├── scripts ├── log-channels.ps1 └── check-audit-logging.ps1 ├── README.md ├── LICENSE └── sysmon-intense.xml /scripts/log-channels.ps1: -------------------------------------------------------------------------------- 1 | # Incrase Sysmon logs Size 2 | $sysmon = Get-WinEvent -ListLog Microsoft-Windows-Sysmon/Operational 3 | $sysmon.MaximumSizeInBytes = 2147483648 #2GB 4 | $sysmon.SaveChanges() 5 | 6 | # Incrase Powershell logs Size 7 | $ps1 = Get-WinEvent -ListLog Microsoft-Windows-PowerShell/Operational 8 | $ps1.MaximumSizeInBytes = 2147483648 #2GB 9 | $ps1.SaveChanges() 10 | 11 | $ps2 = Get-WinEvent -ListLog "Windows PowerShell" 12 | $ps2.MaximumSizeInBytes = 2147483648 #2GB 13 | $ps2.SaveChanges() 14 | 15 | # Incrase Application logs Size 16 | $application = Get-WinEvent -ListLog Application 17 | $application.MaximumSizeInBytes = 537919488 #512MB 18 | $application.SaveChanges() 19 | 20 | # Incrase Security logs Size 21 | $security = Get-WinEvent -ListLog Security 22 | $security.MaximumSizeInBytes = 537919488 #512MB 23 | $security.SaveChanges() 24 | 25 | # Incrase System logs Size 26 | $system = Get-WinEvent -ListLog System 27 | $system.MaximumSizeInBytes = 537919488 #512MB 28 | $system.SaveChanges() 29 | 30 | # Enable various Log Channels 31 | wevtutil sl Microsoft-Windows-DNS-Client/Operational /e:true 32 | wevtutil sl Microsoft-Windows-DriverFrameworks-UserMode/Operational /e:true 33 | wevtutil sl Microsoft-Windows-LSA/Operational /e:true 34 | wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true -------------------------------------------------------------------------------- /scripts/check-audit-logging.ps1: -------------------------------------------------------------------------------- 1 | $auditPolicyArray = @{ 2 | ### Account Logon 3 | "Credential Validation" = "{0CCE923F-69AE-11D9-BED3-505054503030}"; 4 | "Kerberos Authentication Service" = "{0CCE9242-69AE-11D9-BED3-505054503030}"; 5 | "Kerberos Service Ticket Operations" = "{0CCE9240-69AE-11D9-BED3-505054503030}"; 6 | "Other Account Logon Events" = "{0CCE9241-69AE-11D9-BED3-505054503030}"; 7 | ### Account Management 8 | #"Application Group Management" = "{0CCE9239-69AE-11D9-BED3-505054503030}"; 9 | "Computer Account Management" = "{0CCE9236-69AE-11D9-BED3-505054503030}"; 10 | #"Distribution Group Management" = "{0CCE9238-69AE-11D9-BED3-505054503030}"; 11 | "Other Account Management Events" = "{0CCE923A-69AE-11D9-BED3-505054503030}"; 12 | "Security Group Management" = "{0CCE9237-69AE-11D9-BED3-505054503030}"; 13 | "User Account Management" = "{0CCE9235-69AE-11D9-BED3-505054503030}"; 14 | ### Detailed Tracking 15 | "DPAPI Activity" = "{0CCE922D-69AE-11D9-BED3-505054503030}"; 16 | #"Plug and Play Events" = "{0CCE9248-69AE-11D9-BED3-505054503030}"; 17 | "Process Creation" = "{0CCE922B-69AE-11D9-BED3-505054503030}"; 18 | #"Process Termination" = "{0CCE922C-69AE-11D9-BED3-505054503030}"; 19 | #"RPC Events" = "{0CCE922E-69AE-11D9-BED3-505054503030}"; 20 | "Token Right Adjusted Events" = "{0CCE924A-69AE-11D9-BED3-505054503030}"; 21 | ### DS Access 22 | #"Detailed Directory Service Replication" = "{0CCE923E-69AE-11D9-BED3-505054503030}"; 23 | #"Directory Service Access" = "{0CCE923B-69AE-11D9-BED3-505054503030}"; 24 | #"Directory Service Changes" = "{0CCE923C-69AE-11D9-BED3-505054503030}"; 25 | #"Directory Service Replication" = "{0CCE923D-69AE-11D9-BED3-505054503030}"; 26 | ### Logon/Logoff 27 | "Account Lockout" = "{0CCE9217-69AE-11D9-BED3-505054503030}"; 28 | #"User / Device Claims" = "{0CCE9247-69AE-11D9-BED3-505054503030}"; 29 | "Group Membership" = "{0CCE9249-69AE-11D9-BED3-505054503030}"; 30 | #"IPsec Extended Mode" = "{0CCE921A-69AE-11D9-BED3-505054503030}"; 31 | #"IPsec Main Mode" = "{0CCE9218-69AE-11D9-BED3-505054503030}"; 32 | #"IPsec Quick Mode" = "{0CCE9219-69AE-11D9-BED3-505054503030}"; 33 | #"Logoff" = "{0CCE9216-69AE-11D9-BED3-505054503030}"; 34 | "Logon" = "{0CCE9215-69AE-11D9-BED3-505054503030}"; 35 | #"Network Policy Server" = "{0CCE9243-69AE-11D9-BED3-505054503030}"; 36 | "Other Logon/Logoff Events" = "{0CCE921C-69AE-11D9-BED3-505054503030}"; 37 | "Special Logon" = "{0CCE921B-69AE-11D9-BED3-505054503030}"; 38 | ### Object Access 39 | #"Application Generated" = "{0CCE9222-69AE-11D9-BED3-505054503030}"; 40 | #"Certification Services" = "{0CCE9221-69AE-11D9-BED3-505054503030}"; 41 | "Detailed File Share" = "{0CCE9244-69AE-11D9-BED3-505054503030}"; 42 | "File Share" = "{0CCE9224-69AE-11D9-BED3-505054503030}"; 43 | #"Filtering Platform Connection" = "{0CCE9226-69AE-11D9-BED3-505054503030}"; 44 | #"Filtering Platform Packet Drop" = "{0CCE9225-69AE-11D9-BED3-505054503030}"; 45 | #"Handle Manipulation" = "{0CCE9223-69AE-11D9-BED3-505054503030}"; 46 | "Kernel Object" = "{0CCE921F-69AE-11D9-BED3-505054503030}"; 47 | "Other Object Access Events" = "{0CCE9227-69AE-11D9-BED3-505054503030}"; 48 | #"Removable Storage" = "{0CCE9245-69AE-11D9-BED3-505054503030}"; 49 | #"SAM" = "{0CCE9220-69AE-11D9-BED3-505054503030}"; 50 | #"Central Policy Staging" = "{0CCE9246-69AE-11D9-BED3-505054503030}"; 51 | ### Policy Change 52 | "Audit Policy Change" = "{0CCE922F-69AE-11D9-BED3-505054503030}"; 53 | "Authentication Policy Change" = "{0CCE9230-69AE-11D9-BED3-505054503030}"; 54 | "Authorization Policy Change" = "{0CCE9231-69AE-11D9-BED3-505054503030}"; 55 | #"Filtering Platform Policy Change" = "{0CCE9233-69AE-11D9-BED3-505054503030}"; 56 | "MPSSVC Rule-Level Policy Change" = "{0CCE9232-69AE-11D9-BED3-505054503030}"; 57 | "Other Policy Change Events" = "{0CCE9234-69AE-11D9-BED3-505054503030}"; 58 | ### Privilege Use 59 | #"Non Sensitive Privilege Use" = "{0CCE9229-69AE-11D9-BED3-505054503030}"; 60 | "Other Privilege Use Events" = "{0CCE922A-69AE-11D9-BED3-505054503030}"; 61 | "Sensitive Privilege Use" = "{0CCE9228-69AE-11D9-BED3-505054503030}"; 62 | # System 63 | "IPsec Driver" = "{0CCE9213-69AE-11D9-BED3-505054503030}"; 64 | "Other System Events" = "{0CCE9214-69AE-11D9-BED3-505054503030}"; 65 | "Security State Change" = "{0CCE9210-69AE-11D9-BED3-505054503030}"; 66 | "Security System Extension" = "{0CCE9211-69AE-11D9-BED3-505054503030}"; 67 | "System Integrity" = "{0CCE9212-69AE-11D9-BED3-505054503030}"; 68 | ### Global Object Access Auditing 69 | #"File System" = "{0CCE921D-69AE-11D9-BED3-505054503030}"; 70 | #"Registry" = "{0CCE921E-69AE-11D9-BED3-505054503030}"; 71 | } 72 | $eventLogsArray = @{ 73 | "Microsoft-Windows-Sysmon/Operational" = 2; 74 | "Security" = 2; 75 | "System" = 2; 76 | "Application" = 2; 77 | "Windows PowerShell" = 2; 78 | "Microsoft-Windows-PowerShell/Operational" = 2; 79 | } 80 | $eventLogsAdditionalArray = ( 81 | "Microsoft-Windows-DNS-Client/Operational", 82 | "Microsoft-Windows-DriverFrameworks-UserMode/Operational", 83 | "Microsoft-Windows-LSA/Operational", 84 | "Microsoft-Windows-TaskScheduler/Operational" 85 | ) 86 | 87 | $errors= 0 88 | Write-Host "Checking Audit Policy ..." 89 | Foreach ($i in $auditPolicyArray.GetEnumerator()){ 90 | $auditEnabled = (auditpol /get /Subcategory:"$($i.Value)").Trim() -match "Success" 91 | if ( -not $auditEnabled ) { 92 | Write-Host " [ERROR] Audit" $i.Name "is disabled." -BackgroundColor DarkRed 93 | $errors += 1 94 | } 95 | } 96 | Write-Host "`nChecking If Sysmon Is Installed...." 97 | $sysmon = $False 98 | try { 99 | $x = Get-WinEvent -ListLog Microsoft-Windows-Sysmon/Operational -ErrorAction Stop 100 | Write-Host " [OK] Sysmon Is Installed" -BackgroundColor Green 101 | $sysmon = $True 102 | } 103 | catch { 104 | Write-Host " [ERROR] Sysmon Isn't Installed" -BackgroundColor DarkRed 105 | } 106 | Write-Host "`nChecking Log Size Configuration...." 107 | Foreach ($i in $eventLogsArray.GetEnumerator()){ 108 | if ($i.Name -eq "Microsoft-Windows-Sysmon/Operational"){ 109 | if ($sysmon){ 110 | $size = (Get-WinEvent -ListLog $i.Name).MaximumSizeInBytes / 1000000000 111 | if ($i.Value -gt $size){ 112 | Write-Host " [ERROR] " $i.Name "Log Size Isn't configured" -BackgroundColor DarkRed 113 | $errors += 1 114 | } 115 | } 116 | } 117 | else{ 118 | $size = (Get-WinEvent -ListLog $i.Name).MaximumSizeInBytes / 1000000000 119 | 120 | if ($i.Value -gt $size){ 121 | Write-Host " [ERROR] " $i.Name "Log Size Isn't configured" -BackgroundColor DarkRed 122 | $errors += 1 123 | } 124 | } 125 | } 126 | Write-Host "`nChecking Additional Log Channels ..." 127 | Foreach ($i in $eventLogsAdditionalArray){ 128 | $e = wevtutil gl $i | findstr "enabled: true" 129 | if ( $e -eq "enabled: false" ) { 130 | Write-Host " [ERROR] " $i "Log Channel isn't enabled" -BackgroundColor DarkRed 131 | $errors += 1 132 | } 133 | } 134 | 135 | if ($errors -eq 0){ 136 | Write-Host "All Good" 137 | } -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # evtx-baseline 2 | A repository hosting example goodware evtx logs containing sample software installation and basic user interaction 3 | 4 | # Donations 5 | - win10-client.tgz by [@phantinuss](https://github.com/phantinuss/) 6 | - win11-client.tgz by [@frack113](https://github.com/frack113/) 7 | - win7-x86.tgz by [@pH-T](https://github.com/pH-T) 8 | - win2022-evtx.tgz by [@Neo23x0](https://github.com/Neo23x0) 9 | - win2022-ad.tgz by [@frack113](https://github.com/frack113) 10 | - win2022-0-20348-azure.tgz by [@Neo23x0](https://github.com/Neo23x0) 11 | - win11-client-2023.tgz by [@nasbench](https://github.com/nasbench) 12 | 13 | If you want to donate, create an issue or contact @phantinuss at twitter or keybase (the large files are only organised in releases, not the repo itself) 14 | 15 | ## How the data was produced 16 | 17 | 1. Install a Windows VM using a trial license (https://www.microsoft.com/en-us/evalcenter/) 18 | 19 | 2. Install Sysmon (http://live.sysinternals.com/tools/Sysmon64.exe) using [sysmonconfig-trace.xml](https://github.com/Neo23x0/sysmon-config/blob/master/sysmonconfig-trace.xml) which is a modified fork of [Cyb3rWard0g's config](https://github.com/OTRF/Blacksmith/blob/master/resources/configs/sysmon/sysmon.xml) 20 | 21 | 3. Open a powershell console as an administrator and copy paste the following script 22 | 23 | - The following script will: 24 | - Increase the Sysmon and PowerShell log size to not lose events by log rotation to 2GB 25 | - Increase the `Application`, `Security` and `System` logs to 512MB 26 | - Enable the `Microsoft-Windows-TaskScheduler/Operational` eventlog channel 27 | - Enable the `Microsoft-Windows-DNS-Client/Operational` eventlog channel 28 | - Enable the `Microsoft-Windows-DriverFrameworks-UserMode/Operational` eventlog channel 29 | - Enable the `Microsoft-Windows-LSA/Operational` eventlog channel 30 | 31 | ```powershell 32 | # Incrase Sysmon logs Size 33 | $sysmon = Get-WinEvent -ListLog Microsoft-Windows-Sysmon/Operational 34 | $sysmon.MaximumSizeInBytes = 2147483648 #2GB 35 | $sysmon.SaveChanges() 36 | 37 | # Incrase Powershell logs Size 38 | $ps1 = Get-WinEvent -ListLog Microsoft-Windows-PowerShell/Operational 39 | $ps1.MaximumSizeInBytes = 2147483648 #2GB 40 | $ps1.SaveChanges() 41 | 42 | $ps2 = Get-WinEvent -ListLog "Windows PowerShell" 43 | $ps2.MaximumSizeInBytes = 2147483648 #2GB 44 | $ps2.SaveChanges() 45 | 46 | # Incrase Application logs Size 47 | $application = Get-WinEvent -ListLog Application 48 | $application.MaximumSizeInBytes = 537919488 #512MB 49 | $application.SaveChanges() 50 | 51 | # Incrase Security logs Size 52 | $security = Get-WinEvent -ListLog Security 53 | $security.MaximumSizeInBytes = 537919488 #512MB 54 | $security.SaveChanges() 55 | 56 | # Incrase System logs Size 57 | $system = Get-WinEvent -ListLog System 58 | $system.MaximumSizeInBytes = 537919488 #512MB 59 | $system.SaveChanges() 60 | 61 | # Enable various Log Channels 62 | wevtutil sl Microsoft-Windows-DNS-Client/Operational /e:true 63 | wevtutil sl Microsoft-Windows-DriverFrameworks-UserMode/Operational /e:true 64 | wevtutil sl Microsoft-Windows-LSA/Operational /e:true 65 | wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true 66 | ``` 67 | 68 | 4. Activate logging of process creation events and all other categories with their subcategories except the "Object Access" category. At least the [Microsoft Recommendations](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) are needed. 69 | 70 | ![image](https://user-images.githubusercontent.com/79651203/161557067-87ab2977-e351-4595-b083-cceaafe19614.png) 71 | 72 | (Location: Open "gpedit" > "Computer Configuration" > "Windows Settings" > "Security Settings" > "Advanced Audit Policy Configuration" 73 | 74 | Note: When Advanced Audit Policy Configuration settings are used, the "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" policy setting under Local Policies\Security Options must als be enabled. 75 | 76 | ![image](https://user-images.githubusercontent.com/31235211/224973601-b8621b17-82e8-4ea7-8249-b5b92abc8ae3.png) 77 | 78 | 79 | 5. Activate logging of process command line 80 | 81 | ![image](https://user-images.githubusercontent.com/79651203/161557776-b06f7436-908d-4da2-8331-daa50e51309a.png) 82 | 83 | (Location: Open "gpedit" > "Computer Configuration" > "Administrative Templates" > "System" > "Audit Process Creation" > "Include command line in process creation events" set to "Enabled") 