Custom.CapsSysmon.Deploy.xml

name: Custom.CapsSysmon.Deploy
description: |
   A quick and dirty way to download and install sysmon via Velociraptor
# Can be CLIENT, CLIENT_EVENT, SERVER, SERVER_EVENT
type: CLIENT
parameters:
   - name: sysmonURL
     default: http://url.to/sysmon8_64.exe
   - name: binPath
     default: C:\sysmon.exe
   - name: configURL
     default: http://url.to/sysmon.xml
   - name: configPath
     default: C:\sysmon.xml
sources:
  - queries:
     - LET download_binary <= SELECT hash(path=Content) as Hash, Filename AS Name, "Downloaded" AS DownloadStatus, copy(filename=Content, dest=binPath) AS FullPath FROM http_client(url=sysmonURL, tempfile_extension=".exe", remove_last=TRUE)
     - LET download_config <= SELECT hash(path=Content) as Hash, Filename AS Name, "Downloaded" AS DownloadStatus, copy(filename=Content, dest=configPath) AS FullPath FROM http_client(url=configURL, tempfile_extension=".xml", remove_last=TRUE)
     - LET out = SELECT Stdout FROM execve(argv=[binPath, "-accepteula", "-i", configPath])