admin/trustedsec-SysmonCommunityGuide
1
0
Fork 0
mirror of https://github.com/trustedsec/SysmonCommunityGuide/ synced 2026-06-06 19:46:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Configuration Example re-format

Browse Source 
Re-formatted the configuration example to keep the lines shorter for when exported to PDF and other formats.
This commit is contained in:
Carlos Perez
2020-02-07 16:48:40 -04:00
committed by GitHub
parent ce7ea608b9
commit f282ff4b05
1 changed files with 32 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
create-remote-thread.md
+32 -14
View File
@@ -69,21 +69,39 @@ Example where known processes that use the API call are excluded
```xml
<Sysmon schemaversion="4.22">
<CheckRevocation/>
<CheckRevocation/>
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<CreateRemoteThread onmatch="exclude">
<!--The process activity of those in the list should be monitored since an-->
<!--attacker may host his actions in one of these to bypass detection.-->
<TargetImage condition="end with">Google\Chrome\Application\chrome.exe</TargetImage>
<SourceImage condition="is">C:\Windows\System32\wbem\WmiPrvSE.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\wininit.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\services.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\winlogon.exe</SourceImage>
<SourceImage condition="is">C:\Windows\System32\audiodg.exe</SourceImage>
<StartModule condition="is">C:\windows\system32\kernel32.dll</StartModule>
<RuleGroup name="" groupRelation="or">
<CreateRemoteThread onmatch="exclude">
<!--The process activity of those in the list should be monitored since an-->
<!--attacker may host his actions in one of these to bypass detection.-->
<TargetImage condition="end with">
Google\Chrome\Application\chrome.exe
</TargetImage>
<SourceImage condition="is">
C:\Windows\System32\wbem\WmiPrvSE.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\svchost.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\wininit.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\csrss.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\services.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\winlogon.exe
</SourceImage>
<SourceImage condition="is">
C:\Windows\System32\audiodg.exe
</SourceImage>
<StartModule condition="is">
C:\windows\system32\kernel32.dll
</StartModule>
</CreateRemoteThread>
</RuleGroup>
</EventFiltering>