Created
March 28, 2017 18:53
-
-
Save Cyb3rWard0g/a0fa35bc5badf505f803921f0fe40971 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<Sysmon schemaversion="3.30"> | |
<!-- Capture all hashes --> | |
<HashAlgorithms>md5</HashAlgorithms> | |
<EventFiltering> | |
<!-- Event ID 1 == Process Creation. --> | |
<ProcessCreate onmatch="include"/> | |
<!-- Event ID 2 == File Creation Time. --> | |
<FileCreateTime onmatch="include"/> | |
<!-- Event ID 3 == Network Connection. --> | |
<NetworkConnect onmatch="include"/> | |
<!-- Event ID 5 == Process Terminated. --> | |
<ProcessTerminate onmatch="include"/> | |
<!-- Event ID 6 == Driver Loaded.--> | |
<DriverLoad onmatch="include"/> | |
<!-- Event ID 7 == Image Loaded. --> | |
<ImageLoad onmatch="include"> | |
<Image condition="end with">winword.exe</Image> | |
<Image condition="end with">WINWORD.EXE</Image> | |
</ImageLoad> | |
<!-- Event ID 8 == CreateRemoteThread. --> | |
<CreateRemoteThread onmatch="include"/> | |
<!-- Event ID 9 == RawAccessRead. --> | |
<RawAccessRead onmatch="include"/> | |
<!-- Event ID 10 == ProcessAccess. --> | |
<ProcessAccess onmatch="include"/> | |
<!-- Event ID 11 == FileCreate. --> | |
<FileCreate onmatch="include"/> | |
<!-- Event ID 12,13,14 == RegObject added/deleted, RegValue Set, RegObject Renamed. --> | |
<RegistryEvent onmatch="include"/> | |
<!-- Event ID 15 == FileStream Created. --> | |
<FileCreateStreamHash onmatch="include"/> | |
<!-- Event ID 17 == PipeEvent. --> | |
<PipeEvent onmatch="include"/> | |
</EventFiltering> | |
</Sysmon> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment