File tree 3 files changed +49
-0
lines changed 3 files changed +49
-0
lines changed Original file line number Diff line number Diff line change
1
+ <Sysmon schemaversion =" 4.30" >
2
+ <EventFiltering >
3
+ <RuleGroup name =" " groupRelation =" or" >
4
+ <ProcessAccess onmatch =" exclude" >
5
+ <Rule groupRelation =" and" >
6
+ <SourceImage condition =" is" >C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage >
7
+ <TargetImage condition =" is" >C:\Windows\system32\cscript.exe</TargetImage >
8
+ </Rule >
9
+ <SourceImage condition =" contains all" >C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage >
10
+ <SourceImage condition =" is" >C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage >
11
+ </ProcessAccess >
12
+ </RuleGroup >
13
+ </EventFiltering >
14
+ </Sysmon >
Original file line number Diff line number Diff line change
1
+ <Sysmon schemaversion =" 4.30" >
2
+ <EventFiltering >
3
+ <RuleGroup name =" " groupRelation =" or" >
4
+ <ProcessAccess onmatch =" exclude" >
5
+ <SourceImage condition =" is" >C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage >
6
+ <SourceImage condition =" contains all" >C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage >
7
+ </ProcessAccess >
8
+ </RuleGroup >
9
+ </EventFiltering >
10
+ </Sysmon >
Original file line number Diff line number Diff line change
1
+ <!-- COMMENT: Filtering these commonly loaded DLLs, which are so verbose they incur a lot of cost and have limited to no detection value-->
2
+ <Sysmon schemaversion =" 4.30" >
3
+ <EventFiltering >
4
+ <RuleGroup name =" " groupRelation =" or" >
5
+ <ImageLoad onmatch =" exclude" >
6
+ <Rule groupRelation =" and" >
7
+ <Image condition =" is" >C:\Windows\System32\svchost.exe</Image >
8
+ <ImageLoaded condition =" is" >C:\Windows\System32\netapi32.dll</ImageLoaded >
9
+ </Rule >
10
+ <Rule groupRelation =" and" >
11
+ <Image condition =" is" >C:\Windows\System32\svchost.exe</Image >
12
+ <ImageLoaded condition =" is" >C:\Windows\System32\msvcp110_win.dll</ImageLoaded >
13
+ </Rule >
14
+ <Rule groupRelation =" and" >
15
+ <Image condition =" is" >C:\Windows\System32\svchost.exe</Image >
16
+ <ImageLoaded condition =" is" >C:\Windows\System32\dsreg.dll</ImageLoaded >
17
+ </Rule >
18
+ <Rule groupRelation =" and" >
19
+ <Image condition =" is" >C:\Windows\System32\svchost.exe</Image >
20
+ <ImageLoaded condition =" is" >C:\Windows\System32\perfctrs.dll</ImageLoaded >
21
+ </Rule >
22
+ </ImageLoad >
23
+ </RuleGroup >
24
+ </EventFiltering >
25
+ </Sysmon >
You can’t perform that action at this time.
0 commit comments