├── README.md
├── SysmonForLinux
    ├── ReadME.md
    └── config.xml
├── startupscript.bat
├── sysmonconfig.xml
└── sysmonv9.xml


/README.md:
--------------------------------------------------------------------------------
1 | # Sysmon configuration and scripts
2 | Create a GPO startup script and execute the batch file from it. The script terminates if it finds sysmonconfig.xml in C:\Windows modify it with the new config name.
3 | # Sysmon V9.0
4 | In sysmon v9.0 config file we added some of the detections from JPCERT https://jpcertcc.github.io/ToolAnalysisResultSheet/. 
5 | We also included most of https://github.com/olafhartong/sysmon-modular and also some of https://github.com/Neo23x0/sigma/tree/master/rules/windows/sysmon. 
6 | Our target is to map most of the MITRE Att@ck/JPCERT in this sysmon config. You might need to add exclusion for some of the software your enivroment including Antivirus/EDR/Whitelisting...etc. Also some of the events are noisy like pipe related events.
7 | 


--------------------------------------------------------------------------------
/SysmonForLinux/ReadME.md:
--------------------------------------------------------------------------------
 1 | # Config File
 2 | The config file is this repo is based on MSTIC config file we have added to it 
 3 | * Sigma Rules for Linux Detections
 4 | * GTFOBins Detections
 5 | * Malware research articles detection on Linux
 6 |  # Live log view
 7 |  ```journalctl  -f | /opt/sysmon/sysmonLogView```
 8 | 
 9 | 
10 | 
11 | # References
12 | https://pberba.github.io/security/2021/11/22/linux-threat-hunting-for-persistence-sysmon-auditd-webshell/
13 | https://www.lares.com/blog/sysmon-for-linux-test-drive/
14 | https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/
15 | https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/main.xml
16 | 


--------------------------------------------------------------------------------
/SysmonForLinux/config.xml:
--------------------------------------------------------------------------------
  1 | <!--
  2 |     SysmonForLinux
  3 | 
  4 |     Copyright (c) Microsoft Corporation
  5 | 
  6 |     All rights reserved.
  7 | 
  8 |     MIT License
  9 | 
 10 |     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the ""Software""), to deal in the Software without
 11 |  restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom th
 12 | e Software is furnished to do so, subject to the following conditions:
 13 | 
 14 |     The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 15 | 
 16 |     THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE
 17 |  AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISI
 18 | NG FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 19 | Config is based on MSTIC config with GTFObins added...etc
 20 | 
 21 | -->
 22 | <Sysmon schemaversion="4.81">
 23 |   <EventFiltering>
 24 |     <!-- Event ID 1 == ProcessCreate -->
 25 |     <RuleGroup name="" groupRelation="or">
 26 |       <ProcessCreate onmatch="include">
 27 |         <Rule name="TechniqueID=T1021.004,TechniqueName=Remote Services: SSH" groupRelation="and">
 28 |           <Image condition="end with">ssh</Image>
 29 |           <CommandLine condition="contains">ConnectTimeout=</CommandLine>
 30 |           <CommandLine condition="contains">BatchMode=yes</CommandLine>
 31 |           <CommandLine condition="contains">StrictHostKeyChecking=no</CommandLine>
 32 |           <CommandLine condition="contains any">wget;curl</CommandLine>
 33 |         </Rule>
 34 | 
 35 |         <Rule name="TechniqueID=T1027.001,TechniqueName=Obfuscated Files or Information: Binary Padding" groupRelation="and">
 36 |           <Image condition="is">/bin/dd</Image>
 37 |           <CommandLine condition="contains all">dd;if=</CommandLine>
 38 |         </Rule>
 39 |         <Rule name="TechniqueID=T1033,TechniqueName=System Owner/User Discovery" groupRelation="or">
 40 |           <CommandLine condition="contains">/var/run/utmp</CommandLine>
 41 |           <CommandLine condition="contains">/var/log/btmp</CommandLine>
 42 |           <CommandLine condition="contains">/var/log/wtmp</CommandLine>
 43 |         </Rule>
 44 |         <Rule name="TechniqueID=T1053.003,TechniqueName=Scheduled Task/Job: Cron" groupRelation="or">
 45 |           <Image condition="end with">crontab</Image>
 46 |         </Rule>
 47 |         <Rule name="group_modification" groupRelation="or">
 48 |          <Image condition="end with">groupmod</Image>
 49 |          <Image condition="end with">addgroup</Image>
 50 |          <Image condition="end with">groupadd</Image>
 51 |        </Rule>
 52 |        <Rule name="user_modification" groupRelation="or">
 53 |          <Image condition="end with">usermod</Image>
 54 |          <Image condition="end with">userdel</Image>
 55 |        </Rule>
 56 |        <Rule name="passwd_modification" groupRelation="or">
 57 |          <Image condition="end with">passwd</Image>
 58 |        </Rule>
 59 |         <Rule name="TechniqueID=T1059.004,TechniqueName=Command and Scripting Interpreter: Unix Shell" groupRelation="or">
 60 |           <Image condition="end with">/bin/bash</Image>
 61 |           <Image condition="end with">/bin/dash</Image>
 62 |           <Image condition="end with">/bin/sh</Image>
 63 |           <ParentImage condition="end with">aa-exec</ParentImage>
 64 |           <ParentImage condition="end with">ansible-playbook</ParentImage>
 65 |           <ParentImage condition="end with">ansible-test</ParentImage>
 66 |           <ParentImage condition="end with">aoss</ParentImage>
 67 |           <ParentImage condition="end with">apt-get</ParentImage>
 68 |           <ParentImage condition="end with">apt</ParentImage>
 69 |           <ParentImage condition="end with">ash</ParentImage>
 70 |           <ParentImage condition="end with">at</ParentImage>
 71 |           <ParentImage condition="end with">awk</ParentImage>
 72 |           <ParentImage condition="end with">aws</ParentImage>
 73 |           <ParentImage condition="end with">batcat</ParentImage>
 74 |           <ParentImage condition="end with">bconsole</ParentImage>
 75 |           <ParentImage condition="end with">bundle</ParentImage>
 76 |           <ParentImage condition="end with">bundler</ParentImage>
 77 |           <ParentImage condition="end with">busctl</ParentImage>
 78 |           <ParentImage condition="end with">busybox</ParentImage>
 79 |           <ParentImage condition="end with">byebug</ParentImage>
 80 |           <ParentImage condition="end with">c89</ParentImage>
 81 |           <ParentImage condition="end with">c99</ParentImage>
 82 |           <ParentImage condition="end with">cabal</ParentImage>
 83 |           <ParentImage condition="end with">capsh</ParentImage>
 84 |           <ParentImage condition="end with">cdist</ParentImage>
 85 |           <ParentImage condition="end with">certbot</ParentImage>
 86 |           <ParentImage condition="end with">check_by_ssh</ParentImage>
 87 |           <ParentImage condition="end with">choom</ParentImage>
 88 |           <ParentImage condition="end with">cobc</ParentImage>
 89 |           <ParentImage condition="end with">composer</ParentImage>
 90 |           <ParentImage condition="end with">cowsay</ParentImage>
 91 |           <ParentImage condition="end with">cowthink</ParentImage>
 92 |           <ParentImage condition="end with">cpan</ParentImage>
 93 |           <ParentImage condition="end with">cpio</ParentImage>
 94 |           <ParentImage condition="end with">cpulimit</ParentImage>
 95 |           <ParentImage condition="end with">crash</ParentImage>
 96 |           <ParentImage condition="end with">csh</ParentImage>
 97 |           <ParentImage condition="end with">csvtool</ParentImage>
 98 |           <ParentImage condition="end with">dc</ParentImage>
 99 |           <ParentImage condition="end with">distcc</ParentImage>
100 |           <ParentImage condition="end with">dmesg</ParentImage>
101 |           <ParentImage condition="end with">dotnet</ParentImage>
102 |           <ParentImage condition="end with">dpkg</ParentImage>
103 |           <ParentImage condition="end with">dstat</ParentImage>
104 |           <ParentImage condition="end with">dvips</ParentImage>
105 |           <ParentImage condition="end with">easy_install</ParentImage>
106 |           <ParentImage condition="end with">eb</ParentImage>
107 |           <ParentImage condition="end with">ed</ParentImage>
108 |           <ParentImage condition="end with">elvish</ParentImage>
109 |           <ParentImage condition="end with">emacs</ParentImage>
110 |           <ParentImage condition="end with">enscript</ParentImage>
111 |           <ParentImage condition="end with">env</ParentImage>
112 |           <ParentImage condition="end with">ex</ParentImage>
113 |           <ParentImage condition="end with">expect</ParentImage>
114 |           <ParentImage condition="end with">facter</ParentImage>
115 |           <ParentImage condition="end with">find</ParentImage>
116 |           <ParentImage condition="end with">fish</ParentImage>
117 |           <ParentImage condition="end with">flock</ParentImage>
118 |           <ParentImage condition="end with">ftp</ParentImage>
119 |           <ParentImage condition="end with">gawk</ParentImage>
120 |           <ParentImage condition="end with">gcc</ParentImage>
121 |           <ParentImage condition="end with">gcloud</ParentImage>
122 |           <ParentImage condition="end with">gdb</ParentImage>
123 |           <ParentImage condition="end with">gem</ParentImage>
124 |           <ParentImage condition="end with">genie</ParentImage>
125 |           <ParentImage condition="end with">ghc</ParentImage>
126 |           <ParentImage condition="end with">ghci</ParentImage>
127 |           <ParentImage condition="end with">gimp</ParentImage>
128 |           <ParentImage condition="end with">ginsh</ParentImage>
129 |           <ParentImage condition="end with">git</ParentImage>
130 |           <ParentImage condition="end with">grc</ParentImage>
131 |           <ParentImage condition="end with">gtester</ParentImage>
132 |           <ParentImage condition="end with">hping3</ParentImage>
133 |           <ParentImage condition="end with">iftop</ParentImage>
134 |           <ParentImage condition="end with">ionice</ParentImage>
135 |           <ParentImage condition="end with">irb</ParentImage>
136 |           <ParentImage condition="end with">ispell</ParentImage>
137 |           <ParentImage condition="end with">jjs</ParentImage>
138 |           <ParentImage condition="end with">joe</ParentImage>
139 |           <ParentImage condition="end with">journalctl</ParentImage>
140 |           <ParentImage condition="end with">jrunscript</ParentImage>
141 |           <ParentImage condition="end with">jtag</ParentImage>
142 |           <ParentImage condition="end with">julia</ParentImage>
143 |           <ParentImage condition="end with">knife</ParentImage>
144 |           <ParentImage condition="end with">ksh</ParentImage>
145 |           <ParentImage condition="end with">latex</ParentImage>
146 |           <ParentImage condition="end with">latexmk</ParentImage>
147 |           <ParentImage condition="end with">ld.so</ParentImage>
148 |           <ParentImage condition="end with">less</ParentImage>
149 |           <ParentImage condition="end with">lftp</ParentImage>
150 |           <ParentImage condition="end with">loginctl</ParentImage>
151 |           <ParentImage condition="end with">logsave</ParentImage>
152 |           <ParentImage condition="end with">ltrace</ParentImage>
153 |           <ParentImage condition="end with">lua</ParentImage>
154 |           <ParentImage condition="end with">lualatex</ParentImage>
155 |           <ParentImage condition="end with">luatex</ParentImage>
156 |           <ParentImage condition="end with">mail</ParentImage>
157 |           <ParentImage condition="end with">make</ParentImage>
158 |           <ParentImage condition="end with">man</ParentImage>
159 |           <ParentImage condition="end with">mawk</ParentImage>
160 |           <ParentImage condition="end with">minicom</ParentImage>
161 |           <ParentImage condition="end with">more</ParentImage>
162 |           <ParentImage condition="end with">msfconsole</ParentImage>
163 |           <ParentImage condition="end with">msgfilter</ParentImage>
164 |           <ParentImage condition="end with">multitime</ParentImage>
165 |           <ParentImage condition="end with">mysql</ParentImage>
166 |           <ParentImage condition="end with">nano</ParentImage>
167 |           <ParentImage condition="end with">nawk</ParentImage>
168 |           <ParentImage condition="end with">ncdu</ParentImage>
169 |           <ParentImage condition="end with">ncftp</ParentImage>
170 |           <ParentImage condition="end with">neofetch</ParentImage>
171 |           <ParentImage condition="end with">nice</ParentImage>
172 |           <ParentImage condition="end with">nmap</ParentImage>
173 |           <ParentImage condition="end with">node</ParentImage>
174 |           <ParentImage condition="end with">nohup</ParentImage>
175 |           <ParentImage condition="end with">npm</ParentImage>
176 |           <ParentImage condition="end with">nroff</ParentImage>
177 |           <ParentImage condition="end with">nsenter</ParentImage>
178 |           <ParentImage condition="end with">octave</ParentImage>
179 |           <ParentImage condition="end with">openvpn</ParentImage>
180 |           <ParentImage condition="end with">pandoc</ParentImage>
181 |           <ParentImage condition="end with">pdb</ParentImage>
182 |           <ParentImage condition="end with">pdflatex</ParentImage>
183 |           <ParentImage condition="end with">pdftex</ParentImage>
184 |           <ParentImage condition="end with">perf</ParentImage>
185 |           <ParentImage condition="end with">perl</ParentImage>
186 |           <ParentImage condition="end with">perlbug</ParentImage>
187 |           <ParentImage condition="end with">pexec</ParentImage>
188 |           <ParentImage condition="end with">pg</ParentImage>
189 |           <ParentImage condition="end with">php</ParentImage>
190 |           <ParentImage condition="end with">pic</ParentImage>
191 |           <ParentImage condition="end with">pico</ParentImage>
192 |           <ParentImage condition="end with">pip</ParentImage>
193 |           <ParentImage condition="end with">posh</ParentImage>
194 |           <ParentImage condition="end with">pry</ParentImage>
195 |           <ParentImage condition="end with">psftp</ParentImage>
196 |           <ParentImage condition="end with">psql</ParentImage>
197 |           <ParentImage condition="end with">puppet</ParentImage>
198 |           <ParentImage condition="end with">pwsh</ParentImage>
199 |           <ParentImage condition="end with">python</ParentImage>
200 |           <ParentImage condition="end with">rake</ParentImage>
201 |           <ParentImage condition="end with">rc</ParentImage>
202 |           <ParentImage condition="end with">rlwrap</ParentImage>
203 |           <ParentImage condition="end with">rpm</ParentImage>
204 |           <ParentImage condition="end with">rpmdb</ParentImage>
205 |           <ParentImage condition="end with">rpmquery</ParentImage>
206 |           <ParentImage condition="end with">rpmverify</ParentImage>
207 |           <ParentImage condition="end with">rsync</ParentImage>
208 |           <ParentImage condition="end with">rtorrent</ParentImage>
209 |           <ParentImage condition="end with">ruby</ParentImage>
210 |           <ParentImage condition="end with">run-mailcap</ParentImage>
211 |           <ParentImage condition="end with">run-parts</ParentImage>
212 |           <ParentImage condition="end with">runscript</ParentImage>
213 |           <ParentImage condition="end with">rview</ParentImage>
214 |           <ParentImage condition="end with">rvim</ParentImage>
215 |           <ParentImage condition="end with">sash</ParentImage>
216 |           <ParentImage condition="end with">scanmem</ParentImage>
217 |           <ParentImage condition="end with">scp</ParentImage>
218 |           <ParentImage condition="end with">screen</ParentImage>
219 |           <ParentImage condition="end with">script</ParentImage>
220 |           <ParentImage condition="end with">scrot</ParentImage>
221 |           <ParentImage condition="end with">sed</ParentImage>
222 |           <ParentImage condition="end with">service</ParentImage>
223 |           <ParentImage condition="end with">setarch</ParentImage>
224 |           <ParentImage condition="end with">setlock</ParentImage>
225 |           <ParentImage condition="end with">sftp</ParentImage>
226 |           <ParentImage condition="end with">sg</ParentImage>
227 |           <ParentImage condition="end with">slsh</ParentImage>
228 |           <ParentImage condition="end with">smbclient</ParentImage>
229 |           <ParentImage condition="end with">socat</ParentImage>
230 |           <ParentImage condition="end with">softlimit</ParentImage>
231 |           <ParentImage condition="end with">split</ParentImage>
232 |           <ParentImage condition="end with">sqlite3</ParentImage>
233 |           <ParentImage condition="end with">sqlmap</ParentImage>
234 |           <ParentImage condition="end with">ssh-agent</ParentImage>
235 |           <ParentImage condition="end with">ssh</ParentImage>
236 |           <ParentImage condition="end with">sshpass</ParentImage>
237 |           <ParentImage condition="end with">start-stop-daemon</ParentImage>
238 |           <ParentImage condition="end with">stdbuf</ParentImage>
239 |           <ParentImage condition="end with">strace</ParentImage>
240 |           <ParentImage condition="end with">tar</ParentImage>
241 |           <ParentImage condition="end with">task</ParentImage>
242 |           <ParentImage condition="end with">taskset</ParentImage>
243 |           <ParentImage condition="end with">tasksh</ParentImage>
244 |           <ParentImage condition="end with">tclsh</ParentImage>
245 |           <ParentImage condition="end with">tdbtool</ParentImage>
246 |           <ParentImage condition="end with">telnet</ParentImage>
247 |           <ParentImage condition="end with">tex</ParentImage>
248 |           <ParentImage condition="end with">time</ParentImage>
249 |           <ParentImage condition="end with">timedatectl</ParentImage>
250 |           <ParentImage condition="end with">timeout</ParentImage>
251 |           <ParentImage condition="end with">tmate</ParentImage>
252 |           <ParentImage condition="end with">tmux</ParentImage>
253 |           <ParentImage condition="end with">top</ParentImage>
254 |           <ParentImage condition="end with">torify</ParentImage>
255 |           <ParentImage condition="end with">torsocks</ParentImage>
256 |           <ParentImage condition="end with">tshark</ParentImage>
257 |           <ParentImage condition="end with">unshare</ParentImage>
258 |           <ParentImage condition="end with">vagrant</ParentImage>
259 |           <ParentImage condition="end with">valgrind</ParentImage>
260 |           <ParentImage condition="end with">vi</ParentImage>
261 |           <ParentImage condition="end with">view</ParentImage>
262 |           <ParentImage condition="end with">vim</ParentImage>
263 |           <ParentImage condition="end with">vimdiff</ParentImage>
264 |           <ParentImage condition="end with">volatility</ParentImage>
265 |           <ParentImage condition="end with">watch</ParentImage>
266 |           <ParentImage condition="end with">wget</ParentImage>
267 |           <ParentImage condition="end with">wish</ParentImage>
268 |           <ParentImage condition="end with">xargs</ParentImage>
269 |           <ParentImage condition="end with">xdg-user-dir</ParentImage>
270 |           <ParentImage condition="end with">xdotool</ParentImage>
271 |           <ParentImage condition="end with">xelatex</ParentImage>
272 |           <ParentImage condition="end with">xetex</ParentImage>
273 |           <ParentImage condition="end with">yarn</ParentImage>
274 |           <ParentImage condition="end with">yash</ParentImage>
275 |           <ParentImage condition="end with">zathura</ParentImage>
276 |           <ParentImage condition="end with">zip</ParentImage>
277 |           <ParentImage condition="end with">zypper</ParentImage>
278 |         </Rule>
279 |         <Rule name="TechniqueID=T1070.006,TechniqueName=Indicator Removal on Host: Timestomp" groupRelation="and">
280 |           <Image condition="is">/bin/touch</Image>
281 |           <CommandLine condition="contains any">-r;--reference;-t;--time</CommandLine>
282 |         </Rule>
283 |         <Rule name="TechniqueID=T1087.001,TechniqueName=Account Discovery: Local Account" groupRelation="or">
284 |           <CommandLine condition="contains">/etc/passwd</CommandLine>
285 |           <CommandLine condition="contains">/etc/sudoers</CommandLine>
286 |         </Rule>
287 |         <Rule name="TechniqueID=T1105,TechniqueName=Ingress Tool Transfer" groupRelation="or">
288 |           <Image condition="end with">wget</Image>
289 |           <Image condition="end with">curl</Image>
290 |           <Image condition="end with">ftpget</Image>
291 |           <Image condition="end with">tftp</Image>
292 |           <Image condition="end with">lwp-download</Image>
293 |         </Rule>
294 |         <Rule name="TechniqueID=T1123,TechniqueName=Audio Capture" groupRelation="and">
295 |           <Image condition="contains">/bin/aplay</Image>
296 |           <CommandLine condition="contains">arecord</CommandLine>
297 |         </Rule>
298 |         <Rule name="TechniqueID=T1136.001,TechniqueName=Create Account: Local Account" groupRelation="or">
299 |           <Image condition="end with">useradd</Image>
300 |           <Image condition="end with">adduser</Image>
301 |         </Rule>
302 |         <Rule name="TechniqueID=T1203,TechniqueName=Exploitation for Client Execution" groupRelation="and">
303 |           <User condition="is">root</User>
304 |           <LogonId condition="is">0</LogonId>
305 |           <CurrentDirectory condition="is">/var/opt/microsoft/scx/tmp</CurrentDirectory>
306 |           <CommandLine condition="contains">/bin/sh</CommandLine>
307 |         </Rule>
308 |         <Rule name="TechniqueID=T1485,TechniqueName=Data Destruction" groupRelation="and">
309 |           <Image condition="is">/bin/dd</Image>
310 |           <CommandLine condition="contains all">dd;of=;if=</CommandLine>
311 |           <CommandLine condition="contains any">if=/dev/zero;if=/dev/null</CommandLine>
312 |         </Rule>
313 |         <Rule name="TechniqueID=T1505.003,TechniqueName=Server Software Component: Web Shell" groupRelation="and"> <!--https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml -->
314 |           <Image condition="contains any">whoami;ifconfig;/usr/bin/ip;/bin/uname;iptables;netstat;pwd;route</Image>
315 |           <ParentImage condition="contains any">httpd;lighttpd;nginx;apache2;node;dash;caddy</ParentImage>
316 |         </Rule>
317 |         <Rule name="TechniqueID=T1543.002,TechniqueName=Create or Modify System Process: Systemd Service" groupRelation="or">
318 |           <Image condition="end with">systemd</Image>
319 |         </Rule>
320 |         <Rule name="TechniqueID=T1548.001,TechniqueName=Abuse Elevation Control Mechanism: Setuid and Setgid" groupRelation="or">
321 |           <Image condition="end with">chmod</Image>
322 |           <Image condition="end with">chown</Image>
323 |           <Image condition="end with">fchmod</Image>
324 |           <Image condition="end with">fchmodat</Image>
325 |           <Image condition="end with">fchown</Image>
326 |           <Image condition="end with">fchownat</Image>
327 |           <Image condition="end with">fremovexattr</Image>
328 |           <Image condition="end with">fsetxattr</Image>
329 |           <Image condition="end with">lchown</Image>
330 |           <Image condition="end with">lremovexattr</Image>
331 |           <Image condition="end with">lsetxattr</Image>
332 |           <Image condition="end with">removexattr</Image>
333 |           <Image condition="end with">setuid</Image>
334 |           <Image condition="end with">setgid</Image>
335 |           <Image condition="end with">setreuid</Image>
336 |           <Image condition="end with">setregid</Image>
337 |         </Rule>
338 |         <Rule name="Linux Base64 Encoded Shebang In CLI" groupRelation="or"> <!-- https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml-->
339 |           <CommandLine condition="contains any">IyEvYmluL2Jhc2;IyEvYmluL2Rhc2;IyEvYmluL3pza;IyEvYmluL2Zpc2;IyEvYmluL3No</CommandLine>
340 |         </Rule>
341 |         <Rule name="BPFtrace and kprob tracing enabled" groupRelation="or"> <!-- https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml -->
342 |           <CommandLine condition="contains all">bpftrace;--unsafe</CommandLine>
343 |           <CommandLine condition="contains all">kprobes;enable</CommandLine>
344 |         </Rule>
345 |         <Rule name="TechniqueID=attack.t1083,Capability Discovery" groupRelation="or"> <!-- https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml -->
346 |           <Image condition="end with">/getcap</Image>
347 |         </Rule>
348 |         <Rule name="TechniqueID=attack.t1222.002,Chattr Remove Immutable File Attribute" groupRelation="or"> <!-- https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml -->
349 |           <CommandLine condition="contains all">chattr;--unsafe</CommandLine>
350 |         </Rule>
351 |            <Rule name="TechniqueID=attack.t1115,Clipboard Collection with Xclip Tool" groupRelation="and">
352 |                <Image condition="contains">xclip</Image>
353 |                <CommandLine condition="contains all">-sel;clip;-o</CommandLine>
354 |         </Rule>
355 | 
356 |            <Rule name="Crypto Mining Detection" groupRelation="or">
357 |         <!-- Filter for specific FileName and ProcessCommandLine patterns -->
358 |                 <CommandLine condition="contains any">--cpu-priority=;--donate-level=0;-o pool.;--nicehash;--algo=rx/0;stratum+tcp://;stratum+udp://;sh -c /sbin/modprobe msr allow_writes=on;LS1kb25hdGUtbGV2ZWw9;0tZG9uYXRlLWxldmVsP;tLWRvbmF0ZS1sZXZlbD;c3RyYXR1bSt0Y3A6Ly;N0cmF0dW0rdGNwOi8v;zdHJhdHVtK3RjcDovL;c3RyYXR1bSt1ZHA6Ly;N0cmF0dW0rdWRwOi8v;zdHJhdHVtK3VkcDovL;</CommandLine>
359 |            </Rule>
360 |       </ProcessCreate>
361 |     </RuleGroup>
362 |     <!-- Event ID 3 == NetworkConnect Detected -->
363 |     <RuleGroup name="" groupRelation="or">
364 |       <NetworkConnect onmatch="include">
365 |         <Rule name="TechniqueID=T1105,TechniqueName=Ingress Tool Transfer" groupRelation="or">
366 |           <Image condition="end with">wget</Image>
367 |           <Image condition="end with">curl</Image>
368 |           <Image condition="end with">ftpget</Image>
369 |           <Image condition="end with">tftp</Image>
370 |           <Image condition="end with">lwp-download</Image>
371 |           <Image condition="end with">bash</Image> <!--https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml-->
372 |           <Image condition="end with">busybox</Image>
373 |           <Image condition="end with">cpan</Image>
374 |           <Image condition="end with">easy_install</Image>
375 |           <Image condition="end with">gdb</Image>
376 |           <Image condition="end with">gimp</Image>
377 |           <Image condition="end with">irb</Image>
378 |           <Image condition="end with">jjs</Image>
379 |           <Image condition="end with">jrunscript</Image>
380 |           <Image condition="end with">julia</Image>
381 |           <Image condition="end with">ksh</Image>
382 |           <Image condition="end with">nc</Image>
383 |           <Image condition="end with">node</Image>
384 |           <Image condition="end with">openssl</Image>
385 |           <Image condition="end with">perl</Image>
386 |           <Image condition="end with">php</Image>
387 |           <Image condition="end with">pip</Image>
388 |           <Image condition="end with">python</Image>
389 |           <Image condition="end with">ruby</Image>
390 |           <Image condition="end with">rview</Image>
391 |           <Image condition="end with">rvim</Image>
392 |           <Image condition="end with">socat</Image>
393 |           <Image condition="end with">socket</Image>
394 |           <Image condition="end with">telnet</Image>
395 |           <Image condition="end with">view</Image>
396 |           <Image condition="end with">vim</Image>
397 |           <Image condition="end with">vimdiff</Image>
398 |           <User condition="end with">www-data</User>  <!-- detects outgoing connections by www-data user -->
399 |         </Rule>
400 |         <Rule name="Crypto Miner Indicators" groupRelation="or">
401 |           <DestinationHostname condition="end with">pool.minexmr.com</DestinationHostname>
402 |           <DestinationHostname condition="end with">fr.minexmr.com</DestinationHostname>
403 |           <DestinationHostname condition="end with">de.minexmr.com</DestinationHostname>
404 |           <DestinationHostname condition="end with">sg.minexmr.com</DestinationHostname>
405 |           <DestinationHostname condition="end with">ca.minexmr.com</DestinationHostname>
406 |           <DestinationHostname condition="end with">us-west.minexmr.com</DestinationHostname>
407 |           <DestinationHostname condition="end with">pool.supportxmr.com</DestinationHostname>
408 |           <DestinationHostname condition="end with">mine.c3pool.com</DestinationHostname>
409 |           <DestinationHostname condition="end with">xmr-eu1.nanopool.org</DestinationHostname>
410 |           <DestinationHostname condition="end with">xmr-eu2.nanopool.org</DestinationHostname>
411 |           <DestinationHostname condition="end with">xmr-us-east1.nanopool.org</DestinationHostname>
412 |           <DestinationHostname condition="end with">xmr-us-west1.nanopool.org</DestinationHostname>
413 |           <DestinationHostname condition="end with">xmr-asia1.nanopool.org</DestinationHostname>
414 |           <DestinationHostname condition="end with">xmr-jp1.nanopool.org</DestinationHostname>
415 |           <DestinationHostname condition="end with">xmr-au1.nanopool.org</DestinationHostname>
416 |           <DestinationHostname condition="end with">xmr.2miners.com</DestinationHostname>
417 |           <DestinationHostname condition="end with">xmr.hashcity.org</DestinationHostname>
418 |           <DestinationHostname condition="end with">xmr.f2pool.com</DestinationHostname>
419 |           <DestinationHostname condition="end with">xmrpool.eu</DestinationHostname>
420 |           <DestinationHostname condition="end with">pool.hashvault.pro</DestinationHostname>
421 |           <DestinationHostname condition="end with">moneroocean.stream</DestinationHostname>
422 |           <DestinationHostname condition="end with">monerocean.stream</DestinationHostname>
423 |         </Rule>
424 |         <Rule name="LocaltoNet Tunneling" groupRelation="or">  <!-- https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml -->
425 |           <DestinationHostname condition="end with">localto.net</DestinationHostname>
426 |           <DestinationHostname condition="end with">localtonet.com</DestinationHostname>
427 |         </Rule>
428 |         <Rule name="Ngrok Tunneling" groupRelation="or">  <!-- https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml -->
429 |           <DestinationHostname condition="end with">tunnel.us.ngrok.com</DestinationHostname>
430 |           <DestinationHostname condition="end with">tunnel.eu.ngrok.com</DestinationHostname>
431 |           <DestinationHostname condition="end with">tunnel.au.ngrok.com</DestinationHostname>
432 |           <DestinationHostname condition="end with">tunnel.sa.ngrok.com</DestinationHostname>
433 |           <DestinationHostname condition="end with">tunnel.jp.ngrok.com</DestinationHostname>
434 |           <DestinationHostname condition="end with">tunnel.in.ngrok.com</DestinationHostname>
435 |         </Rule>
436 |         <Rule name="Java outgoing traffic log4shell" groupRelation="and">
437 |             <Protocol condition="is">tcp</Protocol>
438 |               <Image condition="end with">java</Image>
439 |           </Rule>
440 |       </NetworkConnect>
441 |     </RuleGroup>
442 |     <!-- Event ID 5 == ProcessTerminate -->
443 |     <RuleGroup name="" groupRelation="or">
444 |       <ProcessTerminate onmatch="include" />
445 |     </RuleGroup>
446 |     <!-- Event ID 9 == RawAccessRead -->
447 |     <RuleGroup name="" groupRelation="or">
448 |       <RawAccessRead onmatch="include" />
449 |     </RuleGroup>
450 |     <!-- Event ID 11 == FileCreate -->
451 |     <RuleGroup name="" groupRelation="or">
452 |       <FileCreate onmatch="include">
453 |         <Rule name="TechniqueID=T1037,TechniqueName=Boot or Logon Initialization Scripts" groupRelation="or">
454 |           <TargetFilename condition="begin with">/etc/init/</TargetFilename>
455 |           <TargetFilename condition="begin with">/etc/init.d/</TargetFilename>
456 |           <TargetFilename condition="begin with">/etc/rc.d/</TargetFilename>
457 |         </Rule>
458 |         <Rule name="TechniqueID=T1053.003,TechniqueName=Scheduled Task/Job: Cron" groupRelation="or">
459 |           <TargetFilename condition="is">/etc/cron.allow</TargetFilename>
460 |           <TargetFilename condition="is">/etc/cron.deny</TargetFilename>
461 |           <TargetFilename condition="is">/etc/crontab</TargetFilename>
462 |           <TargetFilename condition="begin with">/etc/cron.d/</TargetFilename>
463 |           <TargetFilename condition="begin with">/etc/cron.daily/</TargetFilename>
464 |           <TargetFilename condition="begin with">/etc/cron.hourly/</TargetFilename>
465 |           <TargetFilename condition="begin with">/etc/cron.monthly/</TargetFilename>
466 |           <TargetFilename condition="begin with">/etc/cron.weekly/</TargetFilename>
467 |           <TargetFilename condition="begin with">/var/spool/cron/crontabs/</TargetFilename>
468 |         </Rule>
469 |         <Rule name="TechniqueID=T1105,TechniqueName=Ingress Tool Transfer" groupRelation="or">
470 |           <Image condition="end with">wget</Image>
471 |           <Image condition="end with">curl</Image>
472 |           <Image condition="end with">ftpget</Image>
473 |           <Image condition="end with">tftp</Image>
474 |           <Image condition="end with">lwp-download</Image>
475 |         </Rule>
476 |         <Rule name="TechniqueID=T1543.002,TechniqueName=Create or Modify System Process: Systemd Service" groupRelation="or">
477 |           <TargetFilename condition="begin with">/etc/systemd/system</TargetFilename>
478 |           <TargetFilename condition="begin with">/usr/lib/systemd/system</TargetFilename>
479 |           <TargetFilename condition="begin with">/run/systemd/system/</TargetFilename>
480 |           <TargetFilename condition="contains">/systemd/user/</TargetFilename>
481 |           <TargetFilename condition="begin with">/lib/systemd/system/</TargetFilename>
482 |         </Rule>
483 |         <Rule name="TechniqueID=T1098.004,TechniqueName=Account Manipulation: SSH Authorized Keys" groupRelation="or">
484 |           <TargetFilename condition="contains">authorized_keys</TargetFilename>
485 |           <TargetFilename condition="contains">.ssh</TargetFilename>
486 |         </Rule>
487 |         <Rule name="TechniqueID=T1546.004,TechniqueName=Event Triggered Execution: Unix Shell Configuration Modification" groupRelation="or">
488 |        <TargetFilename condition="begin with">/etc/profile.d/</TargetFilename>
489 |        <TargetFilename condition="is">/etc/profile</TargetFilename>
490 |        <TargetFilename condition="is">/etc/bash.bashrc</TargetFilename>
491 |        <TargetFilename condition="is">/etc/bash.bash_logout</TargetFilename>
492 |        <TargetFilename condition="end with">.bashrc</TargetFilename>
493 |        <TargetFilename condition="end with">.bash_profile</TargetFilename>
494 |        <TargetFilename condition="end with">.bash_login</TargetFilename>
495 |        <TargetFilename condition="end with">.profile</TargetFilename>
496 |        <TargetFilename condition="end with">.bash_logout</TargetFilename>
497 |    </Rule>
498 |    <Rule name="TechniqueID=T1037,TechniqueName=Boot or Logon Initialization Scripts: systemd-generators" groupRelation="or">
499 |     <TargetFilename condition="contains">/etc/systemd/system-generators/</TargetFilename>
500 |     <TargetFilename condition="contains">/usr/local/lib/systemd/system-generators/</TargetFilename>
501 |     <TargetFilename condition="contains">/lib/systemd/system-generators/</TargetFilename>
502 |     <TargetFilename condition="contains">/usr/lib/systemd/system-generators/</TargetFilename>
503 |     <TargetFilename condition="contains">/etc/systemd/user-generators/</TargetFilename>
504 |     <TargetFilename condition="contains">/usr/local/lib/systemd/user-generators/</TargetFilename>
505 |     <TargetFilename condition="contains">/usr/lib/systemd/user-generators/</TargetFilename>
506 | </Rule>
507 |   <Rule name="Linux Doas Conf File Creation" groupRelation="or">   <!--https://research.splunk.com/endpoint/f6343e86-6e09-11ec-9376-acde48001122/ -->
508 |  <TargetFilename condition="end with">/etc/doas.conf</TargetFilename>
509 |   </Rule>
510 |   <Rule name="Persistence Via Sudoers.d Folder" groupRelation="or"> <!--https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/file_event/file_event_lnx_persistence_sudoers_files.yml -->
511 |     <TargetFilename condition="begin with">/etc/sudoers.d/</TargetFilename>
512 |      </Rule>
513 |      <Rule name="Triple Cross eBPF Rootkit" groupRelation="or"> <!--https://github.com/SigmaHQ/sigma/blob/0bb6f0c0d75ae3e1c37f9ab77d68f20cdb32ecd3/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml -->
514 |         <TargetFilename condition="is">/tmp/rootlog</TargetFilename>
515 |         <TargetFilename condition="end with">ebpfbackdoor</TargetFilename>
516 |         </Rule>
517 |       </FileCreate>
518 |     </RuleGroup>
519 |     <!--Event ID 23 == FileDelete -->
520 |     <RuleGroup name="" groupRelation="or">
521 |       <FileDelete onmatch="include" />
522 |     </RuleGroup>
523 |   </EventFiltering>
524 | </Sysmon>
525 | 


--------------------------------------------------------------------------------
/startupscript.bat:
--------------------------------------------------------------------------------
 1 | @echo off
 2 | 
 3 | SET Configfile="c:\windows\sysmonconfig.xml"
 4 | IF EXIST %Configfile% GOTO END
 5 | 
 6 | REM you can use sysmon -u in here for future versions to unistall the old version before installing new one
 7 | copy /z /y "\\UNCPATH\sysmonconfig.xml" "C:\windows\"
 8 | copy /z /y "\\UNCPATH\sysmon.exe" "C:\windows\"
 9 | 
10 | 
11 | "C:\windows\sysmon.exe" /accepteula -i c:\windows\sysmonconfig.xml
12 | 
13 | :End
14 | 


--------------------------------------------------------------------------------
/sysmonconfig.xml:
--------------------------------------------------------------------------------
  1 | <!--
  2 |   sysmon-config | A sysmon configuration focused on default high-quality event tracing and easy customization by the community
  3 |   Master version:	51 | Date: 2017-03-14
  4 |   Master author:	@SwiftOnSecurity, other contributors also credited in-line or on Git.
  5 |   Master project:	https://github.com/SwiftOnSecurity/sysmon-config
  6 |   Master license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
  7 |   Fork version:	<N/A>
  8 |   Fork author:	<N/A>
  9 |   Fork project:	<N/A>
 10 |   Fork license:	<N/A>
 11 |  
 12 |   REQUIRED: Sysmon version 6.10 or higher 
 13 | 	https://technet.microsoft.com/en-us/sysinternals/bb545021.aspx
 14 |   NOTE: Do not let the imposing size and complexity of this configuration scare you off building your own or customizing it.
 15 | 	This configuration is based around known high-quality event tracing, and thus looks extremely complicated.
 16 | 	Sysmon configurations only have to be a few lines, but significant effort has been invested in front-loading as
 17 | 	much filtering as possible onto the client. This is to make analysis of intrusions possible by hand, and try to
 18 | 	surface anomalous activity as quickly as possible to any technician armed only with Event Viewer.
 19 |   NOTE:	Sysmon is not hardened against a determined attacker with admin rights. Also, this configuration offers an attacker, willing
 20 | 	to study it closely, several ways to evade some of the alerting. If you are in a high-threat environment and have significant 
 21 | 	security staff, you should consider a much broader log-all approach. However, in the vast majority of cases, an attacker
 22 | 	will bumble along through multiple behavioral traps which this configuration monitors, especially in the first minutes.
 23 |   NOTE:	"Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
 24 | 		"ProcessGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual process launches.
 25 | 		"LoginGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual user sessions.
 26 | -->
 27 | 
 28 | <Sysmon schemaversion="3.40">
 29 | 	<HashAlgorithms>md5,sha256</HashAlgorithms>
 30 | 	<EventFiltering>
 31 | 
 32 | 	<!--SYSMON EVENT ID 1 : PROCESS CREATION-->
 33 | 		<!--DATA: UtcTime, ProcessGuid, ProcessID, Image, CommandLine, CurrentDirectory, User, LogonGuid, LogonId, TerminalSessionId, IntegrityLevel, Hashes, ParentProcessGuid, ParentProcessId, ParentImage, ParentCommandLine-->
 34 | 		<ProcessCreate onmatch="exclude">
 35 | 		
 36 | 		<!--COMMENT:	All process launched will be included, except for what matches a rule below. It's best to be as specific as possible, to
 37 | 				avoid user-mode executables imitating other process names to avoid logging, or if malware drops files in an existing directory.
 38 | 				Ultimately, you must weigh CPU time checking many detailed rules, against the risk of malware exploiting the blindness created.-->
 39 | 			<!--SECTION: Microsoft Windows-->
 40 | 			<CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine> <!--Microsoft:Windows-->
 41 | 			<CommandLine condition="is">C:\Windows\system32\SearchIndexer.exe /Embedding</CommandLine> <!--Microsoft:Windows: Search Indexer-->
 42 | 			<Image condition="end with">C:\Windows\System32\CompatTelRunner.exe</Image> <!--Microsoft:Windows:Customer Experience Improvement-->
 43 | 			<Image condition="is">C:\Windows\System32\MusNotification.exe</Image> <!--Microsoft:Windows: Update popups-->
 44 | 			<Image condition="is">C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\ALUpdate.exe</Image> <!--Sophos Updates-->
 45 | 			<Image condition="is">C:\Windows\System32\MusNotificationUx.exe</Image> <!--Microsoft:Windows: Update popups-->
 46 | 			<Image condition="is">C:\Windows\System32\audiodg.exe</Image> <!--Microsoft:Windows: Launched constantly-->
 47 | 			<Image condition="is">C:\Windows\System32\conhost.exe</Image> <!--Microsoft:Windows: Command line interface host process-->
 48 | 			<Image condition="is">C:\Windows\System32\powercfg.exe</Image> <!--Microsoft:Power configuration management-->
 49 | 			<Image condition="is">C:\Windows\System32\wbem\WmiApSrv.exe</Image> <!--Microsoft:Windows: WMI performance adpater host process-->
 50 | 			<Image condition="is">C:\Windows\System32\wermgr.exe</Image> <!--Microsoft:Windows:Windows error reporting/telemetry-->
 51 | 			<Image condition="is">C:\Windows\SysWOW64\wermgr.exe</Image> <!--Microsoft:Windows:Windows error reporting/telemetry-->
 52 | 			<Image condition="is">C:\Windows\system32\sppsvc.exe</Image> <!--Microsoft:Windows: Software Protection Service-->
 53 | 			<IntegrityLevel condition="is">AppContainer</IntegrityLevel> <!--Microsoft:Windows: Don't care about sandboxed processes-->
 54 | 			<ParentImage condition="is"> C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe</ParentImage> 
 55 | 			<ParentCommandLine condition="begin with">%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows</ParentCommandLine> <!--Microsoft:Windows:CommandShell: Triggered when programs use the command shell, but without attribution-->
 56 | 			<ParentImage condition="is">C:\Windows\system32\SearchIndexer.exe</ParentImage> <!--Microsoft:Windows:Search: Launches many uninteresting sub-processes-->
 57 | 			<!--SECTION: Microsoft:Windows:Defender-->
 58 | 			<Image condition="begin with">C:\Program Files\Windows Defender</Image> <!--Microsoft:Windows:Defender in Win10-->
 59 | 			<Image condition="is">C:\Windows\System32\MpSigStub.exe</Image> <!--Microsoft:Windows: Microsoft Malware Protection Signature Update Stub-->
 60 | 			<Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_Base</Image> <!--Microsoft:Defender: Full signature updates-->
 61 | 			<Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_Delta</Image> <!--Microsoft:Defender: Delta signature updates-->
 62 | 			<Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_Engine</Image> <!--Microsoft:Defender: Engine updates-->
 63 | 			<!--SECTION: Microsoft:Windows:svchost-->
 64 | 			<ParentCommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k DcomLaunch</ParentCommandLine>
 65 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k appmodel</CommandLine> <!--Microsoft:Windows 10-->
 66 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k dcomLaunch</CommandLine> <!--Microsoft:Windows dervices-->
 67 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k defragsvc</CommandLine> <!--Microsoft:Windows defrag-->
 68 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k imgsvc</CommandLine> <!--Microsoft:The Windows Image Acquisition Service-->
 69 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Microsoft:Windows: Network services-->
 70 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k localServiceNetworkRestricted</CommandLine> <!--Microsoft:Windows: Network services-->
 71 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k localSystemNetworkRestricted</CommandLine> <!--Microsoft:Windows: Network services-->
 72 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs</CommandLine> <!--Microsoft:Windows: Network services-->
 73 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k networkServiceNetworkRestricted</CommandLine> <!--Microsoft:Windows: Network services-->
 74 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k rPCSS</CommandLine> <!--Microsoft:Windows Services-->
 75 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k swprv</CommandLine> <!--Microsoft:Software Shadow Copy Provider-->
 76 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k unistackSvcGroup</CommandLine> <!--Microsoft:Windows 10-->
 77 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k utcsvc</CommandLine> <!--Microsoft:Windows Services-->
 78 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k wbioSvcGroup</CommandLine> <!--Microsoft:Windows Services-->
 79 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k wsappx</CommandLine> <!--Microsoft:Windows 10-->
 80 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService</CommandLine> <!--Microsoft:Windows: Network services-->
 81 | 			<!--Sophos Services -->
 82 | 			<CommandLine condition="is">C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe</CommandLine>
 83 | 			
 84 | 			<Image condition="is">C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe</Image> <!--Sophos -->
 85 | 			<Image condition="is">C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe</Image> <!--Sophos -->
 86 | 			
 87 | 			<CommandLine condition="is">C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe</CommandLine>
 88 | 			<CommandLine condition="is">C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe</CommandLine>
 89 | 			<CommandLine condition="is">C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\ALUpdate.exe</CommandLine>
 90 | 			<!--Sophos Services -->
 91 | 			<CommandLine condition="is">C:\windows\System32\svchost.exe -k werSvcGroup</CommandLine> <!--Microsoft:Windows: ErrorReporting-->
 92 | 			<ParentCommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs</ParentCommandLine> <!--Microsoft:Windows: Network services: Spawns Consent.exe-->
 93 | 			<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted</ParentCommandLine> <!--Microsoft:Windows: Network services-->
 94 | 			<!--SECTION: Microsoft:dotNet-->
 95 | 			<CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</CommandLine> <!--Microsoft:DotNet-->
 96 | 			<Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
 97 | 			<Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
 98 | 			<Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image> <!--Microsoft:Windows: Font cache service-->
 99 | 			<Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image> <!--Microsoft:Windows: Font cache service-->
100 | 			<ParentCommandLine condition="contains">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentCommandLine>
101 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</ParentImage> <!--Microsoft:DotNet-->
102 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet-->
103 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</ParentImage> <!--Microsoft:DotNet-->
104 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet-->
105 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet: Spawns thousands of ngen.exe processes-->
106 | 			<!--SECTION: Microsoft:Office-->
107 | 			<Image condition="is">C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE</Image> <!--Microsoft:Office: Background process-->
108 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE</Image> <!--Microsoft:Office: Background process-->
109 | 			<!--SECTION: Microsoft:Office:Click2Run-->
110 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image> <!--Microsoft:Office: Background process-->
111 | 			<ParentImage condition="end with">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</ParentImage> <!--Microsoft:Office: Background process-->
112 | 			<ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</ParentImage> <!--Microsoft:Office: Background process-->
113 | 			<!--SECTION: Google-->
114 | 			<CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
115 | 			<CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
116 | 			<Image condition="begin with">C:\Program Files (x86)\Google\Update\</Image> <!--Google:Chrome: Updater-->
117 | 			<ParentImage condition="begin with">C:\Program Files (x86)\Google\Update\</ParentImage> <!--Google:Chrome: Updater-->
118 | 			<!--SECTION: Firefox-->
119 | 			<CommandLine condition="begin with">"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel</CommandLine> <!-- Mozilla:Firefox: Large command-line arguments | Credit @Darkbat91 -->
120 | 			<CommandLine condition="begin with">"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel</CommandLine> <!-- Mozilla:Firefox: Large command-line arguments | Credit @Darkbat91 -->
121 | 			<!--SECTION: Adobe-->
122 | 			<CommandLine condition="contains">AcroRd32.exe" /CR </CommandLine> <!--Adobe:AcrobatReader: Uninsteresting sandbox subprocess-->
123 | 			<CommandLine condition="contains">AcroRd32.exe" --channel=</CommandLine> <!--Adobe:AcrobatReader: Uninteresting sandbox subprocess-->
124 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe</Image> <!--Adobe:Acrobat: Sandbox subprocess, still evaluating security exposure-->
125 | 			<ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe</ParentImage>
126 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe</Image> <!--Adobe:AcrobatReader: Sandbox subprocess, still evaluating security exposure-->
127 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe</Image>
128 | 			<!--SECTION: Adobe:Flash-->
129 | 			<Image condition="end with">C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe</Image> <!--Adobe:Flash: Properly hardened updater, not a risk-->
130 | 			<!--SECTION: Adobe:Updater-->
131 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</Image> <!--Adobe:Updater: Properly hardened updater, not a risk-->
132 | 			<ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</ParentImage> <!--Adobe:Updater: Properly hardened updater, not a risk-->
133 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe</Image> <!--Adobe:Updater: Properly hardened updater, not a risk-->
134 | 			<!--SECTION: Adobe:Supporting processes-->
135 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe</Image>
136 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe</Image>
137 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe</Image> <!--Adobe:Creative Cloud-->
138 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe</Image> <!--Adobe:License utility-->
139 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe</Image> <!--Adobe:License utility-->
140 | 			<ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe</ParentImage> <!--Adobe:License utility-->
141 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</Image>
142 | 			<ParentImage condition="is">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</ParentImage>
143 | 			<!--SECTION: Adobe:Creative Cloud-->
144 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe</Image>
145 | 			<ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe</ParentImage>
146 | 			<ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe</ParentImage>
147 | 			<ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe</ParentImage>
148 | 			<!--SECTION: Drivers-->
149 | 			<CommandLine condition="begin with">"C:\Program Files\DellTPad\ApMsgFwd.exe" -s{</CommandLine>
150 | 			<Image condition="begin with">C:\Program Files\NVIDIA Corporation\</Image> <!--Nvidia:Driver: routine actions-->
151 | 			<Image condition="begin with">C:\Program Files\Realtek\</Image> <!--Realtek:Driver: routine actions-->
152 | 			<ParentImage condition="end with">C:\Program Files\DellTPad\HidMonitorSvc.exe</ParentImage>
153 | 			<ParentImage condition="end with">C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe</ParentImage> <!--Realtek:Driver: routine actions-->
154 | 			<!--SECTION: Dropbox-->
155 | 			<Image condition="end with">C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe</Image> <!--Dropbox:Updater: Lots of command-line arguments-->
156 | 			<ParentImage condition="end with">C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe</ParentImage>
157 | 			<!--SECTION: Dell-->
158 | 			<ParentImage condition="image">C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</ParentImage> <!--Dell:CommandUpdate: Detection process-->
159 | 		</ProcessCreate>
160 | 
161 | 	<!--SYSMON EVENT ID 2 : FILE CREATION TIME RETROACTIVELY CHANGED IN THE FILESYSTEM-->
162 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, PreviousCreationUtcTime-->
163 | 		<FileCreateTime onmatch="include">
164 | 			<Image condition="begin with">C:\Users</Image> <!--Look for timestomping in user area-->
165 | 		</FileCreateTime>
166 | 		<FileCreateTime onmatch="exclude">
167 | 			<Image condition="image">OneDrive.exe</Image> <!--OneDrive constantly changes file times-->
168 | 			<Image condition="contains">setup</Image> <!--Ignore setups-->
169 | 		</FileCreateTime>
170 | 
171 | 	<!--SYSMON EVENT ID 3 : NETWORK CONNECTION INITIATED-->
172 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, User, Protocol, Initiated, SourceIsIpv6, SourceIp, SourceHostname, SourcePort, SourcePortName, DestinationIsIpV6, DestinationIP, DestinationHostname, DestinationPort, DestinationPortName-->
173 | 		<NetworkConnect onmatch="include">
174 | 		<!--COMMENT:	Takes a very conservative approach to network logging, limit to extremely high-signal events.-->
175 | 		<!--TECHNICAL:	For the DestinationHostname, Sysmon uses the GetNameInfo API, which may not always have the information or may be a CDN. Using that field is best-effort only.-->
176 | 		<!--TECHNICAL:	These exe's do not initiate their connections, and cannot be included: BITSADMIN-->
177 | 			<!--Suspicious sources-->
178 | 			<Image condition="begin with">C:\Users</Image> <!--Tools downloaded by users can use other processes for networking, but this is a very valuable indicator.-->
179 | 			<Image condition="begin with">C:\ProgramData</Image> <!--Normally, network communications should be sourced from "Program Files" not from ProgramData, something to look at-->
180 | 			<Image condition="begin with">C:\Windows\Temp</Image> <!--Suspicious anything would communicate from the system-level temp directory-->
181 | 			<!--Suspicious Windows tools-->
182 | 			<Image condition="image">at.exe</Image> <!--Microsoft:Windows: Remote task scheduling | Credit @ion-storm -->
183 | 			<Image condition="image">certutil.exe</Image> <!--Microsoft:Windows: Certificate tool can contact outbound | Credit @ion-storm and @FVT [ https://twitter.com/FVT/status/834433734602530817 ] -->
184 | 			<Image condition="image">cmd.exe</Image> <!--Microsoft:Windows: Command prompt-->
185 | 			<Image condition="image">cscript.exe</Image> <!--Microsoft:WindowsScriptingHost: | Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
186 | 			<Image condition="image">java.exe</Image> <!--Java: Monitor usage of vulnerable application | Credit @ion-storm -->
187 | 			<Image condition="image">mshta.exe</Image> <!--Microsoft:Windows: HTML application executes scripts without IE protections | Credit @ion-storm [ https://en.wikipedia.org/wiki/HTML_Application ] -->
188 | 			<Image condition="image">msiexec.exe</Image> <!--Microsoft:Windows: Can install from http:// paths | Credit @vector-sec -->
189 | 			<Image condition="image">net.exe</Image> <!--Microsoft:Windows: "net use"/"net view" used by attackers to surveil and connect with file shares from command line | Credit @ion-storm -->
190 | 			<Image condition="image">notepad.exe</Image> <!--Microsoft:Windows: [ https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/ ] -->
191 | 			<Image condition="image">powershell.exe</Image> <!--Microsoft:Windows: PowerShell interface-->
192 | 			<Image condition="image">qwinsta.exe</Image> <!--Microsoft:Windows: Remotely query login sessions on a server or workstation | Credit @ion-storm -->
193 | 			<Image condition="image">reg.exe</Image> <!--Microsoft:Windows: Remote Registry | Credit @ion-storm -->
194 | 			<Image condition="image">regsvr32.exe</Image> <!--Microsoft:Windows: [ https://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html ] -->
195 | 			<Image condition="image">rundll32.exe</Image> <!--Microsoft:Windows: [ https://blog.cobaltstrike.com/2016/07/22/why-is-rundll32-exe-connecting-to-the-internet/ ] -->
196 | 			<Image condition="image">sc.exe</Image> <!--Microsoft:Windows: Remotely change Windows service settings from command line | Credit @ion-storm -->
197 | 			<Image condition="image">wmic.exe</Image> <!--Microsoft:WindowsManagementInstrumentation: Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
198 | 			<Image condition="image">wscript.exe</Image> <!--Microsoft:WindowsScriptingHost: | Credit @arekfurt -->
199 | 			<!--Relevant 3rd Party Tools: Remote Access-->
200 | 			<Image condition="image">psexec.exe</Image> <!--Sysinternals:PsExec client side | Credit @Cyb3rOps -->
201 | 			<Image condition="image">psexesvc.exe</Image> <!--Sysinternals:PsExec server side | Credit @Cyb3rOps -->
202 | 			<Image condition="image">vnc.exe</Image> <!-- VNC client | Credit @Cyb3rOps -->
203 | 			<Image condition="image">vncviewer.exe</Image> <!-- VNC client | Credit @Cyb3rOps -->
204 | 			<Image condition="image">vncservice.exe</Image> <!-- VNC server | Credit @Cyb3rOps -->
205 | 			<Image condition="image">winexesvc.exe</Image> <!-- Winexe service executable | Credit @Cyb3rOps -->
206 | 			<Image condition="image">\AA_v</Image> <!-- Ammy Admin service executable (e.g. AA_v3.0.exe AA_v3.5.exe ) | Credit @Cyb3rOps -->
207 | 			<!-- Often exploited services --> 
208 | 			<Image condition="image">omniinet.exe</Image> <!-- HP Data Protector https://www.cvedetails.com/vulnerability-list/vendor_id-10/product_id-20499/HP-Data-Protector.html | Credit @Cyb3rOps -->
209 | 			<Image condition="image">hpsmhd.exe</Image> <!-- HP System Management Homepage https://www.cvedetails.com/vulnerability-list/vendor_id-10/product_id-7244/HP-System-Management-Homepage.html | Credit @Cyb3rOps -->
210 | 			<!--Malware related-->
211 | 			<Image condition="image">tor.exe</Image> <!--Tor [ https://www.hybrid-analysis.com/sample/800bf028a23440134fc834efc5c1e02cc70f05b2e800bbc285d7c92a4b126b1c?environmentId=100 ] -->
212 | 			<!--Ports: Suspicious-->
213 | 			<DestinationPort condition="is">22</DestinationPort> <!--SSH protocol-->
214 | 			<DestinationPort condition="is">23</DestinationPort> <!--Telnet protocol-->
215 | 			<DestinationPort condition="is">25</DestinationPort> <!--SMTP mail protocol-->
216 | 			<DestinationPort condition="is">3389</DestinationPort> <!--Microsoft:Windows:RDP-->
217 | 			<DestinationPort condition="is">5800</DestinationPort> <!--VNC protocol-->
218 | 			<DestinationPort condition="is">5900</DestinationPort> <!--VNC protocol-->
219 | 			<!--Ports: Proxy-->
220 | 			<DestinationPort condition="is">1080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
221 | 			<DestinationPort condition="is">3128</DestinationPort> <!--Socks proyx port | Credit @ion-storm-->
222 | 			<DestinationPort condition="is">8080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
223 | 			<!--Ports: Tor-->
224 | 			<DestinationPort condition="is">1723</DestinationPort> <!--Tor protocol | Credit @ion-storm-->
225 | 			<DestinationPort condition="is">4500</DestinationPort> <!--Tor protocol | Credit @ion-storm-->
226 | 			<DestinationPort condition="is">9001</DestinationPort> <!--Tor protocol [ http://www.computerworlduk.com/tutorial/security/tor-enterprise-2016-blocking-malware-darknet-use-rogue-nodes-3633907/ ] -->
227 | 			<DestinationPort condition="is">9030</DestinationPort> <!--Tor protocol [ http://www.computerworlduk.com/tutorial/security/tor-enterprise-2016-blocking-malware-darknet-use-rogue-nodes-3633907/ ] -->
228 | 		</NetworkConnect>
229 | 		<NetworkConnect onmatch="exclude">
230 | 			<Image condition="image">OneDrive.exe</Image> <!--Microsoft:OneDrive-->
231 | 			<Image condition="image">Spotify.exe</Image> <!--Spotify-->
232 | 			<Image condition="is">C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\ALUpdate.exe</Image> <!--Sophos-->
233 | 			<Image condition="end with">AppData\Roaming\Dropbox\bin\Dropbox.exe</Image> <!--Dropbox-->
234 | 			<!--SECTION: Microsoft-->
235 | 			<Image condition="image">OneDriveStandaloneUpdater.exe</Image> <!--Microsoft:OneDrive-->
236 | 			<DestinationHostname condition="end with">microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
237 | 			<DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
238 | 			<DestinationHostname condition="end with">microsoft.com.nsatc.net</DestinationHostname> <!--Microsoft:Update delivery-->
239 | 		</NetworkConnect>
240 | 
241 | 	<!--SYSMON EVENT ID 4 : RESERVED FOR SYSMON STATUS MESSAGES, THIS LINE IS INCLUDED FOR DOCUMENTATION PURPOSES ONLY-->
242 | 		<!--DATA: UtcTime, State, Version, SchemaVersion-->
243 | 		<!--Cannot be filtered.-->
244 | 
245 | 	<!--SYSMON EVENT ID 5 : PROCESS ENDED-->
246 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image-->
247 | 		<ProcessTerminate onmatch="include">
248 | 		<!--COMMENT:	Useful data in building infection timelines.-->
249 | 			<Image condition="begin with">C:\Users</Image> <!--Process terminations by user binaries-->
250 | 		</ProcessTerminate>
251 | 
252 | 	<!--SYSMON EVENT ID 6 : DRIVER LOADED INTO KERNEL-->
253 | 		<!--DATA: UtcTime, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
254 | 		<DriverLoad onmatch="exclude">
255 | 		<!--COMMENT:	Because drivers with bugs can be used to escalate to kernel permissions, be extremely selective
256 | 				about what you exclude from monitoring. Low event volume, little incentive to exclude.-->
257 | 			<Signature condition="contains">microsoft</Signature> <!--Exclude signed Microsoft drivers-->
258 | 			<Signature condition="contains">windows</Signature> <!--Exclude signed Microsoft drivers-->
259 | 			<Signature condition="begin with">Intel </Signature> <!--Exclude signed Intel drivers-->
260 | 		</DriverLoad>
261 | 
262 | 	<!--SYSMON EVENT ID 7 : DLL (IMAGE) LOADED BY PROCESS-->
263 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
264 | 		<ImageLoad onmatch="include">
265 | 		<!--COMMENT:	Can cause high system load, disabled by default, important examples included below.-->
266 | 		</ImageLoad>
267 | 
268 | 	<!--SYSMON EVENT ID 8 : REMOTE THREAD CREATED-->
269 | 		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceImage, TargetProcessId, TargetImage, NewThreadId, StartAddress, StartModule, StartFunction-->
270 | 		<CreateRemoteThread onmatch="exclude">
271 | 		<!--COMMENT:	Monitor for processes injecting code into other processes. Often used by malware to cloak their actions.
272 | 				Exclude mostly-safe sources and log anything else.-->
273 | 			<SourceImage condition="is">C:\Windows\System32\wbem\WmiPrvSE.exe</SourceImage>
274 | 			<SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
275 | 			<SourceImage condition="is">C:\Windows\System32\wininit.exe</SourceImage>
276 | 			<SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
277 | 			<SourceImage condition="is">C:\Windows\System32\services.exe</SourceImage>
278 | 			<SourceImage condition="is">C:\Windows\System32\winlogon.exe</SourceImage>
279 | 			<SourceImage condition="is">C:\Windows\System32\audiodg.exe</SourceImage>
280 | 			<SourceProcessGuid condition="contains">28f4c222-3655-59a5-0000-0010d60e8919</SourceProcessGuid>
281 | 			<SourceProcessGuid condition="contains">28f4c222-bb74-59b7-0000-00103f02932c</SourceProcessGuid>
282 | 			<SourceImage condition="contains">C:\PROGRA~2\PHAROS~1\PRINTS~1\CTskMstr.exe</SourceImage>
283 | 			<StartModule condition="is">C:\windows\system32\kernel32.dll</StartModule>
284 | 			<TargetImage condition="end with">Google\Chrome\Application\chrome.exe</TargetImage>
285 | 		</CreateRemoteThread>
286 | 
287 | 	<!--SYSMON EVENT ID 9 : RAW DISK ACCESS-->
288 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, Device-->
289 | 		<RawAccessRead onmatch="include">
290 | 		<!--COMMENT:	Monitor for raw sector-level access to the disk, often used to bypass access control lists or access locked files.
291 | 				Disabled by default since including even one entry here activates this component. Reward/performance/rule maintenance decision.
292 | 				Encourage you to experiment with this feature yourself.-->
293 | 		<!--COMMENT:	You will likely want to set this to a full capture on domain controllers, where no process should be doing raw reads.-->
294 | 		</RawAccessRead>
295 | 
296 | 	<!--SYSMON EVENT ID 10 : INTER-PROCESS ACCESS-->
297 | 		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceThreadId, SourceImage, TargetProcessGuid, TargetProcessId, TargetImage, GrantedAccess, CallTrace-->
298 | 		<ProcessAccess onmatch="include">
299 | 			<TargetImage condition="is">C:\Windows\system32\lsass.exe</TargetImage>
300 | 		<!--COMMENT:	Monitor for processes accessing other process' memory. This can be valuable, but can cause a huge number of events.-->
301 | 		</ProcessAccess>
302 | 		<ProcessAccess onmatch="exclude">
303 | 			<GrantedAccess condition="is">0x1400</GrantedAccess>
304 | 			<GrantedAccess condition="is">0x1000</GrantedAccess>
305 | 			<GrantedAccess condition="is">0x400</GrantedAccess>
306 | 			<SourceImage condition="is">C:\Windows\CarbonBlack\cb.exe</SourceImage>
307 | 			<SourceImage condition="is">C:\Windows\system32\wbem\wmiprvse.exe</SourceImage>
308 | 			<SourceImage condition="is">C:\Windows\system32\lsm.exe</SourceImage>
309 | 		</ProcessAccess>
310 | 		
311 | 		
312 | 	<!--SYSMON EVENT ID 11 : FILE CREATED-->
313 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime-->
314 | 		<FileCreate onmatch="include">
315 | 			<TargetFilename condition="contains">\Start Menu</TargetFilename> <!--Microsoft:Windows: Startup links and shortcut modification-->
316 | 			<TargetFilename condition="contains">\Startup</TargetFilename> <!--Microsoft:Office: Changes to user's autoloaded files under AppData-->
317 | 			<TargetFilename condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments--> <!--PRIVACY WARNING-->
318 | 			<TargetFilename condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE--> <!--PRIVACY WARNING-->
319 | 			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
320 | 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
321 | 			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
322 | 			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
323 | 			<TargetFilename condition="end with">.cmdline</TargetFilename> <!--Microsoft:dotNet: Executed by cvtres.exe-->
324 | 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
325 | 			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
326 | 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
327 | 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
328 | 			<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
329 | 			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
330 | 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
331 | 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
332 | 			<TargetFilename condition="begin with">C:\Users\Default</TargetFilename> <!--Microsoft:Windows: Changes to default user profile-->
333 | 			<TargetFilename condition="begin with">C:\Windows\System32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
334 | 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
335 | 			<TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\Machine\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
336 | 			<TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\User\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
337 | 			<TargetFilename condition="begin with">C:\Windows\System32\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks-->
338 | 			<TargetFilename condition="begin with">C:\Windows\System32\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
339 | 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
340 | 			<TargetFilename condition="begin with">C:\Windows\System32\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
341 | 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
342 | 			<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!--Microsoft:ScheduledTasks-->
343 | 		</FileCreate>
344 | 		<FileCreate onmatch="exclude">
345 | 			<!--SECTION: Microsoft:Office:Click2Run-->
346 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image> <!-- Microsoft:Office Click2Run-->
347 | 			<!--SECTION: Microsoft:Windows-->
348 | 			<Image condition="is">C:\Windows\System32\smss.exe</Image> <!-- Microsoft:Windows: Session Manager SubSystem: Creates swapfile.sys,pagefile.sys,hiberfile.sys-->
349 | 			<Image condition="is">C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe</Image> <!-- Sophos-->
350 | 			<Image condition="is">C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe</Image> <!-- Sophos-->
351 | 			<Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image> <!-- Microsoft:Windows: Windows 10 app, creates tons of cache files-->
352 | 			<Image condition="is">\\?\C:\Windows\system32\wbem\WMIADAP.EXE</Image> <!-- Microsoft:Windows: WMI Performance updates-->
353 | 			<TargetFilename condition="begin with">C:\Windows\System32\DriverStore\Temp\</TargetFilename> <!-- Microsoft:Windows: Temp files by DrvInst.exe-->
354 | 			<TargetFilename condition="begin with">C:\Windows\System32\wbem\Performance\</TargetFilename> <!-- Microsoft:Windows: Created in wbem by WMIADAP.exe-->
355 | 			<TargetFilename condition="end with">WRITABLE.TST</TargetFilename> <!-- Microsoft:Windows: Created in wbem by svchost-->
356 | 			<!--SECTION: Microsoft:Windows:Updates-->
357 | 			<TargetFilename condition="begin with">C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\</TargetFilename> <!-- Microsoft:Windows: Feature updates containing lots of .exe and .sys-->
358 | 			<Image condition="begin with">C:\WINDOWS\winsxs\amd64_microsoft-windows</Image> <!-- Microsoft:Windows: Windows update-->
359 | 			<!--SECTION: Dell-->
360 | 			<Image condition="is">C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</Image>
361 | 			<!--SECTION: Intel-->
362 | 			<Image condition="is">C:\Windows\system32\igfxCUIService.exe</Image> <!--Intel: Drops bat and other files in \Windows in normal operation-->
363 | 		</FileCreate>
364 | 
365 | 	<!--SYSMON EVENT ID 12 & 13 & 14 : REGISTRY MODIFICATION-->
366 | 		<!--NOTE:	It may appear this section is missing important entries, but many of them match multiple areas, so look carefully to see if something is already covered.-->
367 | 		<!--NOTE:	"contains" conditions below are formatted to reduce CPU load, so they may appear written inconsistently, but this is on purpose from tuning.-->
368 | 		<!--NOTE:	"contains" works by finding the first letter, then matching the second, etc, so the first letters should be as low-occurance as possible.-->
369 | 		<!--NOTE:	Windows writes hundreds or thousands of registry keys a minute, so just because you're not changing stuff, doesn't mean these rules aren't being run.-->
370 | 		<!--NOTE:	You don't have to spend a lot of time worrying about this, CPUs are fast, but it's something to consider. Every rule and condition type has a cost.-->
371 | 		<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, TargetObject, Details, NewName-->
372 | 		<!--TECHNICAL:	Possible prefixes are HKLM, HKCR, and HKEY_USERS-->
373 | 		<!--CRITICAL:	Schema version 3.30 and higher use HKLM and HKEY_USERS and HKCR and CurrentControlSet instead of REGISTRY\MACHINE\ and \REGISTRY\USER\ and ControlSet001-->
374 | 		
375 | 		<RegistryEvent onmatch="include">
376 | 			<!--Autorun or Startups-->
377 | 				<!--ADDITIONAL REFERENCE: [ http://www.ghacks.net/2016/06/04/windows-automatic-startup-locations/ ] -->
378 | 				<!--ADDITIONAL REFERENCE: [ https://view.officeapps.live.com/op/view.aspx?src=https://arsenalrecon.com/downloads/resources/Registry_Keys_Related_to_Autorun.ods ] -->
379 | 				<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
380 | 			<TargetObject condition="contains">\CurrentVersion\Run</TargetObject> <!--Microsoft:Windows: Run keys, incld RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
381 | 			<TargetObject condition="contains">\Group Policy\Scripts</TargetObject> <!--Microsoft:Windows: Group policy scripts-->
382 | 			<TargetObject condition="contains">\Windows\System\Scripts</TargetObject> <!--Microsoft:Windows: Logon, Loggoff, Shutdown-->
383 | 			<TargetObject condition="contains">\Policies\Explorer\Run</TargetObject> <!--Microsoft:Windows | Credit @ion-storm-->
384 | 			<TargetObject condition="end with">\ServiceDll</TargetObject> <!--Microsoft:Windows: Points to a service's DLL [ https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services ] -->
385 | 			<TargetObject condition="end with">\ImagePath</TargetObject> <!--Microsoft:Windows: Points to a service's EXE [ https://github.com/crypsisgroup/Splunkmon/blob/master/sysmon.cfg ] -->
386 | 			<TargetObject condition="end with">\Start</TargetObject> <!--Microsoft:Windows: Services start mode changes (Disabled, Automatically, Manual)-->
387 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\</TargetObject> <!--Microsoft:Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
388 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\</TargetObject> <!--Microsoft:Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
389 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject> <!--Microsoft:Windows: Legacy driver loading | Credit @ion-storm -->
390 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject> <!--Microsoft:Windows: Autorun | Credit @ion-storm | [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
391 | 			<!--CLSID launch commands and file association changes-->
392 | 			<TargetObject condition="contains">\Explorer\FileExts\</TargetObject> <!--Microsoft:Windows: Changes to file extension mapping-->
393 | 			<TargetObject condition="contains">\shell\install\command\</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
394 | 			<TargetObject condition="contains">\shell\open\command\</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
395 | 			<TargetObject condition="contains">\shell\open\ddeexec\</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
396 | 			<!--Windows COM-->
397 | 			<TargetObject condition="end with">\InprocServer32\(Default)</TargetObject> <!--Microsoft:Windows:COM Object Hijacking [ https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence ] | Credit @ion-storm -->
398 | 			<!--Windows shell hijack-->
399 | 			<TargetObject condition="contains">\Classes\*\</TargetObject> <!--Microsoft:Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
400 | 			<TargetObject condition="contains">\Classes\AllFilesystemObjects\</TargetObject> <!--Microsoft:Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
401 | 			<TargetObject condition="contains">\Classes\Directory\</TargetObject> <!--Microsoft:Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
402 | 			<TargetObject condition="contains">\Classes\Drive\</TargetObject> <!--Microsoft:Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
403 | 			<TargetObject condition="contains">\Classes\Folder\</TargetObject> <!--Microsoft:Windows:Explorer: ContextMenuHandlers, DragDropHandlers, CopyHookHandlers, [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
404 | 			<TargetObject condition="contains">\ContextMenuHandlers\</TargetObject> <!--Microsoft:Windows: [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
405 | 			<TargetObject condition="contains">\CurrentVersion\Shell</TargetObject> <!--Microsoft:Windows: Shell Folders, ShellExecuteHooks, ShellIconOverloadIdentifers, ShellServiceObjects, ShellServiceObjectDelayLoad [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
406 | 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks</TargetObject> <!--Microsoft:Windows: ShellExecuteHooks-->
407 | 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad</TargetObject> <!--Microsoft:Windows: ShellExecuteHooks-->
408 | 			<!--AppPaths hijacking-->
409 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\</TargetObject> <!--Microsoft:Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] -->
410 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\</TargetObject> <!--Microsoft:Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] -->
411 | 			<!--Terminal service boobytraps-->
412 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram</TargetObject>
413 | 			<!--Group Policy interity-->
414 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\</TargetObject> <!--Microsoft:Windows: Group Policy internally uses a plugin architecture that nothing should be modifying-->
415 | 			<!--Winsock and Winsock2-->
416 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WinSock\</TargetObject> <!--Microsoft:Windows: Wildcard, includes Winsock and Winsock2-->
417 | 			<TargetObject condition="end with">\ProxyServer</TargetObject> <!--Microsoft:Windows: System and user proxy server-->
418 | 			<!--Credential providers-->
419 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider</TargetObject> <!--Wildcard, includes Credental Providers and Credential Provider Filters-->
420 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</TargetObject>
421 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders</TargetObject> <!--Microsoft:Windows: Changes to WDigest-UseLogonCredential for password scraping [ https://www.trustedsec.com/april-2015/dumping-wdigest-creds-with-meterpreter-mimikatzkiwi-in-windows-8-1/ ] -->
422 | 			<!--Networking-->
423 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\</TargetObject> <!--Microsoft:Windows: Order of network providers that are checked to connect to destination [ https://www.malwarearchaeology.com/cheat-sheets ] -->
424 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles</TargetObject> <!--Microsoft:Windows: | Credit @ion-storm -->
425 | 			<!--DLLs that get injected into every process launch-->
426 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Microsoft:Windows: [ https://msdn.microsoft.com/en-us/library/windows/desktop/dd744762(v=vs.85).aspx ] -->
427 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Microsoft:Windows: [ https://msdn.microsoft.com/en-us/library/windows/desktop/dn280412(v=vs.85).aspx ] -->
428 | 			<!--Office-->
429 | 			<TargetObject condition="contains">\Microsoft\Office\Outlook\Addins\</TargetObject> <!--Microsoft:Office: Outlook add-ins-->
430 | 			<!--IE-->
431 | 			<TargetObject condition="contains">\Internet Explorer\Toolbar\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user-->
432 | 			<TargetObject condition="contains">\Internet Explorer\Extensions\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user-->
433 | 			<TargetObject condition="contains">\Browser Helper Objects\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ https://msdn.microsoft.com/en-us/library/bb250436(v=vs.85).aspx ] -->
434 | 			<!--Magic registry keys-->
435 | 			<TargetObject condition="contains">{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\</TargetObject> <!--Microsoft:Windows: Thumbnail cache autostart [ http://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-levels-up-with-new-autostart-mechanism/ ] -->
436 | 			<!--Infection artifacts-->
437 | 			<TargetObject condition="end with">\UrlUpdateInfo</TargetObject> <!--Microsoft:ClickOnce: [ https://subt0x10.blogspot.com/2016/12/mimikatz-delivery-via-clickonce-with.html ] -->
438 | 			<TargetObject condition="end with">\InstallSource</TargetObject> <!--Microsoft:Windows: Source folder for certain program and componenent installations-->
439 | 			<!--Windows UAC tampering-->
440 | 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
441 | 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
442 | 			<!--Microsoft Firewall modifications-->
443 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List</TargetObject> <!--Windows Firewall authorized applications | Credit @ion-storm -->
444 | 			<!--Microsoft Security Center tampering | Credit @ion-storm -->
445 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled</TargetObject>
446 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify</TargetObject>
447 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring</TargetObject>
448 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify</TargetObject>
449 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride</TargetObject>
450 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify</TargetObject>
451 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify</TargetObject>
452 | 			<!--Windows Defender tampering | Credit @ion-storm -->
453 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware</TargetObject>
454 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus</TargetObject>
455 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring</TargetObject>
456 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection</TargetObject>
457 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable</TargetObject>
458 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting</TargetObject>
459 | 			<!--Windows internals integrity monitoring-->
460 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\</TargetObject> <!--Microsoft:Windows: Malware likes changing IFEO-->
461 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\</TargetObject> <!--Microsoft:Windows:UAC: Detect malware changes to UAC prompt level-->
462 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\</TargetObject> <!--Microsoft:Windows: Event log system integrity and ACLs-->
463 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\</TargetObject> <!--Microsoft:Defender: Detect changes to Defender administrative settings to monitor for disablement-->
464 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\</TargetObject> <!--Microsoft:Windows: Services approved to load in safe mode-->
465 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\</TargetObject> <!--Microsoft:Windows: Providers notified by WinLogon-->
466 | 			<TargetObject condition="end with">\FriendlyName</TargetObject> <!--Microsoft:Windows: New devices connected and remembered-->
467 | 			<TargetObject condition="is">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default)</TargetObject> <!--Microsoft:Windows: See when WindowsInstaller is engaged-->
468 | 		</RegistryEvent>
469 | 		<RegistryEvent onmatch="exclude">
470 | 		<!--COMMENT:	Remove low-information noise-->
471 | 			<!--SECTION: Microsoft binaries-->
472 | 			<Image condition="end with">Office\root\integration\integrator.exe</Image> <!--Microsoft:Office: C2R client-->
473 | 			<Image condition="end with">\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe</Image> <!--Sophos-->
474 | 			<Image condition="image">C:\WINDOWS\system32\backgroundTaskHost.exe</Image> <!--Microsoft:Windows: Changes association registry keys-->
475 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</Image> <!--Microsoft:Office: C2R client-->
476 | 			<Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image> <!--Microsoft:Windows:Defender-->
477 | 			<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Cortana-->
478 | 			<!--Misc-->
479 | 			<Image condition="is">C:\Program Files (x86)\Common Files\Rhozet\Carbon Coder\Kernel\PNXSERVR.exe</Image> <!-- carbon coder -->
480 | 			<TargetObject condition="end with">Toolbar\WebBrowser</TargetObject> <!--Microsoft:IE: Extraneous activity-->
481 | 			<TargetObject condition="end with">Toolbar\WebBrowser\ITBar7Height</TargetObject> <!--Microsoft:IE: Extraneous activity-->
482 | 			<TargetObject condition="end with">Toolbar\ShellBrowser\ITBar7Layout</TargetObject> <!--Microsoft:Windows:Explorer: Extraneous activity-->
483 | 			<TargetObject condition="end with">Internet Explorer\Toolbar\Locked</TargetObject> <!--Microsoft:Windows:Explorer: Extraneous activity-->
484 | 			<TargetObject condition="end with">ShellBrowser</TargetObject> <!--Microsoft:InternetExplorer: Noise-->
485 | 			<TargetObject condition="end with">\CurrentVersion\Run</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\Run" wildcard-->
486 | 			<TargetObject condition="end with">\CurrentVersion\RunOnce</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\Run" wildcard-->
487 | 			<TargetObject condition="end with">\CurrentVersion\App Paths</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\App Paths" wildcard-->
488 | 			<TargetObject condition="end with">\CurrentVersion\Image File Execution Options</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\Image File Execution Options" wildcard-->
489 | 			<TargetObject condition="end with">\CurrentVersion\Shell Extensions\Cached</TargetObject> <!--Microsoft:Windows: Remove noise from the "\CurrentVersion\Shell Extensions\Cached" wildcard-->
490 | 			<TargetObject condition="end with">\CurrentVersion\Shell Extensions\Approved</TargetObject> <!--Microsoft:Windows: Remove noise from the "\CurrentVersion\Shell Extensions\Approved" wildcard-->
491 | 			<TargetObject condition="end with">}\PreviousPolicyAreas</TargetObject> <!--Microsoft:Windows: Remove noise from \Winlogon\GPExtensions by svchost.exe-->
492 | 			<TargetObject condition="contains">\Control\WMI\Autologger\</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
493 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
494 | 			<TargetObject condition="end with">\Lsa\OfflineJoin\CurrentValue</TargetObject> <!--Microsoft:Windows: Sensitive value during domain join-->
495 | 			<TargetObject condition="end with">\Components\TrustedInstaller\Events</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
496 | 			<TargetObject condition="end with">\Components\TrustedInstaller</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
497 | 			<TargetObject condition="end with">\Components\Wlansvc</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
498 | 			<TargetObject condition="end with">\Components\Wlansvc\Events</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
499 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\</TargetObject> <!--Microsoft:Windows: Remove noise monitoring installations run as system-->
500 | 			<TargetObject condition="end with">\Directory\shellex</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
501 | 			<TargetObject condition="end with">\Directory\shellex\DragDropHandlers</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
502 | 			<TargetObject condition="end with">\Drive\shellex</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
503 | 			<TargetObject condition="end with">\Drive\shellex\DragDropHandlers</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
504 | 			<TargetObject condition="contains">_Classes\AppX</TargetObject> <!--Microsoft:Windows: Remove noise monitoring "Shell\open\command"--> <!--Win8+-->
505 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\</TargetObject> <!--Microsoft:Windows: SvcHost Noise-->
506 | 			<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Windows: Remove noise from Windows 10 Cortana | Credit @ion-storm--> <!--Win10-->
507 | 			<!--Bootup Control noise-->
508 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
509 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
510 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
511 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
512 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
513 | 			<TargetObject condition="end with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
514 | 			<!--Sevices autostart noise-->
515 | 			<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
516 | 			<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
517 | 			<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
518 | 			<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
519 | 			<TargetObject condition="end with">\services\DeviceAssociationService\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
520 | 			<TargetObject condition="end with">\services\BITS\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
521 | 			<TargetObject condition="end with">\services\TrustedInstaller\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
522 | 			<TargetObject condition="end with">\services\tunnel\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
523 | 			<TargetObject condition="end with">\services\UsoSvc\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
524 | 			<!--FileExts noise filtering-->
525 | 			<TargetObject condition="contains">\OpenWithProgids</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
526 | 			<TargetObject condition="end with">\OpenWithList</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
527 | 			<TargetObject condition="end with">\UserChoice</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
528 | 			<TargetObject condition="end with">\UserChoice\ProgId</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
529 | 			<TargetObject condition="end with">\UserChoice\Hash</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
530 | 			<TargetObject condition="end with">\OpenWithList\MRUList</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
531 | 			<TargetObject condition="end with">} 0xFFFF</TargetObject> <!--Microsoft:Windows: Remove noise from explorer.exe from monitoring ShellCached binary keys--> <!--Win8+-->
532 | 			<!--SECTION: 3rd party-->
533 | 			<Image condition="is">C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe</Image> <!--Constantly writes to HKLM-->
534 | 			<Image condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</Image> <!--Webroot-->
535 | 			<Image condition="is">C:\WINDOWS\System32\spoolsv.exe</Image>
536 | 
537 | 		</RegistryEvent>
538 | 
539 | 	<!--SYSMON EVENT ID 15 : ALTERNATE DATA STREAM CREATED-->
540 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, Hash-->
541 | 		<FileCreateStreamHash onmatch="include">
542 | 		<!--COMMENT:	Any files created with an NTFS Alternate Data Stream which match these rules will be hashed and logged.
543 | 				[ https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/ ]
544 | 				ADS's are used by browsers and email clients to mark files as originating from the Internet or other foreign sources.
545 | 				[ https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ ] -->
546 | 			<TargetFilename condition="contains">Content.Outlook</TargetFilename> <!--Microsoft:Outlook: Attachments--> <!--PRIVACY WARNING-->
547 | 			<TargetFilename condition="contains">Downloads</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE-->
548 | 			<TargetFilename condition="contains">Temp\7z</TargetFilename> <!--7zip extractions-->
549 | 			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
550 | 			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting | Credit @ion-storm -->
551 | 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
552 | 			<TargetFilename condition="end with">.lnk</TargetFilename> <!--Shortcut file | Credit @ion-storm -->
553 | 			<TargetFilename condition="end with">.ps1</TargetFilename> <!--Powershell-->
554 | 			<TargetFilename condition="end with">.ps2</TargetFilename> <!--Powershell-->
555 | 			<TargetFilename condition="end with">.reg</TargetFilename> <!--Registry File-->
556 | 			<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
557 | 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting files-->
558 | 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting files-->
559 | 				<!--COMMENT:	Any files created with an NTFS Alternate Data Stream which match these rules will be hashed and logged.
560 | 				[ https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/ ]
561 | 				ADS's are used by browsers and email clients to mark files as originating from the Internet or other foreign sources.
562 | 				[ https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ ] -->
563 | 			<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
564 | 			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
565 | 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
566 | 				<TargetFilename condition="end with">.cmdline</TargetFilename> <!--Microsoft:dotNet: Executed by cvtres.exe-->
567 | 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
568 | 			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
569 | 			<TargetFilename condition="end with">.dll</TargetFilename> <!--Executable-->
570 | 			<TargetFilename condition="end with">.sys</TargetFilename> <!--Executable-->
571 | 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
572 | 			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
573 | 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Office Macros-->
574 | 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Office Macros-->
575 | 			<TargetFilename condition="end with">.xlam</TargetFilename> <!--Office Macros-->
576 | 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Office Macros-->
577 | 			<TargetFilename condition="end with">.potm</TargetFilename> <!--Office Macros-->
578 | 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Office Macros-->
579 | 			<TargetFilename condition="end with">.sldm</TargetFilename> <!--Office Macros-->
580 | 			<TargetFilename condition="end with">.scf</TargetFilename> <!--Explorer Command File-->
581 | 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--ClickOnce Application-->
582 | 			<TargetFilename condition="end with">.rdp</TargetFilename> <!--Remote Desktop file-->
583 | 			<TargetFilename condition="end with">.js</TargetFilename> <!--Java-->
584 | 			<!--SECTION: Certificates -->
585 | 			<TargetFilename condition="contains">.pem</TargetFilename>
586 | 			<TargetFilename condition="contains">.crt</TargetFilename>
587 | 			<TargetFilename condition="contains">.ca-bundle</TargetFilename>
588 | 			<TargetFilename condition="contains">.cer</TargetFilename>
589 | 			<TargetFilename condition="contains">.csr</TargetFilename>
590 | 			<TargetFilename condition="contains">.der</TargetFilename>
591 | 			<TargetFilename condition="contains">.p7b</TargetFilename>
592 | 			<TargetFilename condition="contains">.p7r</TargetFilename>
593 | 			<TargetFilename condition="contains">.p7s</TargetFilename>
594 | 			<TargetFilename condition="contains">.pfx</TargetFilename>
595 | 			<TargetFilename condition="contains">.sto</TargetFilename>
596 | 			<TargetFilename condition="contains">.p12</TargetFilename>
597 | 			<TargetFilename condition="contains">.crl</TargetFilename>
598 | 			<TargetFilename condition="contains">.sst</TargetFilename>
599 | 			<TargetFilename condition="contains">.key</TargetFilename>
600 | 			<!--SECTION: CIA Vault7 Leak -->
601 | 			<TargetFilename condition="contains">.mht</TargetFilename> <!-- Possible malformed file will escape IE sandbox -->
602 | 			<TargetFilename condition="contains">.manifest</TargetFilename>
603 | 			<TargetFilename condition="contains">.cpl</TargetFilename> <!-- Vault7 CIA Leak: Control Panel Persistence -->
604 | 			<TargetFilename condition="contains">.scr</TargetFilename> <!-- Vault7 CIA Leak: Screensaver Persistence -->
605 | 			<TargetFilename condition="contains">.inf</TargetFilename> <!-- Vault7 CIA Leak: Sandworm: Uses INF File to bypass UAC on windows 7 -->
606 | 		</FileCreateStreamHash>
607 | 
608 | 	<!--SYSMON EVENT ID 16 : SYSMON CONFIGURATION CHANGE, THIS LINE IS INCLUDED FOR DOCUMENTATION PURPOSES ONLY-->
609 | 		<!--DATA: UtcTime, Configuration, ConfigurationFileHash-->
610 | 		<!--Cannot be filtered.-->
611 | 
612 | 	<!--SYSMON EVENT ID 17 & 18 : PIPE CREATED / PIPE CONNECTED-->
613 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, PipeName, Image-->
614 | 	<PipeEvent onmatch="exclude">
615 | 		<!--COMMENT: Exclude known-good pipe users-->
616 | 				<!--ADDITIONAL REFERENCE: [ https://www.cobaltstrike.com/help-smb-beacon ] -->
617 | 				<!--ADDITIONAL REFERENCE: [ https://blog.cobaltstrike.com/2015/10/07/named-pipe-pivoting/ ] -->
618 | 			<!--SECTION: Microsoft-->
619 | 			<Image condition="is">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</Image>
620 | 			 <Image condition="is">C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe</Image>
621 | 			<PipeName condition="contains">lsass</PipeName>
622 | 			<PipeName condition="is">\netmon</PipeName> <!--SYSTEM Process generates this pipe event: -->
623 | 			<PipeName condition="is">\SQLLocal\RTCLOCAL</PipeName>
624 | 			<!--SECTION: Microsoft IIS -->
625 | 			<PipeName condition="begin with">\M.E.C.Core.WinRMDataCommunicator.NamedPipe.</PipeName>
626 | 			<Image condition="is">c:\windows\system32\inetsrv\w3wp.exe</Image>
627 | 			<Image condition="is">C:\Windows\syswow64\snmp.exe</Image>
628 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE</Image>
629 | 			<!--SECTION: Microsoft Exchange Server -->
630 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\ParserServer\ParserServer.exe</Image>
631 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.RpcClientAccess.Service.exe</Image>
632 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Store.Service.exe</Image>
633 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Store.Worker.exe</Image>
634 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Runtime\1.0\ResourceProfile\contentengine\NodeRunner.exe</Image>
635 | 			<!--SECTION: Microsoft DNS Server -->
636 | 			<Image condition="is">C:\Windows\system32\dns.exe</Image>
637 | 			<!--SECTION: Microsoft SQL Server -->
638 | 			<Image condition="is">C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe</Image>
639 | 			<!--SECTION: Microsoft Skype For Business Server -->
640 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exee</Image>
641 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\OCSMCU\AV Conferencing\AVMCUSvc.exe</Image>
642 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Health Agent\HealthAgent.exe</Image>
643 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\LysSvc.exe</Image>
644 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\File Transfer Agent\FileTransferAgent.exe</Image>
645 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Web Conferencing\DataMCUSvc.exe</Image>
646 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Application Host\OcsAppServerHost.exe</Image>
647 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\ABServer.exe</Image>
648 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Master Replicator Agent\MasterReplicatorAgent.exe</Image>
649 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\OCSMCU\IM Conferencing\IMMCUSvc.exe</Image>
650 | 			<Image condition="is">C:\Program Files\Common Files\Skype for Business Server 2015\ClsAgent\ClsAgent.exe</Image>
651 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\ReplicationApp.exe</Image>
652 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\OCSMCU\Application Sharing\ASMCUSvc.exe</Image>
653 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Replica Replicator Agent\ReplicaReplicatorAgent.exe</Image>
654 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exe</Image>
655 | 			<!--SECTION: Microsoft DFS Replication -->
656 | 			<Image condition="is">C:\Windows\system32\DFSRs.exee</Image>
657 | 			<Image condition="begin with">C:\Windows\SystemApps\Microsoft.Windows</Image>
658 | 			<Image condition="is">C:\Windows\system32\SearchProtocolHost.exe</Image>
659 | 			<Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</Image>
660 | 			<Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe</Image>
661 | 			<Image condition="is">C:\Windows\System32\LxRun.exe</Image> <!--Bash On Windows -->
662 | 			<PipeName condition="contains">vmware-</PipeName>
663 | 			<Image condition="is">\System</Image>
664 | 			<PipeName condition="is">\InitShutdown</PipeName>
665 | 			<Image condition="is">C:\Windows\System32\wininit.exe</Image>
666 | 			<Image condition="is">C:\Windows\System32\SearchIndexer.exe</Image>
667 | 			<Image condition="is">C:\Windows\System32\services.exe</Image>
668 | 			<PipeName condition="is">\ntsvcs</PipeName>
669 | 			<PipeName condition="is">\scerpc</PipeName>
670 | 			<Image condition="is">C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe</Image>
671 | 			<Image condition="is">C:\Windows\System32\smss.exe</Image>
672 | 			<Image condition="is">C:\Windows\System32\spoolsv.exe</Image>
673 | 			<PipeName condition="is">\epmapper</PipeName>
674 | 			<PipeName condition="is">\atsvc</PipeName>
675 | 			<PipeName condition="is">\browser</PipeName>
676 | 			<PipeName condition="is">\srvsvc</PipeName>
677 | 			<PipeName condition="is">\Winsock2CatelogChangeListener</PipeName>
678 | 			<PipeName condition="contains">ProtectedPrefix\LocalService\FTHPIPE</PipeName>
679 | 			<PipeName condition="is">\W32TIME_ALT</PipeName>
680 | 			<PipeName condition="is">\eventlog</PipeName>
681 | 			<PipeName condition="is">\wkssvc</PipeName>
682 | 			<PipeName condition="contains">\TDLN-</PipeName>
683 | 			<PipeName condition="is">\WiFiNetworkManagerTask</PipeName>
684 | 			<PipeName condition="is">\MsFteWds</PipeName>
685 | 			<!--SECTION: Webroot-->
686 | 			<PipeName condition="is">\WRSVCPipe</PipeName>
687 | 			<PipeName condition="is">\WRSynUM2</PipeName>
688 | 			<PipeName condition="is">\wrUrl</PipeName><!--Webroot Webfiltering Pipe-->
689 | 			<Image condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</Image>
690 | 			<!--SECTION: Google-->
691 | 			<Image condition="is">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Image>
692 | 			<Image condition="is">C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Image>
693 | 			<Image condition="contains">AppData\Local\Google\Chrome\User Data\SwReporter\</Image>
694 | 			<PipeName condition="contains">mojo.</PipeName>
695 | 			<PipeName condition="contains">crashpad_</PipeName>
696 | 			<PipeName condition="contains">chrome.</PipeName>
697 | 			<PipeName condition="contains">GoogleCrashServices</PipeName>
698 | 			<!--SECTION: Other-->
699 | 			<Image condition="end with">slack.exe</Image>
700 | 			<!--SECTION: ConnectWise-->
701 | 			<PipeName condition="contains">booma\</PipeName>
702 | 			<!--SECTION: EnPass-->
703 | 			<PipeName condition="contains">qtsingleapp-enpass-</PipeName>
704 | 			<Image condition="contains">qtsingleapp-enpass-</Image>
705 | 			<!--SECTION: Everything Search-->
706 | 			<PipeName condition="contains">Everything Service</PipeName>
707 | 			<PipeName condition="contains">anchor_gui_agent</PipeName>
708 | 			<!--SECTION: Lenovo-->
709 | 			<Image condition="is">C:\Program Files (x86)\Lenovo\System Update\SUService.exe</Image>
710 | 			<Image condition="is">C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe</Image>
711 | 			<Image condition="is">C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe</Image>
712 | 			<Image condition="is">C:\Program Files\Lenovo\HOTKEY\shtctky.exe</Image>
713 | 			<Image condition="is">C:\Windows\System32\LPlatSvc.exe</Image>
714 | 			<Image condition="is">C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe</Image>
715 | 			<!--SECTION: Labtech-->
716 | 			<Image condition="is">C:\Windows\LTSvc\LTSVC.exe</Image>
717 | 			<Image condition="contains">ScreenConnect.WindowsClient.exe</Image>
718 | 			<Image condition="contains">ScreenConnect.ClientService.exe</Image>
719 | 			<Image condition="is">C:\Program Files\OpenVPN\bin\openvpn-gui.exe</Image>
720 | 			<Image condition="is">C:\Program Files\OpenVPN\bin\openvpn.exe</Image>
721 | 			<Image condition="is">C:\Program Files\OpenVPN\bin\openvpnserv.exe</Image>
722 | 			<Image condition="is">C:\Program Files\Synaptics\SynTP\SynTPEnh.exe</Image>
723 | 			<Image condition="is">C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe</Image>
724 | 			<Image condition="is">C:\Program Files\Lenovo\HOTKEY\tphkload.exe</Image>
725 | 			<Image condition="contains">C:\Program Files\Lenovo\</Image>
726 | 			<Image condition="is">C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe</Image>
727 | 			<Image condition="contains">Graylog-collector-sidecar.exe</Image>
728 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git-remote-https.exe</Image>
729 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\git\mingw32\bin\git.exe</Image>
730 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe</Image>
731 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\bin\smartgit.exe</Image>
732 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\bin\smartgit.exe</Image>
733 | 			<PipeName condition="contains">Anonymous Pipe</PipeName> <!-- NOTICE: Comment this out if you dont use Labtech, labtech nests processes and causes excessive noise -->
734 | 			<Image condition="is">C:\Program Files (x86)\Fortinet\FortiClient\FortiESNAC.exe</Image>
735 | 			<Image condition="is">C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe</Image>
736 | 			<Image condition="is">C:\Program Files (x86)\Fortinet\FortiClient\FortiTray.exe</Image>
737 | 			<Image condition="is">C:\Program Files (x86)\Fortinet\FortiClient\FCDBLog.exe</Image>
738 | 			<Image condition="is">C:\Program Files (x86)\Enpass\Enpass.exe</Image>
739 | 			<Image condition="is">C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe</Image>
740 | 			<Image condition="is">C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe</Image>
741 | 			<Image condition="is">C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe</Image>
742 | 			<Image condition="is">C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe</Image>
743 | 			<PipeName condition="contains">SQLAnywhereLRM</PipeName> <!-- Quickbooks -->
744 | 			<PipeName condition="contains">pgsignal</PipeName> <!-- Postgres SQL -->
745 | 			<Image condition="is">postgres.exe</Image>
746 | 			<PipeName condition="contains">MICROSOFT##WID\tsql\query</PipeName> <!-- Microsoft SQL writer-->
747 | 			<PipeName condition="contains">TSVCPIPE-</PipeName> <!-- Terminal Services Pipe-->
748 | 			<PipeName condition="contains">BB4BB19A178C25D1</PipeName>
749 | 			<PipeName condition="contains">SQLAnywhereLRM</PipeName>
750 | 			<PipeName condition="contains">SQLLocal</PipeName>
751 | 			<PipeName condition="contains">DropboxPipe_</PipeName>
752 | 			<Image condition="is">c:\windows\system32\inetsrv\w3wp.exe</Image>
753 | 			<Image condition="is">C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\mfcesd.exe</Image>
754 | 			<Image condition="is">C:\Pfx Engagement\WM\PFXEngagement.exe</Image>
755 | 			<Image condition="is">C:\Pfx Engagement\WM\PfxEngagement.exe</Image>
756 | 			<Image condition="is">C:\Pfx Engagement\WM\Pfx.KnowledgeCoach.SharedServices.exe</Image>
757 | 			<Image condition="is">C:\Program Files (x86)\Micro Focus\COBOL Server 2012\bin\mfds.exe</Image>
758 | 			<Image condition="is">ScreenConnect.WindowsClient.exe</Image>
759 | 			<Image condition="is">ScreenConnect.ClientService.exe</Image>
760 | 			<Image condition="is">QBW32.EXE</Image>
761 | 			<Image condition="is">C:\Windows\system32\wbem\wmiprvse.exe</Image> <!-- WMI provider service false positive for this type of event log-->
762 | 			
763 | 		</PipeEvent>
764 | 		<WmiEvent onmatch="exclude">
765 | 			<!-- Record WMI events !-->
766 | 		</WmiEvent>
767 | 		
768 | 	</EventFiltering>
769 | </Sysmon>
770 | 


--------------------------------------------------------------------------------
/sysmonv9.xml:
--------------------------------------------------------------------------------
   1 | <!--
   2 |   sysmon-config | A sysmon configuration focused on default high-quality event tracing and easy customization by the community
   3 |   Master version:	51 | Date: 2019-03-11
   4 |   Master author:	@SwiftOnSecurity, other contributors also credited in-line
   5 |   Master project:	https://github.com/SwiftOnSecurity/sysmon-config
   6 |   Master license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
   7 |   Fork version:	<N/A>
   8 |   Fork author:	<N/A>
   9 |   Fork project:	<N/A>
  10 |   Fork license:	<N/A>
  11 |  
  12 |   REQUIRED: Sysmon version 9.00 or higher 
  13 | 	https://blogs.technet.microsoft.com/sysinternals/2019/02/19/sysmon-v9-0-autoruns-v13-94/
  14 |   NOTE: Do not let the imposing size and complexity of this configuration scare you off building your own or customizing it.
  15 | 	This configuration is based around known high-quality event tracing, and thus looks extremely complicated.
  16 | 	Sysmon configurations only have to be a few lines, but significant effort has been invested in front-loading as
  17 | 	much filtering as possible onto the client. This is to make analysis of intrusions possible by hand, and try to
  18 | 	surface anomalous activity as quickly as possible to any technician armed only with Event Viewer.
  19 |   NOTE:	Sysmon is not hardened against a determined attacker with admin rights. Also, this configuration offers an attacker, willing
  20 | 	to study it closely, several ways to evade some of the alerting. If you are in a high-threat environment and have significant 
  21 | 	security staff, you should consider a much broader log-all approach. However, in the vast majority of cases, an attacker
  22 | 	will bumble along through multiple behavioral traps which this configuration monitors, especially in the first minutes.
  23 |   NOTE:	"Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.
  24 | 		"ProcessGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual process launches.
  25 | 		"LoginGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual user sessions.
  26 | -->
  27 | 
  28 | <Sysmon schemaversion="4.2">
  29 | 	<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms>
  30 | 	<EventFiltering>
  31 | 
  32 | 
  33 | 
  34 | 
  35 | 	
  36 | 	
  37 | 	<!--SYSMON EVENT ID 1 : PROCESS CREATION-->
  38 | 		<!--DATA: UtcTime, ProcessGuid, ProcessID, Image, CommandLine, CurrentDirectory, User, LogonGuid, LogonId, TerminalSessionId, IntegrityLevel, Hashes, ParentProcessGuid, ParentProcessId, ParentImage, ParentCommandLine-->
  39 | 
  40 | 	<RuleGroup name="Process Creations Exclusions" groupRelation="or">
  41 | 		<ProcessCreate onmatch="exclude">
  42 | 		
  43 | 		<!--COMMENT:	All process launched will be included, except for what matches a rule below. It's best to be as specific as possible, to
  44 | 				avoid user-mode executables imitating other process names to avoid logging, or if malware drops files in an existing directory.
  45 | 				Ultimately, you must weigh CPU time checking many detailed rules, against the risk of malware exploiting the blindness created.-->
  46 | 			<!--SECTION: Microsoft Windows-->
  47 | 			<ParentImage condition="is">C:\Program Files\avs\bin\avagent.exe</ParentImage> <!--Avamar Client-->
  48 | 			<CommandLine condition="begin with"> "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" </CommandLine> <!--Microsoft:Windows:Windows error reporting/telemetry-->
  49 | 			<CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
  50 | 			<CommandLine condition="begin with">"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel</CommandLine> <!-- Mozilla:Firefox: Large command-line arguments | Credit @Darkbat91 -->
  51 | 			<CommandLine condition="begin with">"C:\Program Files\DellTPad\ApMsgFwd.exe" -s{</CommandLine>
  52 | 			<CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine> <!--Google:Chrome: massive command-line arguments-->
  53 | 			<CommandLine condition="begin with">"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel</CommandLine> <!-- Mozilla:Firefox: Large command-line arguments | Credit @Darkbat91 -->
  54 | 			<CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</CommandLine> <!--Microsoft:DotNet-->
  55 | 			<CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine> <!--Microsoft:Windows-->
  56 | 			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine> <!--Microsoft:Windows: WMI provider host-->
  57 | 			<CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding</CommandLine> <!--Microsoft:Windows: WMI provider host-->
  58 | 			<CommandLine condition="contains">AcroRd32.exe" --channel=</CommandLine> <!--Adobe:AcrobatReader: Uninteresting sandbox subprocess-->
  59 | 			<CommandLine condition="contains">AcroRd32.exe" /CR </CommandLine> <!--Adobe:AcrobatReader: Uninsteresting sandbox subprocess-->
  60 | 			<CommandLine condition="contains">AcroRd32.exe" /CR </CommandLine> <!--Adobe:AcrobatReader: Uninteresting sandbox subprocess-->
  61 | 			<CommandLine condition="is">C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost</CommandLine> <!--Microsoft:Windows: Diagnostic System Host [ http://www.blackviper.com/windows-services/diagnostic-system-host/ ] -->
  62 | 			<CommandLine condition="is">C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC</CommandLine> <!--Microsoft:Windows:Apps: Client License Service-->
  63 | 			<CommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc</CommandLine>
  64 | 			<CommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc</CommandLine> <!--Microsoft:Windows: Windows Live Sign-In Assistant [ https://www.howtogeek.com/howto/30348/what-are-wlidsvc.exe-and-wlidsvcm.exe-and-why-are-they-running/ ] -->
  65 | 			<CommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc</CommandLine> <!--Microsoft:Windows:Apps: AppX Deployment Service-->
  66 | 			<CommandLine condition="is">C:\WINDOWS\system32\wermgr.exe -upload</CommandLine> <!--Microsoft:Windows:Windows error reporting/telemetry-->
  67 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k appmodel</CommandLine> <!--Microsoft:Windows 10-->
  68 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k dcomLaunch</CommandLine> <!--Microsoft:Windows dervices-->
  69 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k defragsvc</CommandLine> <!--Microsoft:Windows defrag-->
  70 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k imgsvc</CommandLine> <!--Microsoft:The Windows Image Acquisition Service-->
  71 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Microsoft:Windows: Network services-->
  72 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k localServiceNetworkRestricted</CommandLine> <!--Microsoft:Windows: Network services-->
  73 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k localSystemNetworkRestricted</CommandLine> <!--Microsoft:Windows: Network services-->
  74 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs</CommandLine> <!--Microsoft:Windows: Network services-->
  75 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k networkServiceNetworkRestricted</CommandLine> <!--Microsoft:Windows: Network services-->
  76 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k rPCSS</CommandLine> <!--Microsoft:Windows Services-->
  77 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k swprv</CommandLine> <!--Microsoft:Software Shadow Copy Provider-->
  78 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k unistackSvcGroup</CommandLine> <!--Microsoft:Windows 10-->
  79 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k utcsvc</CommandLine> <!--Microsoft:Windows Services-->
  80 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k wbioSvcGroup</CommandLine> <!--Microsoft:Windows Services-->
  81 | 			<CommandLine condition="is">C:\Windows\System32\svchost.exe -k wsappx</CommandLine> <!--Microsoft:Windows 10-->
  82 | 			<CommandLine condition="is">C:\Windows\system32\SearchIndexer.exe /Embedding</CommandLine> <!--Microsoft:Windows: Search Indexer-->
  83 | 			<CommandLine condition="is">C:\Windows\system32\igfxsrvc.exe -Embedding</CommandLine>
  84 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -s StateRepository</CommandLine>
  85 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel</CommandLine> <!--Microsoft:Windows 10-->
  86 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k camera -s FrameServer</CommandLine>
  87 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM</CommandLine>
  88 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay</CommandLine>
  89 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k defragsvc</CommandLine> <!--Microsoft:Windows defragmentation-->
  90 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc</CommandLine>
  91 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k imgsvc</CommandLine> <!--Microsoft:The Windows Image Acquisition Service-->
  92 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s EventSystem</CommandLine>
  93 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s bthserv</CommandLine>
  94 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s nsi</CommandLine>
  95 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s w32Time</CommandLine>
  96 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc</CommandLine>
  97 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine> <!--Microsoft:Windows: Network services-->
  98 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp</CommandLine> <!--Microsoft:Windows: Network services-->
  99 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog</CommandLine>
 100 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc</CommandLine>
 101 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc</CommandLine>
 102 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted</CommandLine> <!--Microsoft:Windows: Network services-->
 103 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNoNetwork</CommandLine>
 104 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum</CommandLine>
 105 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc</CommandLine>
 106 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService</CommandLine>
 107 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService</CommandLine>
 108 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService</CommandLine>
 109 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService</CommandLine>
 110 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService</CommandLine>
 111 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum</CommandLine>
 112 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost</CommandLine> <!--Microsoft:Windows: Diagnostic System Host [ http://www.blackviper.com/windows-services/diagnostic-system-host/ ] -->
 113 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</CommandLine> <!--Microsoft:Windows-->
 114 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc</CommandLine> <!--Microsoft:Windows: Network Connectivity Assistant [ http://www.blackviper.com/windows-services/network-connectivity-assistant/ ] -->
 115 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC</CommandLine> <!--Microsoft:Windows:Network: BitLocker Drive Encryption-->
 116 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BITS</CommandLine> <!--Microsoft:Windows:Network: Background Intelligent File Transfer (BITS) -->
 117 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc</CommandLine>
 118 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc</CommandLine>
 119 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc</CommandLine> <!--Microsoft:Windows:Network: Group Policy -->
 120 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc</CommandLine> <!--Microsoft:Windows: Network services-->
 121 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SENS</CommandLine> <!--Microsoft:Windows: Network services-->
 122 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv</CommandLine> <!--Microsoft:Windows: Network services-->
 123 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Themes</CommandLine> <!--Microsoft:Windows: Network services-->
 124 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt</CommandLine> <!--Microsoft:Windows: Windows Management Instrumentation (WMI) -->
 125 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</CommandLine> <!--Microsoft:Windows: Network services-->
 126 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc</CommandLine>
 127 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s Dnscache</CommandLine> <!--Microsoft:Windows:Network: DNS caching, other uses -->
 128 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation</CommandLine> <!--Microsoft:Windows:Network: "Workstation" service, used for SMB file-sharing connections and RDP-->
 129 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s NlaSvc</CommandLine> <!--Microsoft:Windows:Network: Network Location Awareness-->
 130 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s TermService</CommandLine> <!--Microsoft:Windows:Network: Terminal Services (RDP)-->
 131 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService</CommandLine> <!--Microsoft:Windows: Network services-->
 132 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted</CommandLine> <!--Microsoft:Windows: Network services-->
 133 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k rPCSS</CommandLine> <!--Microsoft:Windows Services-->
 134 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k secsvcs</CommandLine>
 135 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k swprv</CommandLine> <!--Microsoft:Software Shadow Copy Provider-->
 136 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k unistackSvcGroup</CommandLine> <!--Microsoft:Windows 10-->
 137 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k utcsvc</CommandLine> <!--Microsoft:Windows Services-->
 138 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wbioSvcGroup</CommandLine> <!--Microsoft:Windows Services-->
 139 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k werSvcGroup</CommandLine> <!--Microsoft:Windows: ErrorReporting-->
 140 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC</CommandLine> <!--Microsoft:Windows:Apps: Client License Service-->
 141 | 			<CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx</CommandLine> <!--Microsoft:Windows:Apps [ https://www.howtogeek.com/320261/what-is-wsappx-and-why-is-it-running-on-my-pc/ ] -->
 142 | 			<CommandLine condition="is">C:\windows\System32\svchost.exe -k werSvcGroup</CommandLine> <!--Microsoft:Windows: ErrorReporting-->
 143 | 			<CommandLine condition="is">C:\windows\system32\wermgr.exe -queuereporting</CommandLine> <!--Microsoft:Windows:Windows error reporting/telemetry-->
 144 | 			<CommandLine condition="is">\??\C:\WINDOWS\system32\autochk.exe *</CommandLine> <!--Microsoft:Bootup: Auto Check Utility-->
 145 | 			<CommandLine condition="is">\SystemRoot\System32\smss.exe</CommandLine> <!--Microsoft:Bootup: Windows Session Manager-->
 146 | 			<Image condition="begin with">C:\Program Files (x86)\Google\Update\</Image> <!--Google:Chrome: Updater-->
 147 | 			<Image condition="begin with">C:\Program Files (x86)\Google\Update\</Image> <!--Google:Chrome:Updater: You should experiment with this line since attackers sometimes hide in this folder-->
 148 | 			<Image condition="begin with">C:\Program Files\NVIDIA Corporation\</Image> <!--Nvidia:Driver: routine actions-->
 149 | 			<Image condition="begin with">C:\Program Files\Realtek\</Image> <!--Realtek:Driver: routine actions-->
 150 | 			<Image condition="begin with">C:\Program Files\Windows Defender</Image> <!--Microsoft:Windows:Defender in Win10-->
 151 | 			<Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_</Image> <!--Microsoft:Defender: Signature updates-->
 152 | 			<Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_Base</Image> <!--Microsoft:Defender: Full signature updates-->
 153 | 			<Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_Delta</Image> <!--Microsoft:Defender: Delta signature updates-->
 154 | 			<Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_Engine</Image> <!--Microsoft:Defender: Engine updates-->
 155 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe</Image> <!--Adobe:Acrobat: Sandbox subprocess, still evaluating security exposure-->
 156 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe</Image> <!--Adobe: Telemetry [ https://forums.adobe.com/thread/1006701 ] -->
 157 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe</Image> <!--Adobe:Acrobat: Sandbox subprocess, still evaluating security exposure-->
 158 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe</Image>
 159 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe</Image>
 160 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe</Image> <!--Adobe: Telemetry [ https://forums.adobe.com/thread/1006701 ] -->
 161 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe</Image> <!--Adobe:AcrobatReader: Sandbox subprocess, still evaluating security exposure-->
 162 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe</Image> <!--Adobe: Telemetry [ https://forums.adobe.com/thread/1006701 ] -->
 163 | 			<Image condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe</Image>
 164 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</Image> <!--Adobe:Updater: Properly hardened updater, not a risk-->
 165 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe</Image> <!--Adobe:Updater: Properly hardened updater, not a risk-->
 166 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe</Image>
 167 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe</Image> <!--Adobe:Creative Cloud-->
 168 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe</Image> <!--Adobe:License utility-->
 169 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe</Image> <!--Adobe:License utility-->
 170 | 			<Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</Image>
 171 | 			<Image condition="end with">C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe</Image> <!--Dropbox:Updater: Lots of command-line arguments-->
 172 | 			<Image condition="end with">C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe</Image> <!--Adobe:Flash: Properly hardened updater, not a risk-->
 173 | 			<Image condition="end with">C:\Windows\System32\CompatTelRunner.exe</Image> <!--Microsoft:Windows:Customer Experience Improvement-->
 174 | 			<Image condition="is">C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe</Image> <!--Microsoft:Windows: Touch Keyboard and Handwriting Panel Helper-->
 175 | 			<Image condition="is">C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE</Image> <!--Microsoft:Office: Background process for SharePoint/Office365 connectivity-->
 176 | 			<Image condition="is">C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE</Image> <!--Microsoft:Office: Background process-->
 177 | 			<Image condition="is">C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe</Image>
 178 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image> <!--Microsoft:Office: Background process-->
 179 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE</Image> <!--Microsoft:Office: Background process-->
 180 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE</Image> <!--Microsoft:Office: Licensing service-->
 181 | 			<Image condition="is">C:\Program Files\Dell\SupportAssist\koala.exe</Image> <!--Dell:SupportAssist: routine actions-->
 182 | 			<Image condition="is">C:\Program Files\Dell\SupportAssist\pcdrcui.exe</Image> <!--Dell:SupportAssist: routine actions-->
 183 | 			<Image condition="is">C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE</Image> <!--Microsoft:Office: Background process for SharePoint/Office365 connectivity-->
 184 | 			<Image condition="is">C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE</Image> <!--Microsoft:Office: Background process for SharePoint/Office365 connectivity-->
 185 | 			<Image condition="is">C:\Program Files\Microsoft Office\Office16\msoia.exe</Image> <!--Microsoft:Office: Telemetry collector-->
 186 | 			<Image condition="is">C:\Program Files\Windows Media Player\wmpnscfg.exe</Image> <!--Microsoft:Windows: Windows Media Player Network Sharing Service Configuration Application-->
 187 | 			<Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
 188 | 			<Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
 189 | 			<Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image> <!--Microsoft:Windows: Font cache service-->
 190 | 			<Image condition="is">C:\Windows\SysWOW64\wermgr.exe</Image> <!--Microsoft:Windows:Windows error reporting/telemetry-->
 191 | 			<Image condition="is">C:\Windows\System32\MpSigStub.exe</Image> <!--Microsoft:Windows: Microsoft Malware Protection Signature Update Stub-->
 192 | 			<Image condition="is">C:\Windows\System32\MusNotification.exe</Image> <!--Microsoft:Windows: Update popups-->
 193 | 			<Image condition="is">C:\Windows\System32\MusNotificationUx.exe</Image> <!--Microsoft:Windows: Update popups-->
 194 | 			<Image condition="is">C:\Windows\System32\TokenBrokerCookies.exe</Image> <!--Microsoft:Windows: SSO sign-in assistant for MicrosoftOnline.com-->
 195 | 			<Image condition="is">C:\Windows\System32\audiodg.exe</Image> <!--Microsoft:Windows: Launched constantly-->
 196 | 			<Image condition="is">C:\Windows\System32\conhost.exe</Image> <!--Microsoft:Windows: Command line interface host process-->
 197 | 			<Image condition="is">C:\Windows\System32\plasrv.exe</Image> <!--Microsoft:Windows: Performance Logs and Alerts DCOM Server-->
 198 | 			<Image condition="is">C:\Windows\System32\powercfg.exe</Image> <!--Microsoft:Power configuration management-->
 199 | 			<Image condition="is">C:\Windows\System32\wbem\WmiApSrv.exe</Image> <!--Microsoft:Windows: WMI performance adpater host process-->
 200 | 			<Image condition="is">C:\Windows\System32\wermgr.exe</Image> <!--Microsoft:Windows:Windows error reporting/telemetry-->
 201 | 			<Image condition="is">C:\Windows\System32\wifitask.exe</Image> <!--Microsoft:Windows: Wireless Background Task-->
 202 | 			<Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image> <!--Microsoft:Windows: Customer Experience Improvement-->
 203 | 			<Image condition="is">C:\Windows\system32\MpSigStub.exe</Image> <!--Microsoft:Windows: Microsoft Malware Protection Signature Update Stub-->
 204 | 			<Image condition="is">C:\Windows\system32\PrintIsolationHost.exe</Image> <!--Microsoft:Windows: Printing-->
 205 | 			<Image condition="is">C:\Windows\system32\SppExtComObj.Exe</Image> <!--Microsoft:Windows: KMS activation-->
 206 | 			<Image condition="is">C:\Windows\system32\audiodg.exe</Image> <!--Microsoft:Windows: Launched constantly-->
 207 | 			<Image condition="is">C:\Windows\system32\conhost.exe</Image> <!--Microsoft:Windows: Command line interface host process-->
 208 | 			<Image condition="is">C:\Windows\system32\mobsync.exe</Image> <!--Microsoft:Windows: Network file syncing-->
 209 | 			<Image condition="is">C:\Windows\system32\musNotification.exe</Image> <!--Microsoft:Windows: Update pop-ups-->
 210 | 			<Image condition="is">C:\Windows\system32\musNotificationUx.exe</Image> <!--Microsoft:Windows: Update pop-ups-->
 211 | 			<Image condition="is">C:\Windows\system32\powercfg.exe</Image> <!--Microsoft:Power configuration management-->
 212 | 			<Image condition="is">C:\Windows\system32\sndVol.exe</Image> <!--Microsoft:Windows: Volume control-->
 213 | 			<Image condition="is">C:\Windows\system32\sppsvc.exe</Image> <!--Microsoft:Windows: Software Protection Service-->
 214 | 			<Image condition="is">C:\Windows\system32\wbem\WmiApSrv.exe</Image> <!--Microsoft:Windows: WMI performance adapter host process-->
 215 | 			<IntegrityLevel condition="is">AppContainer</IntegrityLevel> <!--Microsoft:Windows: Don't care about sandboxed processes-->
 216 | 			<ParentCommandLine condition="begin with">%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows</ParentCommandLine> <!--Microsoft:Windows:CommandShell: Triggered when programs use the command shell, but doesn't provide attribution for what caused it-->
 217 | 			<ParentCommandLine condition="begin with">%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows</ParentCommandLine> <!--Microsoft:Windows:CommandShell: Triggered when programs use the command shell, but without attribution-->
 218 | 			<ParentCommandLine condition="contains">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentCommandLine>
 219 | 			<ParentCommandLine condition="end with">"-outc=C:\ProgramData\Dell\CommandUpdate\inventory.xml" "-logc=C:\ProgramData\Dell\CommandUpdate\scanerrs.xml" "-lang=en" "-enc=UTF-16" </ParentCommandLine>
 220 | 			<ParentCommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k DcomLaunch</ParentCommandLine>
 221 | 			<ParentCommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs</ParentCommandLine> <!--Microsoft:Windows: Network services: Spawns Consent.exe-->
 222 | 			<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted</ParentCommandLine> <!--Microsoft:Windows: Network services-->
 223 | 			<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</ParentCommandLine> <!--Microsoft:Windows-->
 224 | 			<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</ParentCommandLine> <!--Microsoft:Windows: Network services: Spawns Consent.exe-->
 225 | 			<ParentCommandLine condition="is">C:\windows\system32\wermgr.exe -queuereporting</ParentCommandLine> <!--Microsoft:Windows:Windows error reporting/telemetry-->
 226 | 			<ParentImage condition="begin with">C:\Program Files (x86)\Google\Update\</ParentImage> <!--Google:Chrome: Updater-->
 227 | 			<ParentImage condition="begin with">C:\Program Files (x86)\Google\Update\</ParentImage> <!--Google:Chrome:Updater: You should experiment with this line since attackers sometimes hide in this folder-->
 228 | 			<ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe</ParentImage>
 229 | 			<ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe</ParentImage>
 230 | 			<ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe</ParentImage>
 231 | 			<ParentImage condition="end with">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe</ParentImage> <!--Cisco: Calls netsh to change settings on connect-->
 232 | 			<ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</ParentImage> <!--Adobe:Updater: Properly hardened updater, not a risk-->
 233 | 			<ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe</ParentImage>
 234 | 			<ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe</ParentImage> <!--Adobe:License utility-->
 235 | 			<ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</ParentImage>
 236 | 			<ParentImage condition="end with">C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe</ParentImage>
 237 | 			<ParentImage condition="end with">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</ParentImage> <!--Microsoft:Office: Background process-->
 238 | 			<ParentImage condition="end with">C:\Program Files\DellTPad\HidMonitorSvc.exe</ParentImage>
 239 | 			<ParentImage condition="end with">C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe</ParentImage> <!--Realtek:Driver: routine actions-->
 240 | 			<ParentImage condition="image">C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</ParentImage> <!--Dell:CommandUpdate: Detection process-->
 241 | 			<ParentImage condition="is">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</ParentImage>
 242 | 			<ParentImage condition="is">C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</ParentImage> <!--Dell:CommandUpdate: Detection process-->
 243 | 			<ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</ParentImage> <!--Microsoft:Office: Background process-->
 244 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</ParentImage> <!--Microsoft:DotNet-->
 245 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet-->
 246 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</ParentImage> <!--Microsoft:DotNet-->
 247 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet-->
 248 | 			<ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage> <!--Microsoft:DotNet: Spawns thousands of ngen.exe processes-->
 249 | 			<ParentImage condition="is">C:\Windows\system32\SearchIndexer.exe</ParentImage> <!--Microsoft:Windows:Search: Launches many uninteresting sub-processes-->
 250 | 			<CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine> <!--Microsoft:Windows-->
 251 | 		</ProcessCreate>
 252 | </RuleGroup>
 253 | 
 254 | 	<!--SYSMON EVENT ID 2 : FILE CREATION TIME RETROACTIVELY CHANGED IN THE FILESYSTEM-->
 255 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, PreviousCreationUtcTime-->
 256 | 		<RuleGroup name="FileCreateTime Excutions" groupRelation="or">
 257 | 		<FileCreateTime onmatch="include">
 258 | 			<Image condition="begin with">C:\Users</Image> <!--Look for timestomping in user area-->
 259 | 			<Image condition="begin with">C:\windows\temp</Image>
 260 | 		</FileCreateTime>
 261 | 	</RuleGroup>
 262 | 	<RuleGroup name="FileCreateTime Exclusions" groupRelation="or">
 263 | 		<FileCreateTime onmatch="exclude">
 264 | 			<Image condition="image">OneDrive.exe</Image> <!--OneDrive constantly changes file times-->
 265 | 			<Image condition="contains">setup</Image> <!--Ignore setups-->
 266 | 			<Image condition="contains">install</Image> <!--Ignore setups-->
 267 | 			<Image condition="contains">Update\</Image> <!--Ignore setups-->
 268 | 			<Image condition="end with">redist.exe</Image> <!--Ignore setups-->
 269 | 			<Image condition="is">TrustedInstaller.exe</Image> <!--Ignore setups-->
 270 | 		</FileCreateTime>
 271 | 	</RuleGroup>
 272 | 
 273 | 	<!--SYSMON EVENT ID 3 : NETWORK CONNECTION INITIATED-->
 274 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, User, Protocol, Initiated, SourceIsIpv6, SourceIp, SourceHostname, SourcePort, SourcePortName, DestinationIsIpV6, DestinationIP, DestinationHostname, DestinationPort, DestinationPortName-->
 275 | 		<RuleGroup name="Network connections" groupRelation="or">
 276 | 		<NetworkConnect onmatch="include">
 277 | 		<!--COMMENT:	Takes a very conservative approach to network logging, limit to extremely high-signal events.-->
 278 | 		<!--TECHNICAL:	For the DestinationHostname, Sysmon uses the GetNameInfo API, which may not always have the information or may be a CDN. Using that field is best-effort only.-->
 279 | 		<!--TECHNICAL:	These exe's do not initiate their connections, and cannot be included: BITSADMIN-->
 280 | 			<!--Suspicious sources-->
 281 | 			<Image condition="begin with">C:\Users</Image> <!--Tools downloaded by users can use other processes for networking, but this is a very valuable indicator.-->
 282 | 			<Image condition="begin with">C:\ProgramData</Image> <!--Normally, network communications should be sourced from "Program Files" not from ProgramData, something to look at-->
 283 | 			<Image condition="begin with">C:\Windows\Temp</Image> <!--Suspicious anything would communicate from the system-level temp directory-->
 284 | 			<!--Suspicious Windows tools-->
 285 | 			<Image condition="image">at.exe</Image> <!--Microsoft:Windows: Remote task scheduling | Credit @ion-storm -->
 286 | 			<Image condition="image">certutil.exe</Image> <!--Microsoft:Windows: Certificate tool can contact outbound | Credit @ion-storm and @FVT [ https://twitter.com/FVT/status/834433734602530817 ] -->
 287 | 			<Image condition="image">cmd.exe</Image> <!--Microsoft:Windows: Command prompt-->
 288 | 			<Image condition="image">cmstp.exe</Image> <!--Microsoft:Windows: Connection manager profiles can launch executables from WebDAV [ https://twitter.com/NickTyrer/status/958450014111633408 ] | Credit @NickTyrer @Oddvarmoe @KyleHanslovan @subTee -->
 289 | 			<Image condition="image">cscript.exe</Image> <!--Microsoft:WindowsScriptingHost: | Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] --> <!--  wmiexec.vbs JPCERT-->
 290 | 			<Image condition="image">driverquery.exe</Image> <!--Microsoft:Windows: Remote recognisance of system configuration, oudated/vulnerable drivers -->
 291 | 			<Image condition="image">dsquery.exe</Image> <!--Microsoft: Query Active Directory -->
 292 | 			<Image condition="image">hh.exe</Image> <!--Microsoft:Windows: HTML Help Executable, opens CHM files -->
 293 | 			<Image condition="image">infDefaultInstall.exe</Image> <!--Microsoft: [ https://github.com/huntresslabs/evading-autoruns ] | Credit @KyleHanslovan -->
 294 | 			<Image condition="image">java.exe</Image> <!--Java: Monitor usage of vulnerable application | Credit @ion-storm -->
 295 | 			<Image condition="image">javaw.exe</Image> <!--Java: Monitor usage of vulnerable application and init from JAR files -->
 296 | 			<Image condition="image">javaws.exe</Image> <!--Java: Monitor usage of vulnerable application and init from JAR files -->
 297 | 			<Image condition="image">mmc.exe</Image> <!--Microsoft:Windows: -->
 298 | 			<Image condition="image">msbuild.exe</Image> <!--Microsoft:Windows: [ https://www.hybrid-analysis.com/sample/a314f6106633fba4b70f9d6ddbee452e8f8f44a72117749c21243dc93c7ed3ac?environmentId=100 ] -->
 299 | 			<Image condition="image">mshta.exe</Image> <!--Microsoft:Windows: HTML application executes scripts without IE protections | Credit @ion-storm [ https://en.wikipedia.org/wiki/HTML_Application ] -->
 300 | 			<Image condition="image">msiexec.exe</Image> <!--Microsoft:Windows: Can install from http:// paths | Credit @vector-sec -->
 301 | 			<Image condition="image">nbtstat.exe</Image> <!--Microsoft:Windows: NetBIOS statistics, attackers use to enumerate local network -->
 302 | 			<Image condition="image">net.exe</Image> <!--Microsoft:Windows: "net use"/"net view" used by attackers to surveil and connect with file shares from command line | Credit @ion-storm -->
 303 | 			<Image condition="image">net1.exe</Image> <!--Microsoft:Windows: Launched by "net.exe", but it may not detect connections either -->
 304 | 			<Image condition="image">notepad.exe</Image> <!--Microsoft:Windows: [ https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/ ] -->
 305 | 			<Image condition="image">nslookup.exe</Image> <!--Microsoft:Windows: Retrieve data over DNS -->
 306 | 			<Image condition="image">powershell.exe</Image> <!--Microsoft:Windows: PowerShell interface-->
 307 | 			<Image condition="image">qprocess.exe</Image> <!--Microsoft:Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
 308 | 			<Image condition="image">qwinsta.exe</Image> <!--Microsoft:Windows: Remotely query login sessions on a server or workstation | Credit @ion-storm -->
 309 | 			<Image condition="image">reg.exe</Image> <!--Microsoft:Windows: Remote Registry | Credit @ion-storm -->
 310 | 			<Image condition="image">regsvcs.exe</Image> <!--Microsoft:Windows: [ https://www.hybrid-analysis.com/sample/3f94d7080e6c5b8f59eeecc3d44f7e817b31562caeba21d02ad705a0bfc63d67?environmentId=100 ] -->
 311 | 			<Image condition="image">regsvr32.exe</Image> <!--Microsoft:Windows: [ https://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html ] -->
 312 | 			<Image condition="image">rundll32.exe</Image> <!--Microsoft:Windows: [ https://blog.cobaltstrike.com/2016/07/22/why-is-rundll32-exe-connecting-to-the-internet/ ] -->
 313 | 			<Image condition="image">rwinsta.exe</Image> <!--Microsoft:Windows: Disconnect remote sessions | Credit @ion-storm -->
 314 | 			<Image condition="image">sc.exe</Image> <!--Microsoft:Windows: Remotely change Windows service settings from command line | Credit @ion-storm -->
 315 | 			<Image condition="image">schtasks.exe</Image> <!--Microsoft:Windows: Command-line interface to local and remote tasks -->
 316 | 			<Image condition="image">taskkill.exe</Image> <!--Microsoft:Windows: Kill processes, has remote ability -->
 317 | 			<Image condition="image">tasklist.exe</Image> <!--Microsoft:Windows: List processes, has remote ability -->
 318 | 			<Image condition="image">wmic.exe</Image> <!--Microsoft:WindowsManagementInstrumentation: Credit @Cyb3rOps [ https://gist.github.com/Neo23x0/a4b4af9481e01e749409 ] -->
 319 | 			<Image condition="image">wscript.exe</Image> <!--Microsoft:WindowsScriptingHost: | Credit @arekfurt -->
 320 | 			<Image condition="image">nc.exe</Image> <!-- Nmap's modern version of netcat [ https://nmap.org/ncat/guide/index.html#ncat-overview ] [ https://securityblog.gr/1517/create-backdoor-in-windows-with-ncat/ ] -->
 321 | 			<Image condition="image">ncat.exe</Image> <!-- Nmap's modern version of netcat [ https://nmap.org/ncat/guide/index.html#ncat-overview ] [ https://securityblog.gr/1517/create-backdoor-in-windows-with-ncat/ ] -->
 322 | 			<!--Relevant 3rd Party Tools: Remote Access-->
 323 | 			<Image condition="image">psexec.exe</Image> <!--Sysinternals:PsExec client side | Credit @Cyb3rOps -->
 324 | 			<Image condition="image">psexesvc.exe</Image> <!--Sysinternals:PsExec server side | Credit @Cyb3rOps -->
 325 | 			<Image condition="image">vnc.exe</Image> <!-- VNC client | Credit @Cyb3rOps -->
 326 | 			<Image condition="image">vncviewer.exe</Image> <!-- VNC client | Credit @Cyb3rOps -->
 327 | 			<Image condition="image">vncservice.exe</Image> <!-- VNC server | Credit @Cyb3rOps -->
 328 | 			<Image condition="image">winexesvc.exe</Image> <!-- Winexe service executable | Credit @Cyb3rOps -->
 329 | 			<Image condition="image">\AA_v</Image> <!-- Ammy Admin service executable (e.g. AA_v3.0.exe AA_v3.5.exe ) | Credit @Cyb3rOps -->
 330 | 			<!-- Often exploited services --> 
 331 | 			<Image condition="image">omniinet.exe</Image> <!-- HP Data Protector https://www.cvedetails.com/vulnerability-list/vendor_id-10/product_id-20499/HP-Data-Protector.html | Credit @Cyb3rOps -->
 332 | 			<Image condition="image">hpsmhd.exe</Image> <!-- HP System Management Homepage https://www.cvedetails.com/vulnerability-list/vendor_id-10/product_id-7244/HP-System-Management-Homepage.html | Credit @Cyb3rOps -->
 333 | 			<!--Malware related-->
 334 | 			<Image condition="image">tor.exe</Image> <!--Tor [ https://www.hybrid-analysis.com/sample/800bf028a23440134fc834efc5c1e02cc70f05b2e800bbc285d7c92a4b126b1c?environmentId=100 ] -->
 335 | 			<!--Ports: Suspicious-->
 336 | 			<Image condition="image">services.exe</Image>
 337 | 				<Image condition="image">nmap.exe</Image>
 338 | 			<Image condition="image">psinfo.exe</Image>
 339 | 			<!--Ports: Suspicious-->
 340 | 			<DestinationPort condition="is">22</DestinationPort> <!--SSH protocol-->
 341 | 			<DestinationPort condition="is">23</DestinationPort> <!--Telnet protocol-->
 342 | 			<DestinationPort condition="is">25</DestinationPort> <!--SMTP mail protocol-->
 343 | 			<DestinationPort condition="is">3389</DestinationPort> <!--Microsoft:Windows:RDP-->
 344 | 			<DestinationPort condition="is">5800</DestinationPort> <!--VNC protocol-->
 345 | 			<DestinationPort condition="is">5900</DestinationPort> <!--VNC protocol-->
 346 | 			<!--Ports: Proxy-->
 347 | 			<DestinationPort condition="is">1080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
 348 | 			<DestinationPort condition="is">3128</DestinationPort> <!--Socks proyx port | Credit @ion-storm-->
 349 | 			<DestinationPort condition="is">8080</DestinationPort> <!--Socks proxy port | Credit @ion-storm-->
 350 | 			<!--Ports: Tor-->
 351 | 			<DestinationPort condition="is">1723</DestinationPort> <!--Tor protocol | Credit @ion-storm-->
 352 | 			<DestinationPort condition="is">4500</DestinationPort> <!--Tor protocol | Credit @ion-storm-->
 353 | 			<DestinationPort condition="is">9001</DestinationPort> <!--Tor protocol [ http://www.computerworlduk.com/tutorial/security/tor-enterprise-2016-blocking-malware-darknet-use-rogue-nodes-3633907/ ] -->
 354 | 			<DestinationPort condition="is">9030</DestinationPort> <!--Tor protocol [ http://www.computerworlduk.com/tutorial/security/tor-enterprise-2016-blocking-malware-darknet-use-rogue-nodes-3633907/ ] -->
 355 | 			<DestinationPort condition="is">445</DestinationPort>   <!-- SMB Lateral movement -->
 356 | 		</NetworkConnect>
 357 | 	</RuleGroup>
 358 | 	<RuleGroup name="Network Connections Exclusions" groupRelation="or">
 359 | 		<NetworkConnect onmatch="exclude">
 360 | 			<Image condition="image">OneDrive.exe</Image> <!--Microsoft:OneDrive-->
 361 | 			<Image condition="image">Spotify.exe</Image> <!--Spotify-->
 362 | 			<Image condition="end with">AppData\Roaming\Dropbox\bin\Dropbox.exe</Image> <!--Dropbox-->
 363 | 			<Image condition="image">g2ax_comm_expert.exe</Image> <!--GoToMeeting-->
 364 | 			<Image condition="image">g2mcomm.exe</Image> <!--GoToMeeting-->
 365 | 			<!--SECTION: Microsoft-->
 366 | 			<Image condition="image">OneDriveStandaloneUpdater.exe</Image> <!--Microsoft:OneDrive-->
 367 | 			<Image condition="image">OneDrive.exe</Image> <!--Microsoft:OneDrive-->
 368 | 			<!--<Image condition="image">system.exe</Image>-->
 369 | 			<Image condition="end with">AppData\Local\Microsoft\Teams\current\Teams.exe</Image> <!--Microsoft: Teams-->
 370 | 			<DestinationHostname condition="end with">microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
 371 | 			<DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
 372 | 			<DestinationHostname condition="end with">microsoft.com.nsatc.net</DestinationHostname> <!--Microsoft:Update delivery-->
 373 | 		</NetworkConnect>
 374 | 		</RuleGroup>
 375 | 	<!--SYSMON EVENT ID 4 : RESERVED FOR SYSMON STATUS MESSAGES, THIS LINE IS INCLUDED FOR DOCUMENTATION PURPOSES ONLY-->
 376 | 		<!--DATA: UtcTime, State, Version, SchemaVersion-->
 377 | 		<!--Cannot be filtered.-->
 378 | 
 379 | 	<!--SYSMON EVENT ID 5 : PROCESS ENDED-->
 380 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image-->
 381 | 		<RuleGroup name="Process terminations" groupRelation="or">
 382 | 		<ProcessTerminate onmatch="include">
 383 | 		<!--COMMENT:	Useful data in building infection timelines.-->
 384 | 			<Image condition="begin with">C:\Users</Image> <!--Process terminations by user binaries-->
 385 | 			<Image condition="begin with">C:\Windows\Temp</Image> <!--Process terminations by windows Temp binaries-->
 386 | 		</ProcessTerminate>
 387 | 		</RuleGroup>
 388 | 		<RuleGroup name="Process termination Exclusions" groupRelation="or">
 389 | 			<ProcessTerminate onmatch="exclude">
 390 | 			</ProcessTerminate>
 391 | 		</RuleGroup>
 392 | 	<!--SYSMON EVENT ID 6 : DRIVER LOADED INTO KERNEL-->
 393 | 		<!--DATA: UtcTime, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
 394 | 		<RuleGroup name="Driver load Exclusions " groupRelation="or">
 395 | 		<DriverLoad onmatch="exclude">
 396 | 		<!--COMMENT:	Because drivers with bugs can be used to escalate to kernel permissions, be extremely selective
 397 | 				about what you exclude from monitoring. Low event volume, little incentive to exclude.-->
 398 | 			<Signature condition="contains">microsoft</Signature> <!--Exclude signed Microsoft drivers-->
 399 | 			<Signature condition="contains">windows</Signature> <!--Exclude signed Microsoft drivers-->
 400 | 			<Signature condition="begin with">Intel </Signature> <!--Exclude signed Intel drivers-->
 401 | 		</DriverLoad>
 402 | 		</RuleGroup>
 403 | 
 404 | 	<!--SYSMON EVENT ID 7 : DLL (IMAGE) LOADED BY PROCESS-->
 405 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
 406 | 		<RuleGroup name="DLL load" groupRelation="or">
 407 | 		<ImageLoad onmatch="include">
 408 | 		<!--COMMENT:	Can cause high system load, disabled by default, important examples included below.-->
 409 | 		</ImageLoad>
 410 | 	</RuleGroup>
 411 | 
 412 | 
 413 | 	<!--SYSMON EVENT ID 8 : REMOTE THREAD CREATED-->
 414 | 		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceImage, TargetProcessId, TargetImage, NewThreadId, StartAddress, StartModule, StartFunction-->
 415 | 	<RuleGroup name="Thread Creation Exclusions " groupRelation="or">
 416 | 		<CreateRemoteThread onmatch="exclude">
 417 | 		<!--COMMENT:	Monitor for processes injecting code into other processes. Often used by malware to cloak their actions.
 418 | 				Exclude mostly-safe sources and log anything else.-->
 419 | 			<SourceImage condition="is">C:\Windows\System32\wbem\WmiPrvSE.exe</SourceImage>
 420 | 			<SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
 421 | 			<SourceImage condition="is">C:\Windows\System32\wininit.exe</SourceImage>
 422 | 			<SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
 423 | 			<SourceImage condition="is">C:\Windows\System32\services.exe</SourceImage>
 424 | 			<SourceImage condition="is">C:\Windows\System32\winlogon.exe</SourceImage>
 425 | 			<SourceImage condition="is">C:\Windows\System32\audiodg.exe</SourceImage>
 426 | 			<SourceImage condition="is">C:\Program Files (x86)\PharosSystems\PrintScout\CTskMstr.exe</SourceImage>
 427 | 			<SourceProcessGuid condition="contains">28f4c222-3655-59a5-0000-0010d60e8919</SourceProcessGuid>
 428 | 			<SourceProcessGuid condition="contains">28f4c222-bb74-59b7-0000-00103f02932c</SourceProcessGuid>
 429 | 			<SourceImage condition="contains">C:\PROGRA~2\PHAROS~1\PRINTS~1\CTskMstr.exe</SourceImage>
 430 | 			<StartModule condition="is">C:\windows\system32\kernel32.dll</StartModule>
 431 | 			<TargetImage condition="end with">Google\Chrome\Application\chrome.exe</TargetImage>
 432 | 		</CreateRemoteThread>
 433 | 	</RuleGroup>
 434 | 	<!--SYSMON EVENT ID 9 : RAW DISK ACCESS-->
 435 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, Device-->
 436 | 		<RuleGroup name="RawAccess" groupRelation="or">
 437 | 		<RawAccessRead onmatch="include">
 438 | 		<!--COMMENT:	Monitor for raw sector-level access to the disk, often used to bypass access control lists or access locked files.
 439 | 				Disabled by default since including even one entry here activates this component. Reward/performance/rule maintenance decision.
