Skip to content

Instantly share code, notes, and snippets.

@olafhartong
Last active July 31, 2022 01:55
Show Gist options
  • Save olafhartong/56bfbbe1a43ba675fdf5b9f194d608af to your computer and use it in GitHub Desktop.
Save olafhartong/56bfbbe1a43ba675fdf5b9f194d608af to your computer and use it in GitHub Desktop.
<Sysmon schemaversion="4.70">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessCreate onmatch="exclude">
<Rule name="" groupRelation="and">
<Image condition="is">/usr/bin/groups</Image>
<ParentImage condition="is">/usr/bin/bash</ParentImage>
</Rule>
<Rule name="" groupRelation="and">
<Image condition="is">/usr/bin/locale-check</Image>
<ParentImage condition="is">/usr/bin/bash</ParentImage>
</Rule>
<Rule name="" groupRelation="and">
<Image condition="is">/usr/bin/dircolors</Image>
<ParentImage condition="is">/usr/bin/bash</ParentImage>
</Rule>
<Rule name="" groupRelation="and">
<Image condition="is">/usr/bin/mesg</Image>
<ParentImage condition="is">/usr/bin/bash</ParentImage>
</Rule>
<Rule name="" groupRelation="and">
<Image condition="is">/usr/bin/dirname</Image>
<CommandLine condition="is">dirname /usr/bin/lesspipe</CommandLine>
</Rule>
<Rule name="" groupRelation="and">
<Image condition="is">/usr/bin/basename</Image>
<ParentImage condition="is">/usr/bin/dash</ParentImage>
</Rule>
</ProcessCreate>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
<NetworkConnect onmatch="exclude">
<Image condition="is">/usr/lib/systemd/systemd-timesyncd</Image>
</NetworkConnect>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
<ProcessTerminate onmatch="exclude"/>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
<RawAccessRead onmatch="include"/>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
<ProcessAccess onmatch="exclude"/>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="exclude"/>
</RuleGroup>
<RuleGroup name="" groupRelation="or">
<FileDelete onmatch="exclude"/>
</RuleGroup>
</EventFiltering>
</Sysmon>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment