Skip to content

Commit 49cf8b1

Browse files
qjeromeqjerome
committed
Sysmon v10.41 configuration, schema-4.22
1 parent 59fdd01 commit 49cf8b1

File tree

3 files changed

+298
-0
lines changed

3 files changed

+298
-0
lines changed

‎tools/sysmon/v10/sysmon-v10.4x-all.xml

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
<Sysmon schemaversion="4.22">
2+
<!-- Capture All Hashes -->
3+
<HashAlgorithms>*</HashAlgorithms>
4+
<EventFiltering>
5+
6+
<!-- EventID: 1 -->
7+
<!-- Log all process creation -->
8+
<ProcessCreate onmatch="exclude"/>
9+
10+
<!-- EventID: 2 -->
11+
<!-- Log all file creation time stamps -->
12+
<FileCreateTime onmatch="exclude"/>
13+
14+
<!-- EventID: 3 -->
15+
<!-- Log all network connections -->
16+
<NetworkConnect onmatch="exclude"/>
17+
18+
<!-- EventID: 5 -->
19+
<!-- Log all process termination -->
20+
<ProcessTerminate onmatch="exclude" />
21+
22+
<!-- EventID: 6 -->
23+
<!-- Log all Drivers Loaded -->
24+
<DriverLoad onmatch="exclude" />
25+
26+
<!-- EventID: 7 -->
27+
<!-- Log all image loaded-->
28+
<!-- There is way too much image loaded by Sysmon.exe in this version -->
29+
<!-- Mostly due to the new feature of File Information -->
30+
<!-- This Schema needs to be adapted with the name of the service -->
31+
<RuleGroup groupRelation="or">
32+
<ImageLoad onmatch="exclude">
33+
<Image condition="is">C:\Windows\Sysmon.exe</Image>
34+
<Image condition="is">C:\Windows\Sysmon64.exe</Image>
35+
</ImageLoad>
36+
</RuleGroup>
37+
38+
39+
<!-- EventID: 8 -->
40+
<!-- Log all RemoteThread created -->
41+
<CreateRemoteThread onmatch="exclude" />
42+
43+
<!-- EventID: 9 -->
44+
<!-- Log all -->
45+
<RawAccessRead onmatch="exclude" />
46+
47+
<!-- EventID: 10 -->
48+
<!-- Log all -->
49+
<ProcessAccess onmatch="exclude" />
50+
51+
<!-- EventID: 11 -->
52+
<!-- Log all -->
53+
<FileCreate onmatch="exclude" />
54+
55+
<!-- EventID: 12/13/14 -->
56+
<!-- Log all registry operations -->
57+
<RuleGroup groupRelation="or">
58+
<RegistryEvent onmatch="exclude">
59+
<Image condition="is">C:\Windows\Sysmon.exe</Image>
60+
<Image condition="is">C:\Windows\Sysmon64.exe</Image>
61+
</RegistryEvent>
62+
</RuleGroup>
63+
64+
<!-- EventID: 15 -->
65+
<!-- Log all -->
66+
<FileCreateStreamHash onmatch="exclude" />
67+
68+
<!-- EventID: 17/18 -->
69+
<!-- Log all -->
70+
<PipeEvent onmatch="exclude" />
71+
72+
<!-- EventID: 19/20/21 -->
73+
<!-- Log all -->
74+
<WmiEvent onmatch="exclude" />
75+
76+
<!-- EventID: 22 -->
77+
<!-- Log all -->
78+
<DnsQuery onmatch="exclude" />
79+
80+
</EventFiltering>
81+
</Sysmon>

