olafhartong-sysmon-modular

admin/olafhartong-sysmon-modular

Fork 0

mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00

Commit Graph

Select branches

Hide Pull Requests

HEM-Inc-master

master

revert-110-master

v10.4

version-12

version-13-14

version-15

version-8

version-9

version1302

#101

#102

#103

#104

#105

#107

#108

#109

#110

#111

#113

#114

#115

#116

#118

#119

#121

#123

#124

#125

#126

#127

#128

#129

#134

#135

#139

#14

#143

#145

#147

#154

#157

#158

#159

#160

#160

#161

#164

#165

#169

#170

#171

#174

#175

#176

#176

#177

#177

#179

#179

#180

#180

#181

#181

#182

#182

#183

#183

#186

#186

#188

#188

#189

#192

#192

#195

#195

#2

#201

#201

#202

#202

#203

#203

#204

#204

#205

#205

#206

#206

#207

#207

#21

#210

#210

#211

#211

#214

#214

#219

#22

#23

#24

#27

#30

#31

#33

#37

#4

#44

#45

#48

#5

#51

#54

#56

#57

#58

#59

#60

#61

#63

#64

#67

#68

#70

#72

#73

#74

#75

#76

#77

#77

#80

#80

#82

#82

#83

#84

#85

#86

#93

#95

#97

a9ff298f6d Updated after successful CICD run 09/20/2023 07:33:02 UTC master Azure Pipeline 2023-09-20 07:33:03 +00:00
5cd2c60668 severe base noise reduction Olaf Hartong 2023-09-20 07:31:32 +00:00
db5a12a2a5 Update README.md for V15 Olaf Hartong 2023-06-27 23:42:25 +01:00
c8fc02e5d7 Updated after successful CICD run 06/27/2023 22:39:06 UTC Azure Pipeline 2023-06-27 22:39:07 +00:00
c171ccbd36 Merge pull request #175 from olafhartong/version-15 Olaf Hartong 2023-06-27 23:37:45 +01:00
d78d50cd4c relocate misplaced file version-15 Olaf Hartong 2023-06-22 16:49:34 +00:00
15dcb04d4a config improvements Olaf Hartong 2023-06-22 16:48:52 +00:00
0b05ee9ce1 FileExeDetect added Olaf Hartong 2023-06-22 16:48:38 +00:00
13168af9c9 added extra config version-13-14 Olaf Hartong 2023-06-21 16:26:49 +02:00
ce858558ff Merge pull request #143 from alwashali/Excluding-Desktop-Central Olaf Hartong 2023-06-21 16:23:54 +02:00
928f3dd185 Updated after successful CICD run 06/21/2023 14:21:16 UTC Azure Pipeline 2023-06-21 14:21:17 +00:00
91f1ee878d fix typo Olaf Hartong 2023-06-21 14:18:52 +00:00
36dfd22060 Updated after successful CICD run 06/21/2023 13:48:02 UTC Azure Pipeline 2023-06-21 13:48:04 +00:00
3f0dce6634 Updated after successful CICD run 06/21/2023 13:43:46 UTC Azure Pipeline 2023-06-21 13:43:47 +00:00
d7bc0e286c update files Olaf Hartong 2023-06-21 13:42:21 +00:00
9db8398102 file_delete improvements Olaf Hartong 2023-06-21 13:31:43 +00:00
7c69adc5c3 Updated after successful CICD run 06/21/2023 13:04:13 UTC Azure Pipeline 2023-06-21 13:04:14 +00:00
d174fe8ff9 added xcacls Olaf Hartong 2023-06-21 13:02:45 +00:00
2e449b72f3 Updated after successful CICD run 06/21/2023 12:57:18 UTC Azure Pipeline 2023-06-21 12:57:19 +00:00
e0ce6676bf add adws Olaf Hartong 2023-06-21 12:56:02 +00:00
fed8170449 updates and restructure Olaf Hartong 2023-06-21 14:46:56 +02:00
166376922d Updated after successful CICD run 06/21/2023 12:41:07 UTC Azure Pipeline 2023-06-21 12:41:08 +00:00
cec824854b Merge pull request #171 from cnnrshd/patch01 Olaf Hartong 2023-06-21 14:39:41 +02:00
52875744f3 Updated after successful CICD run 06/21/2023 12:00:34 UTC Azure Pipeline 2023-06-21 12:00:35 +00:00
dfb0982f82 Merge pull request #164 from thefunch/error_handling_xmlfile Olaf Hartong 2023-06-21 13:46:38 +02:00
