Skip to content

Instantly share code, notes, and snippets.

@W00t3k
Forked from mattifestation/EmptyConfig.xml
Created January 19, 2018 16:47
Show Gist options
  • Save W00t3k/276c11301604f7c627d090165b365352 to your computer and use it in GitHub Desktop.
Save W00t3k/276c11301604f7c627d090165b365352 to your computer and use it in GitHub Desktop.
<Sysmon schemaversion="4fuckyou">
<HashAlgorithms>md5,sha1</HashAlgorithms>
<EventFiltering>
<ProcessCreate onmatch="include">
</ProcessCreate>
<FileCreateTime onmatch="include">
</FileCreateTime>
<NetworkConnect onmatch="include">
</NetworkConnect>
<ProcessTerminate onmatch="include">
</ProcessTerminate>
<DriverLoad onmatch="include">
</DriverLoad>
<ImageLoad onmatch="include">
</ImageLoad>
<CreateRemoteThread onmatch="include">
</CreateRemoteThread>
<RawAccessRead onmatch="include">
</RawAccessRead>
<ProcessAccess onmatch="include">
</ProcessAccess>
<FileCreate onmatch="include">
</FileCreate>
<RegistryEvent onmatch="include">
</RegistryEvent>
<FileCreateStreamHash onmatch="include">
</FileCreateStreamHash>
<PipeEvent onmatch="include">
</PipeEvent>
<WmiEvent onmatch="include">
</WmiEvent>
</EventFiltering>
</Sysmon>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment