Skip to content

Instantly share code, notes, and snippets.

@mattifestation
Created January 17, 2018 19:34
Show Gist options
  • Save mattifestation/73f52b0f6abdc14f35b2f2eb4fccbb2a to your computer and use it in GitHub Desktop.
Save mattifestation/73f52b0f6abdc14f35b2f2eb4fccbb2a to your computer and use it in GitHub Desktop.
<Sysmon schemaversion="4fuckyou">
<HashAlgorithms>md5,sha1</HashAlgorithms>
<EventFiltering>
<ProcessCreate onmatch="include">
</ProcessCreate>
<FileCreateTime onmatch="include">
</FileCreateTime>
<NetworkConnect onmatch="include">
</NetworkConnect>
<ProcessTerminate onmatch="include">
</ProcessTerminate>
<DriverLoad onmatch="include">
</DriverLoad>
<ImageLoad onmatch="include">
</ImageLoad>
<CreateRemoteThread onmatch="include">
</CreateRemoteThread>
<RawAccessRead onmatch="include">
</RawAccessRead>
<ProcessAccess onmatch="include">
</ProcessAccess>
<FileCreate onmatch="include">
</FileCreate>
<RegistryEvent onmatch="include">
</RegistryEvent>
<FileCreateStreamHash onmatch="include">
</FileCreateStreamHash>
<PipeEvent onmatch="include">
</PipeEvent>
<WmiEvent onmatch="include">
</WmiEvent>
</EventFiltering>
</Sysmon>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment