Sysmon Base Configuration - Windows Server

config-server.xml

<!--
   This is a Microsoft Sysmon configuation to be used on Windows server systems
   v0.1
   Florian Roth

   The focus of this configuration is
   - hacking activity on servers / lateral movement (bad admin, attacker)
   It is not focussed on
   - malware detection (execution)
   - malware detection (network connections)
   
   See Windows workstation base config: https://gist.github.com/Neo23x0/f56bea38d95040b70cf5
-->
<Sysmon schemaversion="2.01">
   <!-- Capture MD5 Hashes -->
   <HashAlgorithms>*</HashAlgorithms>
   <EventFiltering>
      <!-- Log all drivers except if the signature -->
      <!-- contains Microsoft or Windows -->
      <DriverLoad onmatch="exclude">
         <Signature condition="contains">microsoft</Signature>
         <Signature condition="contains">windows</Signature>
      </DriverLoad>
      <!-- Exclude certain processes that cause high event volumes -->
      <ProcessCreate onmatch="exclude">
         <Image condition="contains">splunk</Image>
         <Image condition="contains">btool.exe</Image>
         <Image condition="contains">SnareCore</Image>
         <Image condition="contains">nxlog</Image>
         <Image condition="contains">Microsoft Monitoring Agent\Agent\MonitoringHost.exe</Image>
         <CommandLine condition="contains">ClearMyTracksByProcess</CommandLine>
      </ProcessCreate>
      <!-- Do not log file creation time stamps -->
      <FileCreateTime onmatch="include"/>
      <!-- Do not log raw disk access (caused event flooding with certain disk encryption drivers) -->
      <RawAccessRead onmatch="include"/>
      <!-- Do not log process termination -->
      <ProcessTerminate onmatch="include"/>
      <!-- Do only log network connections to web ports -->
      <NetworkConnect onmatch="include">
         <DestinationPort condition="is">80</DestinationPort>
         <DestinationPort condition="is">443</DestinationPort>
         <DestinationPort condition="is">8080</DestinationPort>
         <DestinationPort condition="is">3389</DestinationPort>
         <Image condition="contains">PsExe</Image>
         <Image condition="contains">winexe</Image>
         <Image condition="contains">powershell</Image>
         <Image condition="contains">wscript</Image>
         <Image condition="contains">mstsc</Image>
         <Image condition="contains">RTS2App</Image>
         <Image condition="contains">RTS3App</Image>
         <Image condition="contains">wmic</Image>
      </NetworkConnect>
   </EventFiltering>
</Sysmon>