mirror of
https://github.com/olafhartong/sysmon-modular
synced 2026-06-08 16:29:39 +00:00
Olaf Hartong
14 lines
819 B
XML
14 lines
819 B
XML
<Sysmon schemaversion="4.60">
|
|
<EventFiltering>
|
|
<RuleGroup name="" groupRelation="or">
|
|
<ProcessAccess onmatch="include">
|
|
<Rule groupRelation="and"><!-- https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
|
|
<CallTrace name="technique_id=T1055,technique_name=Process Injection" condition="not begin with">C:\Windows\SYSTEM32\ntdll.dll</CallTrace>
|
|
<CallTrace name="technique_id=T1055,technique_name=Process Injection" condition="not begin with">C:\Windows\SYSTEM32\win32u.dll</CallTrace>
|
|
<CallTrace name="technique_id=T1055,technique_name=Process Injection" condition="not begin with">C:\Windows\SYSTEM32\wow64win.dll</CallTrace>
|
|
</Rule>
|
|
</ProcessAccess>
|
|
</RuleGroup>
|
|
</EventFiltering>
|
|
</Sysmon>
|