‎tools/sysmon/v10/sysmon-v10.4x-optimal.xml

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
<Sysmon schemaversion="4.22">
2+
<!-- Capture All Hashes -->
3+
<HashAlgorithms>*</HashAlgorithms>
4+
<EventFiltering>
5+
6+
<!-- EventID: 1 -->
7+
<!-- Log all process creation -->
8+
<ProcessCreate onmatch="exclude"/>
9+
10+
<!-- EventID: 2 -->
11+
<!-- Log all file creation time stamps -->
12+
<FileCreateTime onmatch="exclude"/>
13+
14+
<!-- EventID: 3 -->
15+
<!-- Log all network connections -->
16+
<NetworkConnect onmatch="exclude"/>
17+
18+
<!-- EventID: 5 -->
19+
<!-- Log all process termination -->
20+
<ProcessTerminate onmatch="exclude" />
21+
22+
<!-- EventID: 6 -->
23+
<!-- Log all Drivers Loaded -->
24+
<DriverLoad onmatch="exclude" />
25+
26+
<!-- EventID: 7 -->
27+
<!-- Log all image loaded-->
28+
<!-- There is way too much image loaded by Sysmon.exe in this version -->
29+
<!-- Mostly due to the new feature of File Information -->
30+
<!-- This Schema needs to be adapted with the name of the service -->
31+
<RuleGroup groupRelation="or">
32+
<ImageLoad onmatch="exclude">
33+
<Image condition="is">C:\Windows\Sysmon.exe</Image>
34+
<Image condition="is">C:\Windows\Sysmon64.exe</Image>
35+
<!-- Whitelist MS signatures -->
36+
<!-- Might cause some detection rules not to work -->
37+
<!-- example: checking for loading of vaultcli.dll -->
38+
<Signature condition="is">Microsoft Windows Publisher</Signature>
39+
<Signature condition="is">Microsoft Corporation</Signature>
40+
<Signature condition="is">Microsoft Windows</Signature>
41+
</ImageLoad>
42+
</RuleGroup>
43+
44+
45+
<!-- EventID: 8 -->
46+
<!-- Log all RemoteThread created -->
47+
<CreateRemoteThread onmatch="exclude" />
48+
49+
<!-- EventID: 9 -->
50+
<!-- Log all -->
51+
<RawAccessRead onmatch="exclude" />
52+
53+
<!-- EventID: 10 -->
54+
<!-- Filtered out the more noisy entries -->
55+
<RuleGroup groupRelation="or">
56+
<ProcessAccess onmatch="exclude">
57+
<!-- 0x1000 // PROCESS_QUERY_LIMITED_INFORMATION Second most frequent -->
58+
<GrantedAccess condition="is">0x1000</GrantedAccess>
59+
<!-- 0x2000 // UNKNOWN rights -->
60+
<GrantedAccess condition="is">0x2000</GrantedAccess>
61+
<!-- 0x3000 // UNKNOWN | PROCESS_QUERY_LIMITED_INFORMATION -->
62+
<GrantedAccess condition="is">0x3000</GrantedAccess>
63+
<!-- 0x100000 // SYNCHRONIZE -->
64+
<GrantedAccess condition="is">0x100000</GrantedAccess>
65+
<!-- 0x101000 // SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION -->
66+
<GrantedAccess condition="is">0x101000</GrantedAccess>
67+
<!-- responsible for a lot of ProcessAccess -->
68+
<SourceImage condition="is">C:\Windows\system32\wbem\wmiprvse.exe</SourceImage>
69+
</ProcessAccess>
70+
</RuleGroup>
71+
72+
<!-- EventID: 11 -->
73+
<!-- Log all -->
74+
<FileCreate onmatch="exclude" />
75+
76+
<!-- EventID: 12/13/14 -->
77+
<!-- CreateKey and DeleteKey are not taken to limit the number of registry operations -->
78+
<RuleGroup groupRelation="or">
79+
<RegistryEvent onmatch="exclude">
80+
<Image condition="is">C:\Windows\Sysmon.exe</Image>
81+
<Image condition="is">C:\Windows\Sysmon64.exe</Image>
82+
<!-- CreateKey and DeleteKey not taken -->
83+
<EventType condition="is not">SetValue</EventType>
84+
</RegistryEvent>
85+
</RuleGroup>
86+
87+
<!-- EventID: 15 -->
88+
<!-- Log all -->
89+
<FileCreateStreamHash onmatch="exclude" />
90+
91+
<!-- EventID: 17/18 -->
92+
<!-- Log all -->
93+
<PipeEvent onmatch="exclude" />
94+
95+
<!-- EventID: 19/20/21 -->
96+
<!-- Log all -->
97+
<WmiEvent onmatch="exclude" />
98+
99+
<!-- EventID: 22 -->
100+
<RuleGroup groupRelation="or">
101+
<DnsQuery onmatch="exclude">
102+
<Image condition="is">C:\Windows\Sysmon.exe</Image>
103+
<Image condition="is">C:\Windows\Sysmon64.exe</Image>
104+
</DnsQuery>
105+
</RuleGroup>
106+
107+
</EventFiltering>
108+
</Sysmon>

