Skip to content

Commit 5cd2c60

Browse files
committed
severe base noise reduction
1 parent db5a12a commit 5cd2c60

File tree

3 files changed

+49
-0
lines changed

3 files changed

+49
-0
lines changed
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<Sysmon schemaversion="4.30">
2+
<EventFiltering>
3+
<RuleGroup name="" groupRelation="or">
4+
<ProcessAccess onmatch="exclude">
5+
<Rule groupRelation="and">
6+
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
7+
<TargetImage condition="is">C:\Windows\system32\cscript.exe</TargetImage>
8+
</Rule>
9+
<SourceImage condition="contains all">C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage>
10+
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
11+
</ProcessAccess>
12+
</RuleGroup>
13+
</EventFiltering>
14+
</Sysmon>
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<Sysmon schemaversion="4.30">
2+
<EventFiltering>
3+
<RuleGroup name="" groupRelation="or">
4+
<ProcessAccess onmatch="exclude">
5+
<SourceImage condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage>
6+
<SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage>
7+
</ProcessAccess>
8+
</RuleGroup>
9+
</EventFiltering>
10+
</Sysmon>

7_image_load/exclude_very_verbose.xml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!--COMMENT: Filtering these commonly loaded DLLs, which are so verbose they incur a lot of cost and have limited to no detection value-->
2+
<Sysmon schemaversion="4.30">
3+
<EventFiltering>
4+
<RuleGroup name="" groupRelation="or">
5+
<ImageLoad onmatch="exclude">
6+
<Rule groupRelation="and">
7+
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
8+
<ImageLoaded condition="is">C:\Windows\System32\netapi32.dll</ImageLoaded>
9+
</Rule>
10+
<Rule groupRelation="and">
11+
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
12+
<ImageLoaded condition="is">C:\Windows\System32\msvcp110_win.dll</ImageLoaded>
13+
</Rule>
14+
<Rule groupRelation="and">
15+
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
16+
<ImageLoaded condition="is">C:\Windows\System32\dsreg.dll</ImageLoaded>
17+
</Rule>
18+
<Rule groupRelation="and">
19+
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
20+
<ImageLoaded condition="is">C:\Windows\System32\perfctrs.dll</ImageLoaded>
21+
</Rule>
22+
</ImageLoad>
23+
</RuleGroup>
24+
</EventFiltering>
25+
</Sysmon>

0 commit comments

Comments
 (0)