admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

add filters to 2 - exe, vsc, remove nvidia

Browse Source
This commit is contained in:
Connor Shade
2023-04-13 07:42:02 -04:00
parent cb72ba2fb0
commit 1c97028b19
4 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
2_file_create_time/exclude_nvidia.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.30"> <!-- Taken from SwiftOnSecurity rules-->
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreateTime onmatch="exclude">
<TargetFilename condition="contains">\NVIDIA\NvBackend\ApplicationOntology\</TargetFilename> <!--NVIDIA GeForce Experience Application Ontology, 1000's of events in user profile-->
</FileCreateTime>
</RuleGroup>
</EventFiltering>
</Sysmon>
2_file_create_time/include_executables.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.30"> <!-- Taken from SwiftOnSecurity rules-->
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreateTime onmatch="include">
<TargetFilename name="technique_id=T1099,technique_name=Timestomp" condition="end with">.exe</TargetFilename> <!--Look for backdated executables anywhere-->
</FileCreateTime>
</RuleGroup>
</EventFiltering>
</Sysmon>
2_file_create_time/include_volume_shadow_copy.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.30"> <!-- Taken from SwiftOnSecurity rules-->
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreateTime onmatch="include">
<Image name="technique_id=T1099,technique_name=Timestomp" condition="begin with">\Device\HarddiskVolumeShadowCopy</Image> <!--Nothing should be written here | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1133030955407630336 ] -->
</FileCreateTime>
</RuleGroup>
</EventFiltering>
</Sysmon>
config_lists/default_list/default_list.csv
+3
View File
@@ -209,12 +209,15 @@ filepath,priority
17_18_pipe_event/include_tsvcpipe.xml,10
17_18_pipe_event/include_winreg.xml,10
2_file_create_time/exclude_chrome.xml,10
2_file_create_time/exclude_nvidia.xml,10
2_file_create_time/exclude_onedrive.xml,10
2_file_create_time/exclude_setups.xml,10
2_file_create_time/exclude_slack.xml,10
2_file_create_time/exclude_teams.xml,10
2_file_create_time/include_executables.xml,10
2_file_create_time/include_temp_folder.xml,10
2_file_create_time/include_users_folder.xml,10
2_file_create_time/include_volume_shadow_copy.xml,10
22_dns_query/exclude_ads.xml,10
22_dns_query/exclude_browser_updates.xml,10
22_dns_query/exclude_cdn_networks.xml,10
1 filepath priority
209 17_18_pipe_event/include_tsvcpipe.xml 10
210 17_18_pipe_event/include_winreg.xml 10
211 2_file_create_time/exclude_chrome.xml 10
212 2_file_create_time/exclude_nvidia.xml 10
213 2_file_create_time/exclude_onedrive.xml 10
214 2_file_create_time/exclude_setups.xml 10
215 2_file_create_time/exclude_slack.xml 10
216 2_file_create_time/exclude_teams.xml 10
217 2_file_create_time/include_executables.xml 10
218 2_file_create_time/include_temp_folder.xml 10
219 2_file_create_time/include_users_folder.xml 10
220 2_file_create_time/include_volume_shadow_copy.xml 10
221 22_dns_query/exclude_ads.xml 10
222 22_dns_query/exclude_browser_updates.xml 10
223 22_dns_query/exclude_cdn_networks.xml 10