admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

severe base noise reduction

Browse Source
This commit is contained in:
Olaf Hartong
2023-09-20 07:31:32 +00:00
parent db5a12a2a5
commit 5cd2c60668
3 changed files with 49 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
10_process_access/exclude_azure_monitor.xml
+14
View File
@@ -0,0 +1,14 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<Rule groupRelation="and">
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
<TargetImage condition="is">C:\Windows\system32\cscript.exe</TargetImage>
</Rule>
<SourceImage condition="contains all">C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
10_process_access/exclude_defender_for_endpoint copy.xml
+10
View File
@@ -0,0 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude">
<SourceImage condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage>
<SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage>
</ProcessAccess>
</RuleGroup>
</EventFiltering>
</Sysmon>
7_image_load/exclude_very_verbose.xml
+25
View File
@@ -0,0 +1,25 @@
<!--COMMENT: Filtering these commonly loaded DLLs, which are so verbose they incur a lot of cost and have limited to no detection value-->
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ImageLoad onmatch="exclude">
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\netapi32.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\msvcp110_win.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\dsreg.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\perfctrs.dll</ImageLoaded>
</Rule>
</ImageLoad>
</RuleGroup>
</EventFiltering>
</Sysmon>