admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Adding module load monitoring for vaultcli.dll (#110)"

Browse Source 
This reverts commit fa456c4adb.
This commit is contained in:
Olaf Hartong
2021-07-26 10:07:18 +02:00
committed by GitHub
parent f935f70367
commit 5aa02c122c
2 changed files with 0 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
7_image_load/exclude_vaulcmd_vaultcli.xml
-12
View File
@@ -1,12 +0,0 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ImageLoad onmatch="exclude">
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\VaultCmd.exe</Image>
<OriginalFileName condition="is">vaultcli.dll</OriginalFileName>
</Rule>
</ImageLoad>
</RuleGroup>
</EventFiltering>
</Sysmon>
7_image_load/include_vaultcli.xml
-9
View File
@@ -1,9 +0,0 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ImageLoad onmatch="include">
<ImageLoaded name="technique_id=T1555,technique_name=Credentials from Password Stores" condition="end with">vaultcli.dll</ImageLoaded>
</ImageLoad>
</RuleGroup>
</EventFiltering>
</Sysmon>