admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

resolved incorrect field syntax

Browse Source
This commit is contained in:
Olaf Hartong
2021-06-21 09:25:24 +02:00
parent 7f7a08a90d
commit e420df2162
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
12_13_14_registry_event/exclude_scheduled_task_cache.xml
+1 -1
View File
@@ -4,7 +4,7 @@
<RegistryEvent onmatch="exclude">
<Rule groupRelation="and">
<Image condition="image">svchost.exe</Image>
<TargetImage condition="start with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks</TargetImage>
<TargetObject condition="start with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks</TargetObject>
</Rule>
</RegistryEvent>
</RuleGroup>
7_image_load/include_dotnet_load.xml
+7 -7
View File
@@ -4,31 +4,31 @@
<ImageLoad onmatch="include"> <!-- Credit https://redhead0ntherun.medium.com/detecting-net-c-injection-execute-assembly-1894dbb04ff7-->
<Rule groupRelation="and">
<OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">clr.dll</OriginalFileName>
<ParentImage condition="excludes">C:\Windows\Microsoft.NET\</ParentImage>
<Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
</Rule>
<Rule groupRelation="and">
<OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">clrjit.dll</OriginalFileName>
<ParentImage condition="excludes">C:\Windows\Microsoft.NET\</ParentImage>
<Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
</Rule>
<Rule groupRelation="and">
<OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscoreei.dll</OriginalFileName>
<ParentImage condition="excludes">C:\Windows\Microsoft.NET\</ParentImage>
<Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
</Rule>
<Rule groupRelation="and">
<OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscoree.dll</OriginalFileName>
<ParentImage condition="excludes">C:\Windows\Microsoft.NET\</ParentImage>
<Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
</Rule>
<Rule groupRelation="and">
<OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscoreeis.dll</OriginalFileName>
<ParentImage condition="excludes">C:\Windows\Microsoft.NET\</ParentImage>
<Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
</Rule>
<Rule groupRelation="and">
<OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscorlib.dll</OriginalFileName>
<ParentImage condition="excludes">C:\Windows\Microsoft.NET\</ParentImage>
<Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
</Rule>
<Rule groupRelation="and">
<OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscorlib.ni.dll</OriginalFileName>
<ParentImage condition="excludes">C:\Windows\Microsoft.NET\</ParentImage>
<Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
</Rule>
</ImageLoad>
</RuleGroup>