84 | 85 | 6. Activate PowerShell Script Block Logging and PowerShell Module Logging 86 | 87 | ![powershell](https://user-images.githubusercontent.com/31235211/224982142-ccacd947-c86f-4b4f-bbe7-1546627f28cc.png) 88 | 89 | (Location: Open "gpedit" > "Computer Configuration" > "Administrative Templates" > "Windows Components" > "Windows PowerShell" > "Turn on Module Logging" & "Turn on Script Block Logging" set to "Enabled") 90 | 91 | 7. Install software and simulate interaction 92 | 93 | 8. Export the eventlog using the method described below and contribute 94 | 95 | ## Export The Event Logs 96 | 97 | Once all is done and you're ready to donate the event log, open a powershell console as administrator and execute the following command 98 | 99 | - This small script will copy the event logs to a seperate directory and then compress them into a single file 100 | 101 | ```powershell 102 | mkdir $ENV:UserProfile\evtx; Copy-Item "C:\Windows\System32\winevt\Logs\*.evtx" -Destination $ENV:UserProfile\evtx\; $filename = "$ENV:UserProfile\donation-evtx-" + $([System.Environment]::OSVersion.Version.Major) + "-" + $([System.Environment]::OSVersion.Version.Minor) + "-" + $([System.Environment]::OSVersion.Version.Build); Compress-Archive -Path $ENV:UserProfile\evtx -CompressionLevel Optimal -DestinationPath $filename; Remove-Item $ENV:UserProfile\evtx\ -Recurse; explorer $ENV:UserProfile\ 103 | ``` 104 | 105 | If you have 7-Zip (`C:\Program Files\7-Zip\7z.exe`) installed on your system and for faster results, please use the following command from an elevated powershell prompt 106 | 107 | ```powershell 108 | mkdir $ENV:UserProfile\evtx; Copy-Item "C:\Windows\System32\winevt\Logs\*.evtx" -Destination $ENV:UserProfile\evtx\; $filename = "$ENV:UserProfile\donation-evtx-" + $([System.Environment]::OSVersion.Version.Major) + "-" + $([System.Environment]::OSVersion.Version.Minor) + "-" + $([System.Environment]::OSVersion.Version.Build); & "C:\Program Files\7-Zip\7z.exe" a $filename $ENV:UserProfile\evtx\*; Remove-Item $ENV:UserProfile\evtx\ -Recurse; explorer $ENV:UserProfile\ 109 | ``` 110 | 111 | The resulting file will be located in `$ENV:UserProfile\evtx\` and have the following naming convention `donation-evtx-[MajorVersion]-[MinorVersion]-[Build]` and is now ready to be donated :) 112 | 113 | ## Examples for Activity 114 | 115 | The following chapters show what we did on out test systems to simulate real user activity. It is meant as an example of what we did to create auhtentic log data. You could use your own systems or simulate your own user activity. 116 | 117 | ### Windows 10 Software and Interaction 118 | 119 | #### Installed Software 120 | (performed by https://ninite.com/) 121 | 122 | * Web Browsers 123 | * Chrome 124 | * Opera 125 | * Firefox 126 | * File Sharing 127 | * Compression 128 | * 7zip 129 | * WinRAR 130 | * Messaging 131 | * Zoom 132 | * Pidgin 133 | * Thunderbird 134 | * Other 135 | * Evernote 136 | * Keepass 2 137 | * Everything 138 | * Media 139 | * iTunes 140 | * VLC 141 | * Audacity 142 | * Spotify 143 | * Runtimes 144 | * Java (AdoptOpenJDK) x64 145 | * .NET Runtime x64 5+6 146 | * Developer Tools 147 | * Python x64 3 148 | * Filezilla 149 | * Notepad++ 150 | * WinSCP 151 | * PuTTY 152 | * WinMerge 153 | * Eclipse 