├── README.md ├── driver-load.txt ├── file-create-file-count-no-chrome.txt ├── file-create-file-count.txt ├── file-create-program-count.txt ├── file-create-time-backwards.txt ├── file-create-time.txt ├── image-load-wininet-winsock32.txt ├── image-load.txt ├── images ├── create-times.PNG ├── event-details.PNG ├── event-list.PNG ├── file-create-program-count.PNG ├── file-create-timestomp.PNG ├── imageload-wininet-winsock32.PNG ├── log-lizard-processes.PNG ├── log-parser-cmd.PNG ├── network-connections-ip-list-external.PNG └── process-start-stop-by-user.PNG ├── network-connection-count.txt ├── network-connection.txt ├── network-connections-ip-list-external.txt ├── network-socket-count.txt ├── process-create-terminate.txt └── process-start-stop-by-user.txt /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/README.md -------------------------------------------------------------------------------- /driver-load.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/driver-load.txt -------------------------------------------------------------------------------- /file-create-file-count-no-chrome.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/file-create-file-count-no-chrome.txt -------------------------------------------------------------------------------- /file-create-file-count.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/file-create-file-count.txt -------------------------------------------------------------------------------- /file-create-program-count.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/file-create-program-count.txt -------------------------------------------------------------------------------- /file-create-time-backwards.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/file-create-time-backwards.txt -------------------------------------------------------------------------------- /file-create-time.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/file-create-time.txt -------------------------------------------------------------------------------- /image-load-wininet-winsock32.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/image-load-wininet-winsock32.txt -------------------------------------------------------------------------------- /image-load.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/image-load.txt -------------------------------------------------------------------------------- /images/create-times.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/create-times.PNG -------------------------------------------------------------------------------- /images/event-details.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/event-details.PNG -------------------------------------------------------------------------------- /images/event-list.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/event-list.PNG -------------------------------------------------------------------------------- /images/file-create-program-count.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/file-create-program-count.PNG -------------------------------------------------------------------------------- /images/file-create-timestomp.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/file-create-timestomp.PNG -------------------------------------------------------------------------------- /images/imageload-wininet-winsock32.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/imageload-wininet-winsock32.PNG -------------------------------------------------------------------------------- /images/log-lizard-processes.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/log-lizard-processes.PNG -------------------------------------------------------------------------------- /images/log-parser-cmd.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/log-parser-cmd.PNG -------------------------------------------------------------------------------- /images/network-connections-ip-list-external.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/network-connections-ip-list-external.PNG -------------------------------------------------------------------------------- /images/process-start-stop-by-user.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/images/process-start-stop-by-user.PNG -------------------------------------------------------------------------------- /network-connection-count.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/network-connection-count.txt -------------------------------------------------------------------------------- /network-connection.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/network-connection.txt -------------------------------------------------------------------------------- /network-connections-ip-list-external.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/network-connections-ip-list-external.txt -------------------------------------------------------------------------------- /network-socket-count.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/network-socket-count.txt -------------------------------------------------------------------------------- /process-create-terminate.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/process-create-terminate.txt -------------------------------------------------------------------------------- /process-start-stop-by-user.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JamesHabben/sysmon-queries/HEAD/process-start-stop-by-user.txt --------------------------------------------------------------------------------