admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

file_delete improvements

Browse Source
This commit is contained in:
Olaf Hartong
2023-06-21 13:31:43 +00:00
parent 7c69adc5c3
commit 9db8398102
3 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
0_custom_configuration/file_delete_modules.txt
+2
View File
@@ -1,6 +1,8 @@
23_file_delete/exclude_google_chrome.xml
23_file_delete/exclude_sophos_journal_temp.xml
23_file_delete/exclude_windows_services.xml
23_file_delete/include_microsoft_sql_server.xml
23_file_delete/include_qualys.xml
23_file_delete/include_user_writable_folders.xml
23_file_delete/include_writable_folders.xml
23_file_delete/include_interesting_files.xml
23_file_delete/interesting_files.xml → 23_file_delete/include_interesting_files.xml
View File
Merge-SysmonXml.ps1
-4
View File
@@ -533,10 +533,6 @@ function Merge-SysmonXml
<RuleGroup groupRelation="or">
<FileDelete onmatch="include"/>
</RuleGroup>
<!-- Event ID 23 == File Delete and overwrite events - Excludes -->
<RuleGroup groupRelation="or">
<FileDelete onmatch="exclude"/>
</RuleGroup>
<!-- Event ID 24 == Clipboard change events, only captures text, not files - Includes -->
<RuleGroup groupRelation="or">
<!-- Default set to disabled due to privacy implications and potential data you leave for attackers, enable with care!-->