154 | * VS Code 155 | * Imaging 156 | * Paint.NET 157 | * Gimp 158 | * IrfanView 159 | * XnView 160 | * Inkscape 161 | * Greenshot 162 | * Documents 163 | * Foxit Reader 164 | * LibreOffice 165 | * Online Storage 166 | * Dropbox 167 | * Google Drive 168 | * OneDrive 169 | * Security 170 | * Utilities 171 | * Teamviewer 172 | * WinDirStat 173 | 174 | #### User Interaction 175 | 176 | - Start the programs and search for updates 177 | - Install updates 178 | - Surf some Websites 179 | - Download pdf and open 180 | - Chrome: Download and install MS Office Trial 181 | - Call windirstat 182 | - Make screenshot in greenshot; open in xnview/irfanview 183 | - Execute java --version 184 | - Open Filezilla to bogus ftp 185 | - Open notepad++ sysmon config 186 | - Vscode extension install powershell stuff, python stuff 187 | - Putty to localhost 188 | - Winscp to localhost 189 | - Open Winmerge 190 | - Search with everything 191 | - Pack and extract using 7zip 192 | - Pack and extract using WinRar 193 | 194 | ### Windows 2022 AD Interaction 195 | 196 | - Install from ISO 197 | - Install sysmon 198 | - Configure logs 199 | - Connect network 200 | - Add AD role 201 | - Update OS 202 | - Add user1 and user2 203 | - * install win10 for client 204 | - connect DESTOP-S5D8VB9 to domain 205 | - Add group sigma 206 | - add user1 to sigma group 207 | - login as user2 on destop 208 | - change default GPO to enable powershell log 209 | - gpupdate /force (client too) 210 | - create shareme 211 | - put sysmon64.exe into 212 | - get and push a new file in shareme from client 213 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /sysmon-intense.xml: -------------------------------------------------------------------------------- 1 | 7 | 8 | 9 | * 10 | False 11 | Archive 12 | 13 | 14 | 15 | 16 | 17 | Sysmon.exe 18 | splunk 19 | btool.exe 20 | SnareCore 21 | nxlog 22 | winlogbeat 23 | Microsoft Monitoring Agent\Agent\MonitoringHost.exe 24 | C:\Program Files\NVIDIA Corporation\Display\ 25 | C:\Program Files\Dell\SupportAssist\pcdrcui.exe 26 | C:\Program Files\Dell\SupportAssist\koala.exe 27 | C:\WindowsAzure\Packages\CollectGuestLogs 28 | C:\Program Files\Windows Defender 29 | C:\Windows\System32\audiodg.exe 30 | C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 31 | C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 32 | ec2config.exe 33 | C:\WIndows\System32\poqexec.exe /noreboot /transaction 34 | 35 | 36 | 37 | 38 | 39 | C:\Program Files\Python310 40 | C:\Windows\system32\msiexec.exe 41 | 42 | 43 | 44 | 45 | 46 | C:\Program Files\Microsoft Office\Office15\ONENOTE.EXE 47 | Spotify.exe 48 | OneDrive.exe 49 | AppData\Roaming\Dashlane\Dashlane.exe 50 | AppData\Roaming\Dashlane\DashlanePlugin.exe 51 | winlogbeat.exe 52 | ec2config.exe 53 | cfn-signal.exe 54 | amazon-ssm-agent.exe 55 | ec2wallpaperinfo.exe 56 | C:\Windows\System32\spoolsv.exe 57 | C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 58 | C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe 59 | C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe 60 | C:\Windows\System32\CompatTelRunner.exe 61 | C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe 62 | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 63 | C:\Windows\System32\mmc.exe 64 | C:\Program Files\Microsoft