admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix. Thanks to @blackmatter23

Browse Source
This commit is contained in:
Olaf Hartong
2021-05-13 21:37:45 +02:00
committed by GitHub
parent e081adc436
commit 6801233174
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
8_create_remote_thread/exclude_generic_windows_processes.xml
+1 -2
View File
@@ -10,7 +10,6 @@
<SourceImage condition="is">C:\Windows\System32\services.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\winlogon.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\audiodg.exe</SourceImage>
<StartModule condition="is">C:\windows\system32\kernel32.dll</StartModule>
<Rule groupRelation="and">
<SourceImage condition="is">C:\Windows\System32\dwm.exe</SourceImage>
<TargetImage condition="is">C:\Windows\System32\csrss.exe</TargetImage>
@@ -18,4 +17,4 @@
</CreateRemoteThread>
</RuleGroup>
</EventFiltering>
</Sysmon>
</Sysmon>