PowerShell" condition="image">powershell.exe</Image>
<Image name="technique_id=T1059.001,technique_name=PowerShell" condition="image">pwsh.exe</Image>
<Image name="technique_id=T1059.001,technique_name=PowerShell" condition="image">powershell_ise.exe</Image>
<Image name="technique_id=T1059.001,technique_name=PowerShell" condition="contains">Sqlps.exe</Image>
</FileExecutableDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
29_file_executable_detected/include_user_writable_folders.xml
+11
View File
@@ -0,0 +1,11 @@
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileExecutableDetected onmatch="include">
<TargetFilename condition="contains">\Downloads\</TargetFilename> <!--User Download folder-->
<TargetFilename condition="contains">\Appdata\Local\Temp\</TargetFilename> <!--User Temp folder-->
<TargetFilename condition="contains">\Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\</TargetFilename> <!--Microsoft Outlook Temp folder-->
</FileExecutableDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
29_file_executable_detected/include_windows_remote_management.xml
+11
View File
@@ -0,0 +1,11 @@
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileExecutableDetected onmatch="include">
<Image name="technique_id=T1021.006,technique_name=Windows Remote Management" condition="is">wsmprovhost.exe</Image>
<Image name="technique_id=T1021.006,technique_name=Windows Remote Management" condition="is">winrshost.exe</Image>
<Image name="technique_id=T1021.006,technique_name=Windows Remote Management" condition="image">winrm.cmd</Image>
</FileExecutableDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
29_file_executable_detected/include_writable_folders.xml
+22
View File
@@ -0,0 +1,22 @@
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileExecutableDetected onmatch="include">
<TargetFilename condition="begin with">C:\ProgramData\Intel</TargetFilename>
<TargetFilename condition="begin with">C:\ProgramData\Mozilla</TargetFilename>
<TargetFilename condition="begin with">C:\ProgramData\chocolatey\</TargetFilename>
<TargetFilename condition="begin with">C:\ProgramData\Microsoft\DeviceSync</TargetFilename>
<TargetFilename condition="begin with">C:\ProgramData\Microsoft\PlayReady</TargetFilename>
<TargetFilename condition="begin with">C:\ProgramData\Microsoft\User Account Pictures</TargetFilename>
<TargetFilename condition="begin with">C:\ProgramData\Microsoft\Office\Heartbeat</TargetFilename>
<TargetFilename condition="begin with">C:\ProgramData\Microsoft\Windows\WER</TargetFilename>
<TargetFilename condition="begin with">C:\Users\All Users\</TargetFilename>
<TargetFilename condition="begin with">C:\Windows\Tasks</TargetFilename>
<TargetFilename condition="begin with">C:\Windows\tracing</TargetFilename>
<TargetFilename condition="begin with">C:\Windows\System32\Tasks</TargetFilename>
<TargetFilename condition="begin with">C:\Windows\System32\spool\drivers\color</TargetFilename>
<TargetFilename condition="begin with">C:\Windows\SysWOW64\Tasks</TargetFilename>
</FileExecutableDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>
Merge-SysmonXml.ps1
+55 -5
View File
@@ -290,6 +290,18 @@ function Merge-SysmonXml
include = @()
exclude = @()
}
FileBlockExecutable = [ordered]@{
include = @()
exclude = @()
}
FileBlockShredding = [ordered]@{
include = @()
exclude = @()
}
FileExecutableDetected = [ordered]@{
include = @()
exclude = @()
}
}
$general = [xml]@'
@@ -312,7 +324,7 @@ function Merge-SysmonXml
<!-- (& ,&. -->
<!-- .*&&*. -->
<!-- -->
<Sysmon schemaversion="4.60">
<Sysmon schemaversion="4.90">