VS Code\Code.exe 65 | C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe 66 | C:\Program Files\Windows Defender Advanced Threat Protection\ 67 | C:\Packages\Plugins\ 68 | C:\WindowsAzure\ 69 | C:\Program Files\Azure Advanced Threat Protection Sensor\ 70 | C:\Program Files\Microsoft Azure AD Connect Health Sync Agent\ 71 | C:\Program Files\Microsoft Azure AD Sync\ 72 | C:\Program Files\Microsoft Monitoring Agent\ 73 | \Ninite.exe 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | microsoft 84 | windows 85 | VMware 86 | Intel 87 | 88 | 89 | 90 | 91 | 92 | chrome.exe 93 | vmtoolsd.exe 94 | Sysmon.exe 95 | mmc.exe 96 | C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 97 | C:\Windows\System32\taskeng.exe 98 | C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe 99 | C:\Program Files\Windows Defender\NisSrv.exe 100 | C:\Program Files\Windows Defender\MsMpEng.exe 101 | onedrivesetup.exe 102 | onedrive.exe 103 | skypeapp.exe 104 | C:\Packages\Plugins\ 105 | C:\WindowsAzure\ 106 | C:\Program Files\Microsoft Monitoring Agent\ 107 | \CompatTelRunner.exe 108 | \Sysmon64.exe 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | Sysmon.exe 119 | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe 120 | \Google\Update\GoogleUpdate.exe 121 | C:\Program Files\Windows Defender\MsMpEng.exe 122 | C:\Windows\System32\svchost.exe 123 | 124 | 125 | 126 | 127 | 128 | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe 129 | Sysmon.exe 130 | GoogleUpdate.exe 131 | \Google\Chrome\Application\chrome.exe 132 | C:\Program Files\Windows Defender\MsMpEng.exe 133 | C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe 134 | C:\Program Files\Microsoft VS Code\Code.exe 135 | C:\WindowsAzure\Packages\CollectGuestLogs.exe 136 | C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe 137 | C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe 138 | C:\Windows\System32\VBoxService.exe 139 | Sysmon.exe 140 | C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe 141 | C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe 142 | C:\Program Files\Microsoft VS Code\Code.exe 143 | C:\Program Files\Windows Defender\MsMpEng.exe 144 | c:\Program Files\Microsoft VS Code\resources\app\out\vs\workbench\services\files\node\watcher\win32\CodeHelper.exe 145 | C:\Program Files\Amazon\Ec2ConfigService\Ec2Config.exe 146 | C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe 147 | C:\windows\system32\CompatTelRunner.exe 148 | C:\Packages\Plugins\ 149 | C:\WindowsAzure\ 150 | C:\Program Files\WindowsApps\ 151 | C:\Program Files\Windows Defender Advanced Threat Protection\ 152 | C:\Program Files\Windows Defender Advanced Threat Protection\ 153 | C:\Windows\SystemApps\InputApp 154 | C:\Program Files\Azure Advanced Threat Protection Sensor\ 155 | Microsoft.Tri.Sensor.Updater.exe 156 | onedrivesetup.exe 157 | StartMenuExperienceHost.exe 158 | ShellExperienceHost.exe 159 | mmc.exe 160 | Microsoft.Tri.Sensor.exe 161 | Microsoft.Tri.Sensor.Updater.exe 162 | \MsMpEng.exe 163 | C:\ProgramData\Microsoft\Windows Defender\platform\ 164 | 165 | C:\Windows\System32\RuntimeBroker.exe 166 | C:\windows\Explorer.EXE 167 | 168 | 169 | C:\ProgramData\Microsoft\Windows Defender\platform\ 170 | \svchost.exe 171 | 172 | Microsoft.Windows.Cortana 173 | C:\Windows\System32\VBoxService.exe 