mirror of
https://github.com/olafhartong/sysmon-modular
synced 2026-06-08 16:29:39 +00:00
Olaf Hartong
21 lines
1.1 KiB
XML
21 lines
1.1 KiB
XML
<Sysmon schemaversion="4.30">
|
|
<EventFiltering>
|
|
<RuleGroup name="" groupRelation="or">
|
|
<CreateRemoteThread onmatch="exclude">
|
|
<!--COMMENT: Monitor for processes injecting code into other processes. Often used by malware to cloak their actions.
|
|
Exclude mostly-safe sources and log anything else.-->
|
|
<SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
|
|
<SourceImage condition="is">C:\Windows\System32\wininit.exe</SourceImage>
|
|
<SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
|
|
<SourceImage condition="is">C:\Windows\System32\services.exe</SourceImage>
|
|
<SourceImage condition="is">C:\Windows\System32\winlogon.exe</SourceImage>
|
|
<SourceImage condition="is">C:\Windows\System32\audiodg.exe</SourceImage>
|
|
<StartModule condition="is">C:\windows\system32\kernel32.dll</StartModule>
|
|
<Rule groupRelation="and">
|
|
<SourceImage condition="is">C:\Windows\System32\dwm.exe</SourceImage>
|
|
<TargetImage condition="is">C:\Windows\System32\csrss.exe</TargetImage>
|
|
</Rule>
|
|
</CreateRemoteThread>
|
|
</RuleGroup>
|
|
</EventFiltering>
|
|
</Sysmon> |