<HashAlgorithms>*</HashAlgorithms> <!-- This now also determines the file names of the files preserved (String) -->
<CheckRevocation>False</CheckRevocation> <!-- Setting this to true might impact performance -->
<DnsLookup>False</DnsLookup> <!-- Disables lookup behavior, default is True (Boolean) -->
@@ -431,9 +443,19 @@ function Merge-SysmonXml
<RuleGroup groupRelation="or">
<FileDeleteDetected onmatch="include"/>
</RuleGroup>
<!-- Event ID 26 == File Delete and overwrite events - Excludes -->
<!-- Event ID 27 == File Block Executable and overwrite events - Includes -->
<!-- Default set to disabled due to potential unwanted blocks, enable with care!-->
<RuleGroup groupRelation="or">
<FileDeleteDetected onmatch="exclude"/>
<FileBlockExecutable onmatch="include"/>
</RuleGroup>
<!-- Event ID 28 == Fileblock Shredding events - Includes -->
<!-- Default set to disabled due to disk space implications, enable with care!-->
<RuleGroup groupRelation="or">
<FileBlockShredding onmatch="include"/>
</RuleGroup>
<!-- Event ID 29 == File Executable Detected events - Excludes -->
<RuleGroup groupRelation="or">
<FileExecutableDetected onmatch="exclude"/>
</RuleGroup>
</EventFiltering>
</Sysmon>
@@ -460,7 +482,7 @@ function Merge-SysmonXml
<!-- (& ,&. -->
<!-- .*&&*. -->
<!-- -->
<Sysmon schemaversion="4.60">
<Sysmon schemaversion="4.90">
<HashAlgorithms>*</HashAlgorithms> <!-- This now also determines the file names of the files preserved (String) -->
<CheckRevocation>False</CheckRevocation> <!-- Setting this to true might impact performance -->
<DnsLookup>False</DnsLookup> <!-- Disables lookup behavior, default is True (Boolean) -->
@@ -546,6 +568,20 @@ function Merge-SysmonXml
<RuleGroup groupRelation="or">
<FileDeleteDetected onmatch="exclude"/>
</RuleGroup>
<!-- Event ID 27 == File Block Executable and overwrite events - Includes -->
<!-- Default set to disabled due to potential unwanted blocks, enable with care!-->
<RuleGroup groupRelation="or">
<FileBlockExecutable onmatch="include"/>
</RuleGroup>
<!-- Event ID 28 == Fileblock Shredding events - Includes -->
<!-- Default set to disabled due to disk space implications, enable with care!-->
<RuleGroup groupRelation="or">
<FileBlockShredding onmatch="include"/>
</RuleGroup>
<!-- Event ID 29 == File Executable Detected events - Excludes -->
<RuleGroup groupRelation="or">
<FileExecutableDetected onmatch="exclude"/>
</RuleGroup>
</EventFiltering>
</Sysmon>
'@
@@ -573,7 +609,7 @@ $mdeaugmentlog = [xml]@'
<!-- (& ,&. -->
<!-- .*&&*. -->
<!-- -->
<Sysmon schemaversion="4.60">
<Sysmon schemaversion="4.90">
<HashAlgorithms>*</HashAlgorithms> <!-- This now also determines the file names of the files preserved (String) -->
<CheckRevocation>False</CheckRevocation> <!-- Setting this to true might impact performance -->
<DnsLookup>False</DnsLookup> <!-- Disables lookup behavior, default is True (Boolean) -->
@@ -680,6 +716,20 @@ $mdeaugmentlog = [xml]@'
<RuleGroup groupRelation="or">
<FileDeleteDetected onmatch="include"/>
</RuleGroup>
<!-- Event ID 27 == File Block Executable and overwrite events - Includes -->
<!-- Default set to disabled due to potential unwanted blocks, enable with care!-->
<RuleGroup groupRelation="or">
<FileBlockExecutable onmatch="include"/>
</RuleGroup>
<!-- Event ID 28 == Fileblock Shredding events - Includes -->
<!-- Default set to disabled due to disk space implications, enable with care!-->
<RuleGroup groupRelation="or">
<FileBlockShredding onmatch="include"/>
</RuleGroup>
<!-- Event ID 29 == File Executable Detected events - Excludes -->
<RuleGroup groupRelation="or">
<FileExecutableDetected onmatch="exclude"/>
</RuleGroup>
</EventFiltering>
</Sysmon>
'@