174 | \Ninite.exe 175 | \Ninite.exe 176 | 0x1000 177 | 178 | 179 | 180 | 181 | 182 | SearchIndexer.exe 183 | winlogbeat.exe 184 | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 185 | C:\Program Files\Microsoft VS Code\Code.exe 186 | onedrivesetup.exe 187 | onedrive.exe 188 | skypeapp.exe 189 | C:\Packages\Plugins\ 190 | C:\WindowsAzure\ 191 | C:\Windows\SystemApps\Microsoft.Windows.Cortana 192 | C:\Program Files\Microsoft Azure AD Sync\ 193 | C:\Program Files\Microsoft Azure AD Connect Health Sync Agent\ 194 | \TiWorker.exe 195 | C:\Windows\System32\winevt\Logs\ 196 | \Ninite.exe 197 | 198 | 199 | 200 | 201 | 202 | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe 203 | Sysmon.exe 204 | GoogleUpdate.exe 205 | C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe 206 | C:\Program Files\Windows Defender\NisSrv.exe 207 | C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe 208 | C:\windows\system32\AUDIODG.EXE 209 | C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 210 | C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe 211 | C:\Program Files\Azure Advanced Threat Protection Sensor\ 212 | C:\Windows\SystemApps\Microsoft.Windows.Cortana 213 | C:\WindowsAzure\ 214 | onedrivesetup.exe 215 | onedrive.exe 216 | skypeapp.exe 217 | Microsoft.Tri.Sensor.exe 218 | Microsoft.Tri.Sensor.Updater.exe 219 | \TiWorker.exe 220 | C:\Windows\system32\compattelrunner.exe 221 | C:\Windows\Sysmon64.exe 222 | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Microsoft Print to PDF\PrinterDriverData 223 | LanguageList 224 | Windows.UI.SettingsAppThreshold.pri 225 | \Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications 226 | \Software\Microsoft\Input\Settings\Insights 227 | \Schemas\StateSchema 228 | \Windows Search\CrawlScopeManager\Windows\SystemIndex 229 | \AppModel\StateRepository\Cache\Metadata 230 | \OpenWithProgids\ 231 | \Microsoft.WindowsMaps 232 | \AppModel\Deployment\Package 233 | \AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager 234 | \Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\ 235 | \Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.OneConnect 236 | HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz 237 | \CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Cortana 238 | \DeliveryOptimization\Swarms\ 239 | HKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTime 240 | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppReadiness\ 241 | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package 242 | HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason 243 | 244 | C:\Windows\system32\svchost.exe 245 | \DRIVERS\DriverDatabase\ 246 | 247 | \Microsoft\SystemCertificates\ 248 | 249 | 250 | 251 | 252 | 253 | 254 | 255 | 256 | 257 | C:\Packages\Plugins\ 258 | C:\WindowsAzure\ 259 | C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe 260 | C:\Windows\System32\VBoxService.exe 261 | 262 | 263 | 264 | 265 | 266 | 267 | 268 | 269 | 270 | C:\Program Files (x86)\nxlog\nxlog.exe 271 | 272 | 273 | 274 | 275 | 276 | 277 | 278 | 279 | 280 | 281 | 282 | 283 | 284 | 285 | 286 | 287 | 288 | 289 | C:\WindowsAzure\ 290 | C:\Packages\Plugins\ 291 | \TiWorker.exe 292 | 293 | 294 | 295 | --------------------------------------------------------------------------------