admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

config improvements

Browse Source
This commit is contained in:
Olaf Hartong
2023-06-22 16:48:52 +00:00
parent 0b05ee9ce1
commit 15dcb04d4a
3 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
10_process_access/exclude_visual_studio_code.xml
+6 -1
View File
@@ -11,8 +11,13 @@
<SourceImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</SourceImage>
<TargetImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</TargetImage>
<GrantedAccess condition="is">0x1401</GrantedAccess> <!--PROCESS_QUERY_LIMITED_INFORMATION,PROCESS_QUERY_INFORMATION and PROCESS_TERMINATE access to its children-->
</Rule>
<Rule groupRelation="and">
<SourceImage condition="contains all">C:\Users\;\AppData\Local\Programs\Microsoft VS Code\Code.exe</SourceImage>
<TargetImage condition="contains all">C:\Users\;\AppData\Local\Programs\Microsoft VS Code\Code.exe</TargetImage>
<GrantedAccess condition="is">0x1401</GrantedAccess> <!--PROCESS_QUERY_LIMITED_INFORMATION,PROCESS_QUERY_INFORMATION and PROCESS_TERMINATE access to its children-->
</Rule>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
</Sysmon>
11_file_create/exclude_microsoft_prefetch.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude">
<TargetFilename condition="contains all">C:\Windows\Prefetch;.pf</TargetFilename>
</FileCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
26_file_delete_detected/exclude_azure_agent.xml
+11
View File
@@ -0,0 +1,11 @@
<Sysmon schemaversion="4.60">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileDeleteDetected onmatch="exclude">
<Image condition="contains all">C:\WindowsAzure\GuestAgent;\WindowsAzureGuestAgent.exe</Image>
<Image condition="contains all">C:\Packages\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent\;\AMAExtHealthMonitor.exe</Image>
<TargetFilename condition="begin with">C:\WindowsAzure\Logs\AggregateStatus\aggregatestatus</TargetFilename>
</FileDeleteDetected>
</RuleGroup>
</EventFiltering>
</Sysmon>