 440 | 				Encourage you to experiment with this feature yourself.-->
 441 | 		<!--COMMENT:	You will likely want to set this to a full capture on domain controllers, where no process should be doing raw reads.-->
 442 | 		</RawAccessRead>
 443 | 	</RuleGroup>
 444 | 
 445 | 	<!--SYSMON EVENT ID 10 : INTER-PROCESS ACCESS-->
 446 | 		<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceThreadId, SourceImage, TargetProcessGuid, TargetProcessId, TargetImage, GrantedAccess, CallTrace-->
 447 | 		<RuleGroup name="Process Access Include" groupRelation="or">
 448 | 		<ProcessAccess onmatch="include">
 449 | 			<TargetImage condition="is">C:\WINDOWS\system32\lsass.exe</TargetImage>
 450 | 			<TargetImage condition="is">C:\Windows\SysWOW64\netsh.exe</TargetImage> <!-- JPCERT BeginX destination Host -->
 451 | 			<TargetImage condition="is">C:\Windows\system32\cmd.exe</TargetImage> <!--JPCERT winrs destination host-->
 452 | 			<!--<CallTrace condition="contains">dbghelp</CallTrace>
 453 | 			<CallTrace condition="contains">dbgcore</CallTrace>-->
 454 | 		<!--COMMENT:	Monitor for processes accessing other process' memory. This can be valuable, but can cause a huge number of events.-->
 455 | 		</ProcessAccess>
 456 | 		</RuleGroup>
 457 | 		<RuleGroup name="Process Access Exclusions" groupRelation="or">
 458 | 		<ProcessAccess onmatch="exclude">
 459 | 			<GrantedAccess condition="is">0x1400</GrantedAccess>
 460 | 			<GrantedAccess condition="is">0x1000</GrantedAccess>
 461 | 			<GrantedAccess condition="is">0x400</GrantedAccess>
 462 | 			<SourceImage condition="is">C:\Windows\system32\wbem\wmiprvse.exe</SourceImage>
 463 | 			<SourceImage condition="is">C:\Windows\system32\lsm.exe</SourceImage>
 464 | 			<SourceImage condition="is">C:\Windows\system32\wbem\wmiprvse.exe</SourceImage>
 465 | 			<SourceImage condition="is">C:\Windows\sysWOW64\wbem\wmiprvse.exe</SourceImage>
 466 | 			<SourceImage condition="is">C:\Program Files\Hewlett-Packard\AMS\service\hpqams.exe</SourceImage>
 467 | 			<SourceImage condition="contains">esrv_svc.exe</SourceImage>
 468 | 			<SourceImage condition="is">VBoxService.exe</SourceImage>
 469 | 		</ProcessAccess>
 470 | 		</RuleGroup>
 471 | 
 472 | 	<RuleGroup name="FileCreate Includes" groupRelation="or">
 473 | 	
 474 | 	<!--SYSMON EVENT ID 11 : FILE CREATED-->
 475 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime-->
 476 | 	
 477 | 		<FileCreate onmatch="include">
 478 | 		<TargetFilename condition="contains">\Startup</TargetFilename> <!--Microsoft:Office: Changes to user's autoloaded files under AppData-->
 479 | 			<TargetFilename condition="contains">\Content.Outlook\</TargetFilename> <!--Microsoft:Outlook: attachments--> <!--PRIVACY WARNING-->
 480 | 			<TargetFilename condition="contains">\Downloads\</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE--> <!--PRIVACY WARNING-->
 481 | 			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
 482 | 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
 483 | 			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
 484 | 			<TargetFilename condition="end with">.chm</TargetFilename>
 485 | 			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
 486 | 			<TargetFilename condition="end with">.cmdline</TargetFilename> <!--Microsoft:dotNet: Executed by cvtres.exe-->
 487 | 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 488 | 			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
 489 | 			<TargetFilename condition="end with">.jar</TargetFilename> <!--Java applets-->
 490 | 			<TargetFilename condition="end with">.jnlp</TargetFilename> <!--Java applets-->
 491 | 			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
 492 | 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
 493 | 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 494 | 			<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
 495 | 			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
 496 | 			<TargetFilename condition="end with">.scr</TargetFilename> <!--System driver files-->
 497 | 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting-->
 498 | 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting-->
 499 | 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 500 | 			<TargetFilename condition="end with">proj</TargetFilename><!--Microsoft:MSBuild:Script: More information: https://twitter.com/subTee/status/885919612969394177-->
 501 | 			<TargetFilename condition="end with">.sln</TargetFilename><!--Microsoft:MSBuild:Script: More information: https://twitter.com/subTee/status/885919612969394177-->
 502 | 			<TargetFilename condition="begin with">C:\Users\Default</TargetFilename> <!--Microsoft:Windows: Changes to default user profile-->
 503 | 			<TargetFilename condition="begin with">C:\Windows\System32\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 504 | 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename> <!--Microsoft: Drivers dropped here-->
 505 | 			<TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\Machine\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
 506 | 			<TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\User\Scripts</TargetFilename> <!--Group policy [ More information: http://www.hexacorn.com/blog/2017/01/07/beyond-good-ol-run-key-part-52/ ] -->
 507 | 			<TargetFilename condition="begin with">C:\Windows\System32\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks-->
 508 | 			<TargetFilename condition="begin with">C:\Windows\System32\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
 509 | 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\Wbem</TargetFilename> <!--Microsoft:WMI: [ More information: http://2014.hackitoergosum.org/slides/day1_WMI_Shell_Andrei_Dumitrescu.pdf ] -->
 510 | 			<TargetFilename condition="begin with">C:\Windows\System32\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
 511 | 			<TargetFilename condition="begin with">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename> <!--Microsoft:Powershell: Look for modifications for persistence [ https://www.malwarearchaeology.com/cheat-sheets ] -->
 512 | 			<TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename> <!--Microsoft:ScheduledTasks-->
 513 | 			<TargetFilename condition="begin with">C:\Windows\system32\Tasks</TargetFilename> <!--Microsoft:ScheduledTasks [ https://attack.mitre.org/wiki/Technique/T1053 ] -->
 514 | 
 515 | 			<!--Windows application compatibility-->
 516 | 			<TargetFilename condition="begin with">C:\Windows\AppPatch\Custom</TargetFilename> <!--Microsoft:Windows: Application compatibility shims [ https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html ] -->
 517 | 			<TargetFilename condition="contains">VirtualStore</TargetFilename> <!--Microsoft:Windows: UAC virtualization [ https://blogs.msdn.microsoft.com/oldnewthing/20150902-00/?p=91681 ] -->
 518 | 			<!--Exploitable file names-->
 519 | 			<TargetFilename condition="end with">.xls</TargetFilename> <!--Legacy Office files are often used for attacks-->
 520 | 			<TargetFilename condition="end with">.ppt</TargetFilename> <!--Legacy Office files are often used for attacks-->
 521 | 			<TargetFilename condition="end with">.rft</TargetFilename> <!--RTF files often 0day malware vectors when opened by Office-->
 522 | 		</FileCreate>
 523 | 	</RuleGroup>
 524 | 		<RuleGroup name="FileCreate Exclusions" groupRelation="or">
 525 | 		<FileCreate onmatch="exclude">
 526 | 			<!--SECTION: Microsoft:Office:Click2Run-->
 527 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image> <!-- Microsoft:Office Click2Run-->
 528 | 			<!--SECTION: Microsoft:Windows-->
 529 | 			<Image condition="is">C:\Windows\System32\smss.exe</Image> <!-- Microsoft:Windows: Session Manager SubSystem: Creates swapfile.sys,pagefile.sys,hiberfile.sys-->
 530 | 			<Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image> <!-- Microsoft:Windows: Windows 10 app, creates tons of cache files-->
 531 | 			<Image condition="is">\\?\C:\Windows\system32\wbem\WMIADAP.EXE</Image> <!-- Microsoft:Windows: WMI Performance updates-->
 532 | 			<TargetFilename condition="begin with">C:\Windows\System32\DriverStore\Temp\</TargetFilename> <!-- Microsoft:Windows: Temp files by DrvInst.exe-->
 533 | 			<TargetFilename condition="begin with">C:\Windows\System32\wbem\Performance\</TargetFilename> <!-- Microsoft:Windows: Created in wbem by WMIADAP.exe-->
 534 | 			<TargetFilename condition="end with">WRITABLE.TST</TargetFilename> <!-- Microsoft:Windows: Created in wbem by svchost-->
 535 | 			<!--SECTION: Microsoft:Windows:Updates-->
 536 | 			<TargetFilename condition="begin with">C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\</TargetFilename> <!-- Microsoft:Windows: Feature updates containing lots of .exe and .sys-->
 537 | 			<Image condition="begin with">C:\WINDOWS\winsxs\amd64_microsoft-windows</Image> <!-- Microsoft:Windows: Windows update-->
 538 | 			<!--SECTION: Dell-->
 539 | 			<Image condition="is">C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</Image>
 540 | 			<!--SECTION: Intel-->
 541 | 			<Image condition="is">C:\Windows\system32\igfxCUIService.exe</Image> <!--Intel: Drops bat and other files in \Windows in normal operation-->
 542 | 			<!--SECTION: Adobe-->
 543 | 			<TargetFilename condition="is">C:\Windows\System32\Tasks\Adobe Acrobat Update Task</TargetFilename>
 544 | 			<TargetFilename condition="is">C:\Windows\System32\Tasks\Adobe Flash Player Updater</TargetFilename>
 545 | 		</FileCreate>
 546 |         </RuleGroup>
 547 | 	<!--SYSMON EVENT ID 12 & 13 & 14 : REGISTRY MODIFICATION-->
 548 | 		<!--NOTE:	It may appear this section is missing important entries, but many of them match multiple areas, so look carefully to see if something is already covered.-->
 549 | 		<!--NOTE:	"contains" conditions below are formatted to reduce CPU load, so they may appear written inconsistently, but this is on purpose from tuning.-->
 550 | 		<!--NOTE:	"contains" works by finding the first letter, then matching the second, etc, so the first letters should be as low-occurance as possible.-->
 551 | 		<!--NOTE:	Windows writes hundreds or thousands of registry keys a minute, so just because you're not changing stuff, doesn't mean these rules aren't being run.-->
 552 | 		<!--NOTE:	You don't have to spend a lot of time worrying about this, CPUs are fast, but it's something to consider. Every rule and condition type has a cost.-->
 553 | 		<!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, TargetObject, Details, NewName-->
 554 | 		<!--TECHNICAL:	Possible prefixes are HKLM, HKCR, and HKEY_USERS-->
 555 | 		<!--CRITICAL:	Schema version 3.30 and higher use HKLM and HKEY_USERS and HKCR and CurrentControlSet instead of REGISTRY\MACHINE\ and \REGISTRY\USER\ and ControlSet001-->
 556 | 		<RuleGroup name="RegistryEvent Includes" groupRelation="or">
 557 | 		<RegistryEvent onmatch="include">
 558 | 			<!--Autorun or Startups-->
 559 | 				<!--ADDITIONAL REFERENCE: [ http://www.ghacks.net/2016/06/04/windows-automatic-startup-locations/ ] -->
 560 | 				<!--ADDITIONAL REFERENCE: [ https://view.officeapps.live.com/op/view.aspx?src=https://arsenalrecon.com/downloads/resources/Registry_Keys_Related_to_Autorun.ods ] -->
 561 | 				<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
 562 | 			<TargetObject condition="contains">\CurrentVersion\Run</TargetObject> <!--Microsoft:Windows: Run keys, incld RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
 563 | 			<TargetObject condition="contains">\Group Policy\Scripts</TargetObject> <!--Microsoft:Windows: Group policy scripts-->
 564 | 			<TargetObject condition="contains">\Windows\System\Scripts</TargetObject> <!--Microsoft:Windows: Logon, Loggoff, Shutdown-->
 565 | 			<TargetObject condition="contains">\Policies\Explorer\Run</TargetObject> <!--Microsoft:Windows | Credit @ion-storm-->
 566 | 			<TargetObject condition="end with">\ServiceDll</TargetObject> <!--Microsoft:Windows: Points to a service's DLL [ https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services ] -->
 567 | 			<TargetObject condition="end with">\ImagePath</TargetObject> <!--Microsoft:Windows: Points to a service's EXE [ https://github.com/crypsisgroup/Splunkmon/blob/master/sysmon.cfg ] -->
 568 | 			<TargetObject condition="end with">\Start</TargetObject> <!--Microsoft:Windows: Services start mode changes (Disabled, Automatically, Manual)-->
 569 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\</TargetObject> <!--Microsoft:Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
 570 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\</TargetObject> <!--Microsoft:Windows: Autorun location [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
 571 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject> <!--Microsoft:Windows: Legacy driver loading | Credit @ion-storm -->
 572 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject> <!--Microsoft:Windows: Autorun | Credit @ion-storm | [ https://www.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order ] -->
 573 | 			<!--CLSID launch commands and file association changes-->
 574 | 			<TargetObject condition="contains">\Explorer\FileExts\</TargetObject> <!--Microsoft:Windows: Changes to file extension mapping-->
 575 | 			<TargetObject condition="contains">\shell\install\command\</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
 576 | 			<TargetObject condition="contains">\shell\open\command\</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
 577 | 			<TargetObject condition="contains">\shell\open\ddeexec\</TargetObject> <!--Microsoft:Windows: Sensitive subkey under file associations and CLSID that map to launch command-->
 578 | 			<!--Windows COM-->
 579 | 			<TargetObject condition="end with">\InprocServer32\(Default)</TargetObject> <!--Microsoft:Windows:COM Object Hijacking [ https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence ] | Credit @ion-storm -->
 580 | 			<!--Windows shell hijack-->
 581 | 			<TargetObject condition="contains">\Classes\*\</TargetObject> <!--Microsoft:Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
 582 | 			<TargetObject condition="contains">\Classes\AllFilesystemObjects\</TargetObject> <!--Microsoft:Windows:Explorer: [ http://www.silentrunners.org/launchpoints.html ] -->
 583 | 			<TargetObject condition="contains">\Classes\Directory\</TargetObject> <!--Microsoft:Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
 584 | 			<TargetObject condition="contains">\Classes\Drive\</TargetObject> <!--Microsoft:Windows:Explorer: [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
 585 | 			<TargetObject condition="contains">\Classes\Folder\</TargetObject> <!--Microsoft:Windows:Explorer: ContextMenuHandlers, DragDropHandlers, CopyHookHandlers, [ https://stackoverflow.com/questions/1323663/windows-shell-context-menu-option ] -->
 586 | 			<TargetObject condition="contains">\ContextMenuHandlers\</TargetObject> <!--Microsoft:Windows: [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
 587 | 			<TargetObject condition="contains">\CurrentVersion\Shell</TargetObject> <!--Microsoft:Windows: Shell Folders, ShellExecuteHooks, ShellIconOverloadIdentifers, ShellServiceObjects, ShellServiceObjectDelayLoad [ http://oalabs.openanalysis.net/2015/06/04/malware-persistence-hkey_current_user-shell-extension-handlers/ ] -->
 588 | 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks</TargetObject> <!--Microsoft:Windows: ShellExecuteHooks-->
 589 | 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad</TargetObject> <!--Microsoft:Windows: ShellExecuteHooks-->
 590 | 			<!--AppPaths hijacking-->
 591 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\</TargetObject> <!--Microsoft:Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] -->
 592 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\</TargetObject> <!--Microsoft:Windows: Credit to @Hexacorn [ http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ ] -->
 593 | 			<!--Terminal service boobytraps-->
 594 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram</TargetObject>
 595 | 			<!--Group Policy interity-->
 596 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\</TargetObject> <!--Microsoft:Windows: Group Policy internally uses a plugin architecture that nothing should be modifying-->
 597 | 			<!--Winsock and Winsock2-->
 598 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WinSock\</TargetObject> <!--Microsoft:Windows: Wildcard, includes Winsock and Winsock2-->
 599 | 			<TargetObject condition="end with">\ProxyServer</TargetObject> <!--Microsoft:Windows: System and user proxy server-->
 600 | 			<!--Credential providers-->
 601 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider</TargetObject> <!--Wildcard, includes Credental Providers and Credential Provider Filters-->
 602 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</TargetObject>
 603 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders</TargetObject> <!--Microsoft:Windows: Changes to WDigest-UseLogonCredential for password scraping [ https://www.trustedsec.com/april-2015/dumping-wdigest-creds-with-meterpreter-mimikatzkiwi-in-windows-8-1/ ] -->
 604 | 			<!--Networking-->
 605 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\</TargetObject> <!--Microsoft:Windows: Order of network providers that are checked to connect to destination [ https://www.malwarearchaeology.com/cheat-sheets ] -->
 606 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles</TargetObject> <!--Microsoft:Windows: | Credit @ion-storm -->
 607 | 			<!--DLLs that get injected into every process launch-->
 608 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Microsoft:Windows: [ https://msdn.microsoft.com/en-us/library/windows/desktop/dd744762(v=vs.85).aspx ] -->
 609 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\</TargetObject> <!--Microsoft:Windows: [ https://msdn.microsoft.com/en-us/library/windows/desktop/dn280412(v=vs.85).aspx ] -->
 610 | 			<!--Office-->
 611 | 			<TargetObject condition="contains">\Microsoft\Office\Outlook\Addins\</TargetObject> <!--Microsoft:Office: Outlook add-ins-->
 612 | 			<!--IE-->
 613 | 			<TargetObject condition="contains">\Internet Explorer\Toolbar\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user-->
 614 | 			<TargetObject condition="contains">\Internet Explorer\Extensions\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user-->
 615 | 			<TargetObject condition="contains">\Browser Helper Objects\</TargetObject> <!--Microsoft:InternetExplorer: Machine and user [ https://msdn.microsoft.com/en-us/library/bb250436(v=vs.85).aspx ] -->
 616 | 			<!--Magic registry keys-->
 617 | 			<TargetObject condition="contains">{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\</TargetObject> <!--Microsoft:Windows: Thumbnail cache autostart [ http://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-levels-up-with-new-autostart-mechanism/ ] -->
 618 | 			<!--Infection artifacts-->
 619 | 			<TargetObject condition="end with">\UrlUpdateInfo</TargetObject> <!--Microsoft:ClickOnce: [ https://subt0x10.blogspot.com/2016/12/mimikatz-delivery-via-clickonce-with.html ] -->
 620 | 			<TargetObject condition="end with">\InstallSource</TargetObject> <!--Microsoft:Windows: Source folder for certain program and componenent installations-->
 621 | 			<!--Windows UAC tampering-->
 622 | 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
 623 | 			<TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject> <!--Detect: UAC Tampering | Credit @ion-storm -->
 624 | 			<!--Microsoft Firewall modifications-->
 625 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List</TargetObject> <!--Windows Firewall authorized applications | Credit @ion-storm -->
 626 | 			<!--Microsoft Security Center tampering | Credit @ion-storm -->
 627 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled</TargetObject>
 628 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify</TargetObject>
 629 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring</TargetObject>
 630 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify</TargetObject>
 631 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride</TargetObject>
 632 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify</TargetObject>
 633 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify</TargetObject>
 634 | 			<!--Windows Defender tampering | Credit @ion-storm -->
 635 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware</TargetObject>
 636 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus</TargetObject>
 637 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring</TargetObject>
 638 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection</TargetObject>
 639 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable</TargetObject>
 640 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting</TargetObject>
 641 | 			<!--Windows internals integrity monitoring-->
 642 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\</TargetObject> <!--Microsoft:Windows: Malware likes changing IFEO-->
 643 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\</TargetObject> <!--Microsoft:Windows:UAC: Detect malware changes to UAC prompt level-->
 644 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\</TargetObject> <!--Microsoft:Windows: Event log system integrity and ACLs-->
 645 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\</TargetObject> <!--Microsoft:Defender: Detect changes to Defender administrative settings to monitor for disablement-->
 646 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\</TargetObject> <!--Microsoft:Windows: Services approved to load in safe mode-->
 647 | 			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\</TargetObject> <!--Microsoft:Windows: Providers notified by WinLogon-->
 648 | 			<TargetObject condition="end with">\FriendlyName</TargetObject> <!--Microsoft:Windows: New devices connected and remembered-->
 649 | 			<TargetObject condition="is">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default)</TargetObject> <!--Microsoft:Windows: See when WindowsInstaller is engaged-->
 650 | 			<!--Section Ola MITRE config https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig.xml-->
 651 | 			<TargetObject condition="begin with" name="technique_id=T1003,technique_name=Credential Dumping">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders</TargetObject>
 652 | 			<TargetObject condition="begin with" name="technique_id=T1004,technique_name=Winlogon Helper DLL">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify</TargetObject>
 653 | 			<TargetObject condition="begin with" name="technique_id=T1004,technique_name=Winlogon Helper DLL">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</TargetObject>
 654 | 			<TargetObject condition="begin with" name="technique_id=T1004,technique_name=Winlogon Helper DLL">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</TargetObject>
 655 | 			<TargetObject condition="begin with" name="technique_id=T1013,technique_name=Forced Authentication">HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</TargetObject>
 656 | 			<TargetObject condition="begin with" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute</TargetObject>
 657 | 			<TargetObject condition="begin with" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram</TargetObject>
 658 | 			<TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify</TargetObject>
 659 | 			<TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify</TargetObject>
 660 | 			<TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</TargetObject>
 661 | 			<TargetObject condition="begin with" name="technique_id=T1088,technique_name=Bypass User Account Control">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject>
 662 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify</TargetObject>
 663 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify</TargetObject>
 664 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride</TargetObject>
 665 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender</TargetObject>
 666 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring</TargetObject>
 667 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection</TargetObject>
 668 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable</TargetObject>
 669 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting</TargetObject>
 670 | 			<TargetObject condition="begin with" name="technique_id=T1089,technique_name=Disabling Security Tools">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List</TargetObject>
 671 | 			<TargetObject condition="begin with" name="technique_id=T1103,technique_name=Appinit DLLs">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject>
 672 | 			<TargetObject condition="begin with" name="technique_id=T1103,technique_name=Appinit DLLs">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject>
 673 | 			<TargetObject condition="begin with" name="technique_id=T1130,technique_name=Install Root Certificate">HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates</TargetObject>
 674 | 			<TargetObject condition="begin with" name="technique_id=T1131,technique_name=Authentication Package">HKLM\SYSTEM\CurrentControlSet\Control\Lsa</TargetObject>
 675 | 			<TargetObject condition="begin with" name="technique_id=T1182,technique_name=AppCert DLLs">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls</TargetObject>
 676 | 			<TargetObject condition="begin with" name="technique_id=T1183,technique_name=Image File Execution Options Injection">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
 677 | 			<TargetObject condition="begin with" name="technique_id=T1183,technique_name=Image File Execution Options Injection">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
 678 | 			<TargetObject condition="begin with" name="technique_id=T1198,technique_name=SIP and Trust Provider Hijacking">HKLM\SOFTWARE\Microsoft\Cryptography\OID</TargetObject>
 679 | 			<TargetObject condition="begin with" name="technique_id=T1198,technique_name=SIP and Trust Provider Hijacking">HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust</TargetObject>
 680 | 			<TargetObject condition="begin with" name="technique_id=T1198,technique_name=SIP and Trust Provider Hijacking">HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID</TargetObject>
 681 | 			<TargetObject condition="begin with" name="technique_id=T1198,technique_name=SIP and Trust Provider Hijacking">HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust</TargetObject>
 682 | 			<TargetObject condition="contains" name="technique_id=T1003,technique_name=Credential Dumping">\Control\SecurityProviders\WDigest</TargetObject>
 683 | 			<TargetObject condition="contains" name="technique_id=T1037,technique_name=Logon Scripts">\Windows\System\Scripts</TargetObject>
 684 | 			<TargetObject condition="contains" name="technique_id=T1042,technique_name=Change Default File Association">\Explorer\FileExts</TargetObject>
 685 | 			<TargetObject condition="contains" name="technique_id=T1047,technique_name=Windows Management Instrumentation">SYSTEM\CurrentControlSet\Control\CrashControl</TargetObject>
 686 | 			<TargetObject condition="contains" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">\CurrentVersion\Run</TargetObject>
 687 | 			<TargetObject condition="contains" name="technique_id=T1060,technique_name=Registry Run Keys / Start Folder">\Policies\Explorer\Run</TargetObject>
 688 | 			<TargetObject condition="contains" name="technique_id=T1088,technique_name=Bypass User Account Control">Classes\exefile\shell\runas\command\isolatedCommand</TargetObject>
 689 | 			<TargetObject condition="contains" name="technique_id=T1088,technique_name=Bypass User Account Control">\mscfile\shell\open\command</TargetObject>
 690 | 			<TargetObject condition="contains" name="technique_id=T1088,technique_name=Bypass User Account Control">ms-settings\shell\open\command</TargetObject>
 691 | 			<TargetObject condition="contains" name="technique_id=T1089,technique_name=Disabling Security Tools">SYSTEM\CurrentControlSet\services\Sysmon</TargetObject>
 692 | 			<TargetObject condition="contains" name="technique_id=T1089,technique_name=Disabling Security Tools">SYSTEM\CurrentControlSet\services\SysmonDrv</TargetObject>
 693 | 			<TargetObject condition="contains" name="technique_id=T1098,technique_name=Account Manipulation">\services\Netlogon\Parameters\DisablePasswordChange</TargetObject>
 694 | 			<TargetObject condition="contains" name="technique_id=T1101,technique_name=Security Support Provider">SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe</TargetObject>
 695 | 			<TargetObject condition="contains" name="technique_id=T1122,technique_name=Component Object Model Hijacking">Software\Classes\CLSID</TargetObject>
 696 | 			<TargetObject condition="contains" name="technique_id=T1128,technique_name=Netsh Helper DLL">SOFTWARE\Microsoft\Netsh</TargetObject>
 697 | 			<TargetObject condition="contains" name="technique_id=T1130,technique_name=Install Root Certificate">\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
 698 | 			<TargetObject condition="contains" name="technique_id=T1138,technique_name=Application Shimming">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom</TargetObject>
 699 | 			<TargetObject condition="contains" name="technique_id=T1138,technique_name=Application Shimming">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB</TargetObject>
 700 | 			<TargetObject condition="contains" name="technique_id=T1209,technique_name=Time Providers">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders</TargetObject>
 701 | 			<TargetObject condition="end with" name="technique_id=T1033,technique_name=System Owner/User Discovery">\PsGetSID\EulaAccepted</TargetObject>
 702 | 			<TargetObject condition="end with" name="technique_id=T1033,technique_name=System Owner/User Discovery">\PsLoggedOn\EulaAccepted</TargetObject>
 703 | 			<TargetObject condition="end with" name="technique_id=T1035,technique_name=Service Execution">\PsExec\EulaAccepted</TargetObject>
 704 | 			<TargetObject condition="end with" name="technique_id=T1035,technique_name=Service Execution">\PsLogList\EulaAccepted</TargetObject>
 705 | 			<TargetObject condition="end with" name="technique_id=T1035,technique_name=Service Execution">\PsService\EulaAccepted</TargetObject>
 706 | 			<TargetObject condition="end with" name="technique_id=T1057,technique_name=Process Discovery">\PsInfo\EulaAccepted</TargetObject>
 707 | 			<TargetObject condition="end with" name="technique_id=T1057,technique_name=Process Discovery">\PsList\EulaAccepted</TargetObject>
 708 | 			<TargetObject condition="end with" name="technique_id=T1089,technique_name=Disabling Security Tools">\PsKill\EulaAccepted</TargetObject>
 709 | 			<TargetObject condition="end with" name="technique_id=T1098,technique_name=Account Manipulation">\PsPasswd\EulaAccepted</TargetObject>
 710 | 			<TargetObject condition="end with" name="technique_id=T1105,technique_name=Remote File Copy">\PsFile\EulaAccepted</TargetObject>
 711 | 			<TargetObject condition="end with" name="undefined">\PsShutDown\EulaAccepted</TargetObject>
 712 | 			<TargetObject condition="end with" name="undefined">\PsSuspend\EulaAccepted</TargetObject>
 713 | 			<TargetObject name="technique_id=T1015,technique_name=Accessibility Features">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
 714 | 			<TargetObject name="technique_id=T1076,technique_name=Remote Desktop Protocol">HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services</TargetObject>
 715 | 			<TargetObject name="technique_id=T1103,technique_name=Appinit DLLs">REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DNS\Parameters\ServerLevelPluginDll</TargetObject>
 716 | 			<TargetObject>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup</TargetObject>
 717 | 			
 718 | 		</RegistryEvent>
 719 | 		</RuleGroup>
 720 | 		<RuleGroup name="RegistryEvent Exclusions" groupRelation="or">
 721 | 		
 722 | 		<RegistryEvent onmatch="exclude">
 723 | 		<!--COMMENT:	Remove low-information noise-->
 724 | 			<!--SECTION: Microsoft binaries-->
 725 | 			<Image condition="end with">Office\root\integration\integrator.exe</Image> <!--Microsoft:Office: C2R client-->
 726 | 			<Image condition="image">C:\WINDOWS\system32\backgroundTaskHost.exe</Image> <!--Microsoft:Windows: Changes association registry keys-->
 727 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</Image> <!--Microsoft:Office: C2R client-->
 728 | 			<Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image> <!--Microsoft:Windows:Defender-->
 729 | 			<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Cortana-->
 730 | 			<!--Misc-->
 731 | 			<Image condition="is">C:\Program Files (x86)\Common Files\Rhozet\Carbon Coder\Kernel\PNXSERVR.exe</Image> <!-- carbon coder -->
 732 | 			<TargetObject condition="end with">Toolbar\WebBrowser</TargetObject> <!--Microsoft:IE: Extraneous activity-->
 733 | 			<TargetObject condition="end with">Toolbar\WebBrowser\ITBar7Height</TargetObject> <!--Microsoft:IE: Extraneous activity-->
 734 | 			<TargetObject condition="end with">Toolbar\ShellBrowser\ITBar7Layout</TargetObject> <!--Microsoft:Windows:Explorer: Extraneous activity-->
 735 | 			<TargetObject condition="end with">Internet Explorer\Toolbar\Locked</TargetObject> <!--Microsoft:Windows:Explorer: Extraneous activity-->
 736 | 			<TargetObject condition="end with">ShellBrowser</TargetObject> <!--Microsoft:InternetExplorer: Noise-->
 737 | 			<TargetObject condition="end with">\CurrentVersion\Run</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\Run" wildcard-->
 738 | 			<TargetObject condition="end with">\CurrentVersion\RunOnce</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\Run" wildcard-->
 739 | 			<TargetObject condition="end with">\CurrentVersion\App Paths</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\App Paths" wildcard-->
 740 | 			<TargetObject condition="end with">\CurrentVersion\Image File Execution Options</TargetObject> <!--Microsoft:Windows: Remove noise from the "\Windows\CurrentVersion\Image File Execution Options" wildcard-->
 741 | 			<TargetObject condition="end with">\CurrentVersion\Shell Extensions\Cached</TargetObject> <!--Microsoft:Windows: Remove noise from the "\CurrentVersion\Shell Extensions\Cached" wildcard-->
 742 | 			<TargetObject condition="end with">\CurrentVersion\Shell Extensions\Approved</TargetObject> <!--Microsoft:Windows: Remove noise from the "\CurrentVersion\Shell Extensions\Approved" wildcard-->
 743 | 			<TargetObject condition="end with">}\PreviousPolicyAreas</TargetObject> <!--Microsoft:Windows: Remove noise from \Winlogon\GPExtensions by svchost.exe-->
 744 | 			<TargetObject condition="contains">\Control\WMI\Autologger\</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
 745 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
 746 | 			<TargetObject condition="end with">\Lsa\OfflineJoin\CurrentValue</TargetObject> <!--Microsoft:Windows: Sensitive value during domain join-->
 747 | 			<TargetObject condition="end with">\Components\TrustedInstaller\Events</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
 748 | 			<TargetObject condition="end with">\Components\TrustedInstaller</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
 749 | 			<TargetObject condition="end with">\Components\Wlansvc</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
 750 | 			<TargetObject condition="end with">\Components\Wlansvc\Events</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Winlogon-->
 751 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\</TargetObject> <!--Microsoft:Windows: Remove noise monitoring installations run as system-->
 752 | 			<TargetObject condition="end with">\Directory\shellex</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
 753 | 			<TargetObject condition="end with">\Directory\shellex\DragDropHandlers</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
 754 | 			<TargetObject condition="end with">\Drive\shellex</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
 755 | 			<TargetObject condition="end with">\Drive\shellex\DragDropHandlers</TargetObject> <!--Microsoft:Windows: Remove noise monitoring Classes-->
 756 | 			<TargetObject condition="contains">_Classes\AppX</TargetObject> <!--Microsoft:Windows: Remove noise monitoring "Shell\open\command"--> <!--Win8+-->
 757 | 			<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\</TargetObject> <!--Microsoft:Windows: SvcHost Noise-->
 758 | 			<Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image> <!--Microsoft:Windows: Remove noise from Windows 10 Cortana | Credit @ion-storm--> <!--Win10-->
 759 | 			<!--Bootup Control noise-->
 760 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
 761 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
 762 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
 763 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
 764 | 			<TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
 765 | 			<TargetObject condition="end with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit</TargetObject> <!--Microsoft:Windows:lsass.exe: Boot noise--> <!--Win8+-->
 766 | 			<!--Sevices autostart noise-->
 767 | 			<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
 768 | 			<TargetObject condition="end with">\services\clr_optimization_v2.0.50727_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 7-->
 769 | 			<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_32\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
 770 | 			<TargetObject condition="end with">\services\clr_optimization_v4.0.30319_64\Start</TargetObject> <!--Microsoft:dotNet: Windows 10-->
 771 | 			<TargetObject condition="end with">\services\DeviceAssociationService\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
 772 | 			<TargetObject condition="end with">\services\BITS\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
 773 | 			<TargetObject condition="end with">\services\TrustedInstaller\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
 774 | 			<TargetObject condition="end with">\services\tunnel\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
 775 | 			<TargetObject condition="end with">\services\UsoSvc\Start</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "\Start"-->
 776 | 			<!--FileExts noise filtering-->
 777 | 			<TargetObject condition="contains">\OpenWithProgids</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
 778 | 			<TargetObject condition="end with">\OpenWithList</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
 779 | 			<TargetObject condition="end with">\UserChoice</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
 780 | 			<TargetObject condition="end with">\UserChoice\ProgId</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
 781 | 			<TargetObject condition="end with">\UserChoice\Hash</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"--> <!--Win8+-->
 782 | 			<TargetObject condition="end with">\OpenWithList\MRUList</TargetObject> <!--Microsoft:Windows: Remove noise from monitoring "FileExts"-->
 783 | 			<TargetObject condition="end with">} 0xFFFF</TargetObject> <!--Microsoft:Windows: Remove noise from explorer.exe from monitoring ShellCached binary keys--> <!--Win8+-->
 784 | 			<!--SECTION: 3rd party-->
 785 | 			<Image condition="is">C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe</Image> <!--Constantly writes to HKLM-->
 786 | 			<Image condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</Image> <!--Webroot-->
 787 | 			<Image condition="is">C:\WINDOWS\System32\spoolsv.exe</Image>
 788 | 
 789 | 		</RegistryEvent>
 790 | 	</RuleGroup>
 791 | 	<!--SYSMON EVENT ID 15 : ALTERNATE DATA STREAM CREATED-->
 792 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, Hash-->
 793 | 				<RuleGroup name="FileCreateStreamHash" groupRelation="or">
 794 | 
 795 | 		<FileCreateStreamHash onmatch="include">
 796 | 		<!--COMMENT:	Any files created with an NTFS Alternate Data Stream which match these rules will be hashed and logged.