‎tools/sysmon/v10/sysmon-v10.4x-vbox-optimal.xml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
<Sysmon schemaversion="4.22">
2+
<!-- Capture All Hashes -->
3+
<HashAlgorithms>*</HashAlgorithms>
4+
<EventFiltering>
5+
6+
<!-- EventID: 1 -->
7+
<!-- Log all process creation -->
8+
<ProcessCreate onmatch="exclude"/>
9+
10+
<!-- EventID: 2 -->
11+
<!-- Log all file creation time stamps -->
12+
<FileCreateTime onmatch="exclude"/>
13+
14+
<!-- EventID: 3 -->
15+
<!-- Log all network connections -->
16+
<NetworkConnect onmatch="exclude"/>
17+
18+
<!-- EventID: 5 -->
19+
<!-- Log all process termination -->
20+
<ProcessTerminate onmatch="exclude" />
21+
22+
<!-- EventID: 6 -->
23+
<!-- Log all Drivers Loaded -->
24+
<DriverLoad onmatch="exclude" />
25+
26+
<!-- EventID: 7 -->
27+
<!-- Log all image loaded-->
28+
<!-- There is way too much image loaded by Sysmon.exe in this version -->
29+
<!-- Mostly due to the new feature of File Information -->
30+
<!-- This Schema needs to be adapted with the name of the service -->
31+
<RuleGroup groupRelation="or">
32+
<ImageLoad onmatch="exclude">
33+
<Image condition="is">C:\Windows\Sysmon.exe</Image>
34+
<Image condition="is">C:\Windows\Sysmon64.exe</Image>
35+
<!-- Whitelist MS signatures -->
36+
<!-- Might cause some detection rules not to work -->
37+
<!-- example: checking for loading of vaultcli.dll -->
38+
<Signature condition="is">Microsoft Windows Publisher</Signature>
39+
<Signature condition="is">Microsoft Corporation</Signature>
40+
<Signature condition="is">Microsoft Windows</Signature>
41+
</ImageLoad>
42+
</RuleGroup>
43+
44+
45+
<!-- EventID: 8 -->
46+
<!-- Log all RemoteThread created -->
47+
<CreateRemoteThread onmatch="exclude" />
48+
49+
<!-- EventID: 9 -->
50+
<!-- Log all -->
51+
<RawAccessRead onmatch="exclude" />
52+
53+
<!-- EventID: 10 -->
54+
<!-- Filtered out the more noisy entries -->
55+
<RuleGroup groupRelation="or">
56+
<ProcessAccess onmatch="exclude">
57+
<!-- 0x1000 // PROCESS_QUERY_LIMITED_INFORMATION Second most frequent -->
58+
<GrantedAccess condition="is">0x1000</GrantedAccess>
59+
<!-- 0x2000 // UNKNOWN rights -->
60+
<GrantedAccess condition="is">0x2000</GrantedAccess>
61+
<!-- 0x3000 // UNKNOWN | PROCESS_QUERY_LIMITED_INFORMATION -->
62+
<GrantedAccess condition="is">0x3000</GrantedAccess>
63+
<!-- 0x100000 // SYNCHRONIZE -->
64+
<GrantedAccess condition="is">0x100000</GrantedAccess>
65+
<!-- 0x101000 // SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION -->
66+
<GrantedAccess condition="is">0x101000</GrantedAccess>
67+
<!-- responsible for a lot of ProcessAccess -->
68+
<SourceImage condition="is">C:\Windows\system32\wbem\wmiprvse.exe</SourceImage>
69+
<SourceImage condition="is">C:\Windows\System32\VBoxService.exe</SourceImage>
70+
</ProcessAccess>
71+
</RuleGroup>
72+
73+
<!-- EventID: 11 -->
74+
<!-- Log all -->
75+
<FileCreate onmatch="exclude" />
76+
77+
<!-- EventID: 12/13/14 -->
78+
<!-- CreateKey and DeleteKey are not taken to limit the number of registry operations -->
79+
<RuleGroup groupRelation="or">
80+
<RegistryEvent onmatch="exclude">
81+
<Image condition="is">C:\Windows\Sysmon.exe</Image>
82+
<Image condition="is">C:\Windows\Sysmon64.exe</Image>
83+
<!-- CreateKey and DeleteKey not taken -->
84+
<EventType condition="is not">SetValue</EventType>
85+
</RegistryEvent>
86+
</RuleGroup>
87+
88+
<!-- EventID: 15 -->
89+
<!-- Log all -->
90+
<FileCreateStreamHash onmatch="exclude" />
91+
92+
<!-- EventID: 17/18 -->
93+
<!-- Log all -->
94+
<PipeEvent onmatch="exclude" />
95+
96+
<!-- EventID: 19/20/21 -->
97+
<!-- Log all -->
98+
<WmiEvent onmatch="exclude" />
99+
100+
<!-- EventID: 22 -->
101+
<RuleGroup groupRelation="or">
102+
<DnsQuery onmatch="exclude">
103+
<Image condition="is">C:\Windows\Sysmon.exe</Image>
104+
<Image condition="is">C:\Windows\Sysmon64.exe</Image>
105+
</DnsQuery>
106+
</RuleGroup>
107+
108+
</EventFiltering>
109+
</Sysmon>

0 commit comments

Comments
 (0)