admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

excluding symantec and wmiadap

Browse Source 
excluding from process tempering event 
C:\Windows\System32\wbem\WMIADAP.exe
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin\XDelta64\xdelta3.exe
This commit is contained in:
Ali Alwashali
2022-12-18 11:04:30 +03:00
committed by GitHub
parent 4153d4c989
commit db02385f88
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
25_process_tampering/exclude_symantec.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.50">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessTampering onmatch="exclude">
<Image condition="is">C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin\XDelta64\xdelta3.exe</Image>
</ProcessTampering>
</RuleGroup>
</EventFiltering>
</Sysmon>
25_process_tampering/exclude_wmiadap.xml
+9
View File
@@ -0,0 +1,9 @@
<Sysmon schemaversion="4.50">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessTampering onmatch="exclude">
<Image condition="is">C:\Windows\System32\wbem\WMIADAP.exe</Image>
</ProcessTampering>
</RuleGroup>
</EventFiltering>
</Sysmon>