 797 | 				[ https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/ ]
 798 | 				ADS's are used by browsers and email clients to mark files as originating from the Internet or other foreign sources.
 799 | 				[ https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ ] -->
 800 | 			<TargetFilename condition="contains">Content.Outlook</TargetFilename> <!--Microsoft:Outlook: Attachments--> <!--PRIVACY WARNING-->
 801 | 			<TargetFilename condition="contains">Downloads</TargetFilename> <!--Downloaded files. Does not include "Run" files in IE-->
 802 | 			<TargetFilename condition="contains">Startup</TargetFilename> <!--ADS startup | Example: [ https://www.hybrid-analysis.com/sample/a314f6106633fba4b70f9d6ddbee452e8f8f44a72117749c21243dc93c7ed3ac?environmentId=100 ] -->
 803 | 			<TargetFilename condition="contains">Temp\7z</TargetFilename> <!--7zip extractions-->
 804 | 			<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
 805 | 			<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting | Credit @ion-storm -->
 806 | 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
 807 | 			<TargetFilename condition="end with">.lnk</TargetFilename> <!--Shortcut file | Credit @ion-storm -->
 808 | 			<TargetFilename condition="end with">.ps1</TargetFilename> <!--Powershell-->
 809 | 			<TargetFilename condition="end with">.ps2</TargetFilename> <!--Powershell-->
 810 | 			<TargetFilename condition="end with">.reg</TargetFilename> <!--Registry File-->
 811 | 			<TargetFilename condition="end with">.jse</TargetFilename> 
 812 | 			<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
 813 | 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting files-->
 814 | 			<TargetFilename condition="end with">.vbs</TargetFilename> <!--VisualBasicScripting files-->
 815 | 				<!--COMMENT:	Any files created with an NTFS Alternate Data Stream which match these rules will be hashed and logged.
 816 | 				[ https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/ ]
 817 | 				ADS's are used by browsers and email clients to mark files as originating from the Internet or other foreign sources.
 818 | 				[ https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ ] -->
 819 | 			<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
 820 | 			<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
 821 | 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
 822 | 				<TargetFilename condition="end with">.cmdline</TargetFilename> <!--Microsoft:dotNet: Executed by cvtres.exe-->
 823 | 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 824 | 			<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
 825 | 			<TargetFilename condition="end with">.dll</TargetFilename> <!--Executable-->
 826 | 			<TargetFilename condition="end with">.sys</TargetFilename> <!--Executable-->
 827 | 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 828 | 			<TargetFilename condition="end with">.sys</TargetFilename> <!--System driver files-->
 829 | 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Office Macros-->
 830 | 			<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Office Macros-->
 831 | 			<TargetFilename condition="end with">.xlam</TargetFilename> <!--Office Macros-->
 832 | 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Office Macros-->
 833 | 			<TargetFilename condition="end with">.potm</TargetFilename> <!--Office Macros-->
 834 | 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Office Macros-->
 835 | 			<TargetFilename condition="end with">.sldm</TargetFilename> <!--Office Macros-->
 836 | 			<TargetFilename condition="end with">.scf</TargetFilename> <!--Explorer Command File-->
 837 | 			<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--ClickOnce Application-->
 838 | 			<TargetFilename condition="end with">.rdp</TargetFilename> <!--Remote Desktop file-->
 839 | 			<TargetFilename condition="end with">.js</TargetFilename> <!--Java-->
 840 | 			<!--SECTION: Certificates -->
 841 | 			<TargetFilename condition="contains">.pem</TargetFilename>
 842 | 			<TargetFilename condition="contains">.crt</TargetFilename>
 843 | 			<TargetFilename condition="contains">.ca-bundle</TargetFilename>
 844 | 			<TargetFilename condition="contains">.cer</TargetFilename>
 845 | 			<TargetFilename condition="contains">.csr</TargetFilename>
 846 | 			<TargetFilename condition="contains">.der</TargetFilename>
 847 | 			<TargetFilename condition="contains">.p7b</TargetFilename>
 848 | 			<TargetFilename condition="contains">.p7r</TargetFilename>
 849 | 			<TargetFilename condition="contains">.p7s</TargetFilename>
 850 | 			<TargetFilename condition="contains">.pfx</TargetFilename>
 851 | 			<TargetFilename condition="contains">.sto</TargetFilename>
 852 | 			<TargetFilename condition="contains">.p12</TargetFilename>
 853 | 			<TargetFilename condition="contains">.crl</TargetFilename>
 854 | 			<TargetFilename condition="contains">.sst</TargetFilename>
 855 | 			<TargetFilename condition="contains">.key</TargetFilename>
 856 | 			<!--SECTION: CIA Vault7 Leak -->
 857 | 			<TargetFilename condition="contains">.mht</TargetFilename> <!-- Possible malformed file will escape IE sandbox -->
 858 | 			<TargetFilename condition="contains">.manifest</TargetFilename>
 859 | 			<TargetFilename condition="contains">.cpl</TargetFilename> <!-- Vault7 CIA Leak: Control Panel Persistence -->
 860 | 			<TargetFilename condition="contains">.scr</TargetFilename> <!-- Vault7 CIA Leak: Screensaver Persistence -->
 861 | 			<TargetFilename condition="contains">.inf</TargetFilename> <!-- Vault7 CIA Leak: Sandworm: Uses INF File to bypass UAC on windows 7 -->
 862 | 		</FileCreateStreamHash>
 863 | </RuleGroup>
 864 | 	<!--SYSMON EVENT ID 16 : SYSMON CONFIGURATION CHANGE, THIS LINE IS INCLUDED FOR DOCUMENTATION PURPOSES ONLY-->
 865 | 		<!--DATA: UtcTime, Configuration, ConfigurationFileHash-->
 866 | 		<!--Cannot be filtered.-->
 867 | 
 868 | 	<!--SYSMON EVENT ID 17 & 18 : PIPE CREATED / PIPE CONNECTED-->
 869 | 		<!--DATA: UtcTime, ProcessGuid, ProcessId, PipeName, Image-->
 870 | 	<RuleGroup name="PipeEvent" groupRelation="or">
 871 | 	<PipeEvent onmatch="exclude">
 872 | 		<!--COMMENT: Exclude known-good pipe users-->
 873 | 				<!--ADDITIONAL REFERENCE: [ https://www.cobaltstrike.com/help-smb-beacon ] -->
 874 | 				<!--ADDITIONAL REFERENCE: [ https://blog.cobaltstrike.com/2015/10/07/named-pipe-pivoting/ ] -->
 875 | 			<!--SECTION: Microsoft-->
 876 | 			<Image condition="is">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</Image>
 877 | 			 <Image condition="is">C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe</Image>
 878 | 			<PipeName condition="contains">lsass</PipeName>
 879 | 			<PipeName condition="is">\netmon</PipeName>
 880 | 			<PipeName condition="is">\SQLLocal\RTCLOCAL</PipeName>
 881 | 			<!--SECTION: Microsoft IIS -->
 882 | 			<PipeName condition="begin with">\M.E.C.Core.WinRMDataCommunicator.NamedPipe.</PipeName>
 883 | 			<Image condition="is">c:\windows\system32\inetsrv\w3wp.exe</Image>
 884 | 			<Image condition="is">VBoxTrayIPC</Image>
 885 | 			<Image condition="is">C:\Windows\syswow64\snmp.exe</Image>
 886 | 			<Image condition="is">C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE</Image>
 887 | 			<!--SECTION: Microsoft Exchange Server -->
 888 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\ParserServer\ParserServer.exe</Image>
 889 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.RpcClientAccess.Service.exe</Image>
 890 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Store.Service.exe</Image>
 891 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Store.Worker.exe</Image>
 892 | 			<Image condition="is">C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Runtime\1.0\ResourceProfile\contentengine\NodeRunner.exe</Image>
 893 | 			<!--SECTION: Microsoft DNS Server -->
 894 | 			<Image condition="is">C:\Windows\system32\dns.exe</Image>
 895 | 			<!--SECTION: Microsoft SQL Server -->
 896 | 			<Image condition="is">C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe</Image>
 897 | 			<!--SECTION: Microsoft Skype For Business Server -->
 898 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exee</Image>
 899 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\OCSMCU\AV Conferencing\AVMCUSvc.exe</Image>
 900 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Health Agent\HealthAgent.exe</Image>
 901 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\LysSvc.exe</Image>
 902 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\File Transfer Agent\FileTransferAgent.exe</Image>
 903 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Web Conferencing\DataMCUSvc.exe</Image>
 904 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Application Host\OcsAppServerHost.exe</Image>
 905 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\ABServer.exe</Image>
 906 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Master Replicator Agent\MasterReplicatorAgent.exe</Image>
 907 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\OCSMCU\IM Conferencing\IMMCUSvc.exe</Image>
 908 | 			<Image condition="is">C:\Program Files\Common Files\Skype for Business Server 2015\ClsAgent\ClsAgent.exe</Image>
 909 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\ReplicationApp.exe</Image>
 910 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\OCSMCU\Application Sharing\ASMCUSvc.exe</Image>
 911 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Replica Replicator Agent\ReplicaReplicatorAgent.exe</Image>
 912 | 			<Image condition="is">C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exe</Image>
 913 | 			<!--SECTION: Microsoft DFS Replication -->
 914 | 			<Image condition="is">C:\Windows\system32\DFSRs.exee</Image>
 915 | 			<Image condition="begin with">C:\Windows\SystemApps\Microsoft.Windows</Image>
 916 | 			<Image condition="is">C:\Windows\system32\SearchProtocolHost.exe</Image>
 917 | 			<Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</Image>
 918 | 			<Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe</Image>
 919 | 			<Image condition="is">C:\Windows\System32\LxRun.exe</Image> <!--Bash On Windows -->
 920 | 			<PipeName condition="contains">vmware-</PipeName>
 921 | 			<Image condition="is">\System</Image>
 922 | 			<PipeName condition="is">\InitShutdown</PipeName>
 923 | 			<Image condition="is">C:\Windows\System32\wininit.exe</Image>
 924 | 			<Image condition="is">C:\Windows\System32\SearchIndexer.exe</Image>
 925 | 			<Image condition="is">C:\Windows\System32\services.exe</Image>
 926 | 			<PipeName condition="is">\ntsvcs</PipeName>
 927 | 			<PipeName condition="is">\scerpc</PipeName>
 928 | 			<Image condition="is">C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe</Image>
 929 | 			<Image condition="is">C:\Windows\System32\smss.exe</Image>
 930 | 			<Image condition="is">C:\Windows\System32\spoolsv.exe</Image>
 931 | 			<PipeName condition="is">\epmapper</PipeName>
 932 | 			<PipeName condition="is">\atsvc</PipeName>
 933 | 			<PipeName condition="is">\browser</PipeName>
 934 | 			<PipeName condition="is">\srvsvc</PipeName>
 935 | 			<PipeName condition="is">\Winsock2CatelogChangeListener</PipeName>
 936 | 			<PipeName condition="contains">ProtectedPrefix\LocalService\FTHPIPE</PipeName>
 937 | 			<PipeName condition="is">\W32TIME_ALT</PipeName>
 938 | 			<PipeName condition="is">\eventlog</PipeName>
 939 | 			<PipeName condition="is">\wkssvc</PipeName>
 940 | 			<PipeName condition="contains">\TDLN-</PipeName>
 941 | 			<PipeName condition="is">\WiFiNetworkManagerTask</PipeName>
 942 | 			<PipeName condition="is">\MsFteWds</PipeName>
 943 | 			<!--SECTION: Webroot-->
 944 | 			<PipeName condition="is">\WRSVCPipe</PipeName>
 945 | 			<PipeName condition="is">\WRSynUM2</PipeName>
 946 | 			<PipeName condition="is">\wrUrl</PipeName><!--Webroot Webfiltering Pipe-->
 947 | 			<Image condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</Image>
 948 | 			<!--SECTION: Google-->
 949 | 			<Image condition="is">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Image>
 950 | 			<Image condition="is">C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Image>
 951 | 			<Image condition="contains">AppData\Local\Google\Chrome\User Data\SwReporter\</Image>
 952 | 			<PipeName condition="contains">mojo.</PipeName>
 953 | 			<PipeName condition="contains">crashpad_</PipeName>
 954 | 			<PipeName condition="contains">chrome.</PipeName>
 955 | 			<PipeName condition="contains">GoogleCrashServices</PipeName>
 956 | 			<!--SECTION: Other-->
 957 | 			<Image condition="end with">slack.exe</Image>
 958 | 			<!--SECTION: ConnectWise-->
 959 | 			<PipeName condition="contains">booma\</PipeName>
 960 | 			<!--SECTION: EnPass-->
 961 | 			<PipeName condition="contains">qtsingleapp-enpass-</PipeName>
 962 | 			<Image condition="contains">qtsingleapp-enpass-</Image>
 963 | 			<!--SECTION: Everything Search-->
 964 | 			<PipeName condition="contains">Everything Service</PipeName>
 965 | 			<PipeName condition="contains">anchor_gui_agent</PipeName>
 966 | 			<!--SECTION: Lenovo-->
 967 | 			<Image condition="is">C:\Program Files (x86)\Lenovo\System Update\SUService.exe</Image>
 968 | 			<Image condition="is">C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe</Image>
 969 | 			<Image condition="is">C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe</Image>
 970 | 			<Image condition="is">C:\Program Files\Lenovo\HOTKEY\shtctky.exe</Image>
 971 | 			<Image condition="is">C:\Windows\System32\LPlatSvc.exe</Image>
 972 | 			<Image condition="is">C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe</Image>
 973 | 			<!--SECTION: Labtech-->
 974 | 			<Image condition="is">C:\Windows\LTSvc\LTSVC.exe</Image>
 975 | 			<Image condition="contains">ScreenConnect.WindowsClient.exe</Image>
 976 | 			<Image condition="contains">ScreenConnect.ClientService.exe</Image>
 977 | 			<Image condition="is">C:\Program Files\OpenVPN\bin\openvpn-gui.exe</Image>
 978 | 			<Image condition="is">C:\Program Files\OpenVPN\bin\openvpn.exe</Image>
 979 | 			<Image condition="is">C:\Program Files\OpenVPN\bin\openvpnserv.exe</Image>
 980 | 			<Image condition="is">C:\Program Files\Synaptics\SynTP\SynTPEnh.exe</Image>
 981 | 			<Image condition="is">C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe</Image>
 982 | 			<Image condition="is">C:\Program Files\Lenovo\HOTKEY\tphkload.exe</Image>
 983 | 			<Image condition="contains">C:\Program Files\Lenovo\</Image>
 984 | 			<Image condition="is">C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe</Image>
 985 | 			<Image condition="contains">Graylog-collector-sidecar.exe</Image>
 986 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git-remote-https.exe</Image>
 987 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\git\mingw32\bin\git.exe</Image>
 988 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe</Image>
 989 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\bin\smartgit.exe</Image>
 990 | 			<Image condition="is">C:\Program Files (x86)\SmartGit\bin\smartgit.exe</Image>
 991 | 			<PipeName condition="contains">Anonymous Pipe</PipeName> <!-- NOTICE: Comment this out if you dont use Labtech, labtech nests processes and causes excessive noise -->
 992 | 			<Image condition="is">C:\Program Files (x86)\Fortinet\FortiClient\FortiESNAC.exe</Image>
 993 | 			<Image condition="is">C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe</Image>
 994 | 			<Image condition="is">C:\Program Files (x86)\Fortinet\FortiClient\FortiTray.exe</Image>
 995 | 			<Image condition="is">C:\Program Files (x86)\Fortinet\FortiClient\FCDBLog.exe</Image>
 996 | 			<Image condition="is">C:\Program Files (x86)\Enpass\Enpass.exe</Image>
 997 | 			<Image condition="is">C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe</Image>
 998 | 			<Image condition="is">C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe</Image>
 999 | 			<Image condition="is">C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe</Image>
1000 | 			<Image condition="is">C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe</Image>
1001 | 			<PipeName condition="contains">SQLAnywhereLRM</PipeName> <!-- Quickbooks -->
1002 | 			<PipeName condition="contains">pgsignal</PipeName> <!-- Postgres SQL -->
1003 | 			<Image condition="is">postgres.exe</Image>
1004 | 			<PipeName condition="contains">MICROSOFT##WID\tsql\query</PipeName> <!-- Microsoft SQL writer-->
1005 | 			<PipeName condition="contains">TSVCPIPE-</PipeName> <!-- Terminal Services Pipe-->
1006 | 			<PipeName condition="contains">BB4BB19A178C25D1</PipeName>
1007 | 			<PipeName condition="contains">SQLAnywhereLRM</PipeName>
1008 | 			<PipeName condition="contains">SQLLocal</PipeName>
1009 | 			<PipeName condition="contains">DropboxPipe_</PipeName>
1010 | 			<PipeName condition="contains">pipe\netlogon</PipeName>
1011 | 			<PipeName condition="contains">pipe\samr</PipeName>
1012 | 			<PipeName condition="contains">pipe\lsarpc</PipeName>
1013 | 			<Image condition="is">c:\windows\system32\inetsrv\w3wp.exe</Image>
1014 | 			<Image condition="is">C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\mfcesd.exe</Image>
1015 | 			<Image condition="is">C:\Pfx Engagement\WM\PFXEngagement.exe</Image>
1016 | 			<Image condition="is">C:\Pfx Engagement\WM\PfxEngagement.exe</Image>
1017 | 			<Image condition="is">C:\Pfx Engagement\WM\Pfx.KnowledgeCoach.SharedServices.exe</Image>
1018 | 			<Image condition="is">C:\Program Files (x86)\Micro Focus\COBOL Server 2012\bin\mfds.exe</Image>
1019 | 			<Image condition="is">ScreenConnect.WindowsClient.exe</Image>
1020 | 			<Image condition="is">ScreenConnect.ClientService.exe</Image>
1021 | 			<Image condition="is">QBW32.EXE</Image>
1022 | 			<Image condition="is">C:\Windows\system32\wbem\wmiprvse.exe</Image>
1023 | 			
1024 | 		</PipeEvent>
1025 | 	</RuleGroup>
1026 | 		<RuleGroup name="WmiEvent Exclusions" groupRelation="or">
1027 | 
1028 | 		<WmiEvent onmatch="exclude">
1029 | 			<!-- Record WMI events !-->
1030 | 		</WmiEvent>
1031 | </RuleGroup>		
1032 | 	</EventFiltering>
1033 | </Sysmon>
1034 | 


--------------------------------------------------------------------------------