admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

improvements on exclusion

Browse Source
This commit is contained in:
Olaf Hartong
2021-05-13 13:46:56 +02:00
parent c353268ce1
commit a26f72e14d
2 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
12_13_14_registry_event/exclude_windows_misc.xml
+5
View File
@@ -25,6 +25,11 @@
<TargetObject condition="is">HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Windows: Remove noise from Windows 10 Cortana | Credit @ion-storm--> <!--Win10-->
<Image condition="begin with">C:\$WINDOWS.~BT\</Image> <!--Microsoft:Windows: Update/Upgrade noise -->
<TargetObject condition="is">HKLM\System\CurrentControlSet\Services\Tcpip\Parameters</TargetObject>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\system32\lsass.exe</Image>
<TargetObject contains="begin with">HKLM\System\CurrentControlSet\Services</TargetObject>
</Rule>
</RegistryEvent>
</RuleGroup>
</EventFiltering>
7_image_load/exclude_cscript_scrobj.xml
+12
View File
@@ -0,0 +1,12 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ImageLoad onmatch="exclude">
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\cscript.exe</Image>
<OriginalFileName condition="is">scrobj.dll</OriginalFileName>
</Rule>
</ImageLoad>
</RuleGroup>
</EventFiltering>
</Sysmon>