admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

include all wmi and remake config

Browse Source
This commit is contained in:
Connor Shade
2023-04-13 13:53:50 -04:00
parent d5af3c2f3a
commit f4600eb71a
3 changed files with 878 additions and 871 deletions
Download Patch File Download Diff File Expand all files Collapse all files
19_20_21_wmi_event/exclude_wmi_none.xml
+10
View File
@@ -0,0 +1,10 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<!-- COMMENT: Sysmon already performs some filtering on WMI events - it only logs ActiveScript and CommandLine consumers, since Attackers abuse those -->
<!-- COMMENT: The recommendation is to log everything for WMI: https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md -->
<WmiEvent onmatch="exclude">
</WmiEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>
config_lists/default_list/default_list.csv
+1
View File
@@ -217,6 +217,7 @@ filepath,priority
17_18_pipe_event/include_srvsvc.xml,10
17_18_pipe_event/include_tsvcpipe.xml,10
17_18_pipe_event/include_winreg.xml,10
19_20_21_wmi_event/exclude_wmi_none.xml,10
2_file_create_time/exclude_chrome.xml,10
2_file_create_time/exclude_nvidia.xml,10
2_file_create_time/exclude_onedrive.xml,10
1 filepath priority
217 17_18_pipe_event/include_srvsvc.xml 10
218 17_18_pipe_event/include_tsvcpipe.xml 10
219 17_18_pipe_event/include_winreg.xml 10
220 19_20_21_wmi_event/exclude_wmi_none.xml 10
221 2_file_create_time/exclude_chrome.xml 10
222 2_file_create_time/exclude_nvidia.xml 10
223 2_file_create_time/exclude_onedrive.xml 10
config_lists/default_list/default_list_config.xml
+867 -871
View File
File diff suppressed because it is too large Load Diff