olafhartong

<manifest schemaversion="4.82" binaryversion="17">
  <configuration>
    <options>
      <!-- Command-line only options -->
      <option switch="i" name="Install" argument="optional" noconfig="true" exclusive="true" />
      <option switch="c" name="Configuration" argument="optional" noconfig="true" exclusive="true" />
      <option switch="u" name="UnInstall" argument="optional" noconfig="true" exclusive="true" />
      <option switch="m" name="Manifest" argument="none" noconfig="true" exclusive="true" />
      <option switch="z" name="ClipboardInstance" argument="required" noconfig="true" exclusive="true" />
      <option switch="t" name="DebugMode" argument="optional" noconfig="true" />

olafhartong

<Sysmon schemaversion="4.82">
   <EventFiltering>
      <RuleGroup name="" groupRelation="or">
         <FileBlockExecutable onmatch="include">
            <TargetFilename condition="contains all">C:\Users;Downloads</TargetFilename>
         </FileBlockExecutable>
      </RuleGroup>
   </EventFiltering>
</Sysmon>

olafhartong

<Sysmon schemaversion="4.82">
   <EventFiltering>
      <RuleGroup name="" groupRelation="or">
         <FileBlockExecutable onmatch="include">
		<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">excel.exe</Image>
		<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">winword.exe</Image>
		<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">powerpnt.exe</Image>
		<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">outlook.exe</Image>
		<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">msaccess.exe</Image>
		<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">mspub.exe</Image>

olafhartong

<manifest schemaversion="4.90" binaryversion="18">
  <configuration>
    <options>
      <!-- Command-line only options -->
      <option switch="i" name="Install" argument="optional" noconfig="true" exclusive="true" />
      <option switch="c" name="Configuration" argument="optional" noconfig="true" exclusive="true" />
      <option switch="u" name="UnInstall" argument="optional" noconfig="true" exclusive="true" />
      <option switch="m" name="Manifest" argument="none" noconfig="true" exclusive="true" />
      <option switch="z" name="ClipboardInstance" argument="required" noconfig="true" exclusive="true" />
      <option switch="t" name="DebugMode" argument="optional" noconfig="true" />