config-a.xml

<Sysmon schemaversion="3.20">
  <HashAlgorithms>md5,imphash</HashAlgorithms>
  <EventFiltering>
    <ProcessCreate onmatch="include">
	      <Image condition="contains">cmd.exe</Image>
  	      <Image condition="contains">powershell.exe</Image>
  	      <Image condition="contains">wmic.exe</Image>
  	      <Image condition="contains">cscirpt.exe</Image>
  	      <Image condition="contains">wscript.exe</Image>
          <Image condition="contains">net.exe</Image>
          <Image condition="contains">psexec.exe</Image>
          <ParentImage condition="contains">cmd.exe</ParentImage>
          <ParentImage condition="contains">powershell.exe</ParentImage>
          <ParentImage condition="contains">wmic.exe</ParentImage>
          <ParentImage condition="contains">cscirpt.exe</ParentImage>
          <ParentImage condition="contains">wscript.exe</ParentImage>
          <ParentImage condition="contains">net.exe</ParentImage>
          <ParentImage condition="contains">psexec.exe</ParentImage>
          <ParentImage condition="contains">explorer.exe</ParentImage>
    </ProcessCreate>
  </EventFiltering>
</Sysmon>