862697f74b Updated after successful CICD run 06/21/2023 11:39:26 UTC Azure Pipeline 2023-06-21 11:39:27 +00:00
b76dfcf555 Merge pull request #174 from zbalkan/master Olaf Hartong 2023-06-21 13:37:43 +02:00
5aee922d95 Merge pull request #165 from benmontour/fixDetectedTypo Olaf Hartong 2023-06-21 13:36:33 +02:00
d439f1760c Merge pull request #169 from jaybirnuw/master Olaf Hartong 2023-06-21 13:35:32 +02:00
0a128b7aeb Update interesting_files.xml Zafer Balkan 2023-06-04 14:35:13 +03:00
768cd83d8b fix 1_lol and update xml Connor Shade 2023-04-13 14:32:10 -04:00
48b810c034 Fix technique ids Connor Shade 2023-04-13 14:22:25 -04:00
f4600eb71a include all wmi and remake config Connor Shade 2023-04-13 13:53:50 -04:00
d5af3c2f3a several changes to reg events, improve signals Connor Shade 2023-04-13 13:50:23 -04:00
d5f83e8b2d exclude powershell loading dotnet Connor Shade 2023-04-13 13:44:17 -04:00
23fed68cb5 add common callback port filters Connor Shade 2023-04-13 12:49:18 -04:00
e593dca3c2 merge and organize 3_lol Connor Shade 2023-04-13 12:47:01 -04:00
83311344bc Add rpcping detection to 1_lol Connor Shade 2023-04-13 12:46:47 -04:00
5ecab710e0 11 taskmanager lsass works now Connor Shade 2023-04-13 11:50:47 -04:00
bfa7ad51e2 merge script now forces top level grouprelation=or Connor Shade 2023-04-13 11:45:02 -04:00
d643a3a225 add rules to 11_file_create Connor Shade 2023-04-13 10:35:05 -04:00
a12b0f1821 improve 1_lol atbroker Connor Shade 2023-04-13 10:34:39 -04:00
7614d0e87c add exclude for chrome software reporter Connor Shade 2023-04-13 09:22:23 -04:00
1c97028b19 add filters to 2 - exe, vsc, remove nvidia Connor Shade 2023-04-13 07:42:02 -04:00
cb72ba2fb0 add 1_include_all rule Connor Shade 2023-04-13 07:39:06 -04:00
ddc829d993 extract shells to separate section for prio Connor Shade 2023-04-13 07:07:48 -04:00
14806a6aa9 sorted and organized 1_lol Connor Shade 2023-04-13 07:06:24 -04:00
04b23880fa Add sample data for merge script Connor Shade 2023-04-13 06:03:12 -04:00
4790ccfa6f add template, update merge python script Connor Shade 2023-04-13 06:02:51 -04:00
16b1ca42cf Create merge_sysmon_configs.py cws4197 2023-04-06 10:23:59 -04:00
f54d0c728f Update matrix-build.yml cws4197 2023-03-27 15:06:48 -04:00
df69ede067 Changed job name for building matrix cws4197 2023-03-27 15:01:30 -04:00
aa1b81f9c6 Update config-build.yml cws4197 2023-03-27 14:40:06 -04:00
ab7c9bd2f9 Create matrix-build.yml cws4197 2023-03-27 14:27:49 -04:00
4cfafd3b97 Merge pull request #1 from jaybirnuw/23_sophos_endpoint_journal_exception jaybirnuw 2023-03-09 15:32:43 -08:00
b71d92a4b0 Create exclude_sophos_journal_temp.xml jaybirnuw 2023-03-09 15:30:01 -08:00
45a3796ccc fixing referenced event 26 folder name typo Ben Montour 2023-02-14 13:54:36 -06:00
7f148186a8 fixing typo in event 26 folder name Ben Montour 2023-02-14 13:48:13 -06:00
e15d0af7af Display file name when XML load fails thefunch 2023-02-13 21:00:14 -05:00
965652e8b3 added youtube video Olaf Hartong 2023-01-04 11:47:38 +01:00
d5acf2d650 2023 bump Olaf Hartong 2023-01-03 18:46:05 +01:00
ab69d6d34b Updated after successful CICD run 01/01/2023 16:23:43 UTC Azure Pipeline 2023-01-01 16:23:44 +00:00
e2473fd8b3 Merge pull request #161 from alwashali/25_process_tampering-exclusions Olaf Hartong 2023-01-01 17:21:47 +01:00
8e90937ca1 Merge pull request #159 from kevinelwell/kevinelwell-4 Olaf Hartong 2023-01-01 17:21:06 +01:00
db02385f88 excluding symantec and wmiadap Ali Alwashali 2022-12-18 11:04:30 +03:00
247a47833c Changed vassadmin.exe to vssadmin.exe Kevin 2022-12-08 12:07:31 -05:00
c8a39738a4 Merge pull request #157 from Defensive-Depth/fixup Olaf Hartong 2022-12-08 17:42:26 +01:00
3ceec3bb87 Fix InclusionFolder error Josh Brower 2022-12-05 18:57:02 -05:00
fa1ae53132 Updated after successful CICD run 11/12/2022 19:57:53 UTC Azure Pipeline 2022-11-12 19:57:54 +00:00
d1e6b21c96 filter additional noise Olaf Hartong 2022-11-12 20:56:26 +01:00
63625bf391 Updated after successful CICD run 11/08/2022 09:48:50 UTC Azure Pipeline 2022-11-08 09:48:50 +00:00
c7b8b61f0a added vscode filters Olaf Hartong 2022-11-08 10:47:20 +01:00
d25759a97f Updated after successful CICD run 11/08/2022 08:27:20 UTC Azure Pipeline 2022-11-08 08:27:21 +00:00
43caa8f003 additional filters for noise Olaf Hartong 2022-11-08 09:25:51 +01:00
87dbf01bb1 Updated after successful CICD run 11/08/2022 07:51:13 UTC Azure Pipeline 2022-11-08 07:51:14 +00:00
96b85d4054 filter some additional noise Olaf Hartong 2022-11-08 08:50:03 +01:00
96c90a0c54 added pre-generated configs Olaf Hartong 2022-10-03 21:21:51 +02:00
bb379c5ccd Updated after successful CICD run 10/03/2022 19:01:44 UTC Azure Pipeline 2022-10-03 19:01:45 +00:00
332e1b0aba Merge branch 'master' of https://github.com/olafhartong/sysmon-modular Olaf Hartong 2022-10-03 20:57:12 +02:00
acebfd90ad first version of MDE-augment config Olaf Hartong 2022-10-03 20:50:53 +02:00
e84833d09a adding reseach config Olaf Hartong 2022-10-03 20:50:14 +02:00
567f6fb90c added note on basepath Olaf Hartong 2022-10-03 19:22:40 +02:00
feac45fbcf Update README.md Olaf Hartong 2022-09-10 10:53:58 +02:00
386b5656bc Update README.md Olaf Hartong 2022-09-10 10:50:00 +02:00
8634019675 added community section Olaf Hartong 2022-09-10 10:49:38 +02:00
a8e7cba4ea Updated after successful CICD run 09/05/2022 07:39:34 UTC Azure Pipeline 2022-09-05 07:39:35 +00:00
3c2246462f fixing https://github.com/olafhartong/sysmon-modular/issues/146 Olaf Hartong 2022-09-05 09:38:12 +02:00
56605b7d41 Updated after successful CICD run 08/31/2022 10:18:37 UTC Azure Pipeline 2022-08-31 10:18:38 +00:00
90935c5723 added file monitoring Olaf Hartong 2022-08-31 12:17:32 +02:00
2e629b44ee Updated after successful CICD run 08/31/2022 10:09:21 UTC Azure Pipeline 2022-08-31 10:09:21 +00:00
df73d65d9a registry monitoring improvements Olaf Hartong 2022-08-31 12:08:16 +02:00
279fe42c10 Updated after successful CICD run 08/31/2022 07:47:46 UTC Azure Pipeline 2022-08-31 07:47:47 +00:00
3df6c527c0 refined via https://github.com/olafhartong/sysmon-modular/issues/141 Olaf Hartong 2022-08-31 09:46:38 +02:00
88867bb5aa Updated after successful CICD run 08/31/2022 07:42:20 UTC Azure Pipeline 2022-08-31 07:42:21 +00:00
8a433ef716 added psscriptpolicy file exclusion Olaf Hartong 2022-08-31 09:41:10 +02:00
429c8d1e97 Updated after successful CICD run 08/31/2022 07:32:33 UTC Azure Pipeline 2022-08-31 07:32:33 +00:00
39ab7223bf https://github.com/olafhartong/sysmon-modular/issues/132 Olaf Hartong 2022-08-31 09:31:27 +02:00
8384141817 Updated after successful CICD run 08/31/2022 07:28:20 UTC Azure Pipeline 2022-08-31 07:28:21 +00:00
744cb886fb several improvements Olaf Hartong 2022-08-31 09:27:04 +02:00
495185b482 Updated after successful CICD run 08/31/2022 07:20:50 UTC Azure Pipeline 2022-08-31 07:20:51 +00:00

1 2 3 4 5 ...