ThreatLens/config.xml at main · f3nr1rs3c/ThreatLens · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
<!-- Made by Doğukan İSPİRLİ -->

<Sysmon schemaversion="4.90">

  <HashAlgorithms>sha256,md5</HashAlgorithms>
  <CheckRevocation>true</CheckRevocation>

  <EventFiltering>

    <!-- ===================== -->
    <!-- PROCESS CREATION -->
    <!-- ===================== -->
    <ProcessCreate onmatch="include">
      <Image condition="contains">powershell.exe</Image>
      <Image condition="contains">cmd.exe</Image>
      <Image condition="contains">rundll32.exe</Image>
      <Image condition="contains">mshta.exe</Image>
      <Image condition="contains">wscript.exe</Image>
      <Image condition="contains">cscript.exe</Image>
      <Image condition="contains">regsvr32.exe</Image>
      <Image condition="contains">certutil.exe</Image>
      <Image condition="contains">bitsadmin.exe</Image>

      <CommandLine condition="contains">-enc</CommandLine>
      <CommandLine condition="contains">DownloadString</CommandLine>
      <CommandLine condition="contains">Invoke-Expression</CommandLine>
      <CommandLine condition="contains">IEX</CommandLine>
    </ProcessCreate>

    <!-- ===================== -->
    <!-- NETWORK CONNECTION -->
    <!-- ===================== -->
    <NetworkConnect onmatch="include">
      <Image condition="contains">powershell.exe</Image>
      <Image condition="contains">cmd.exe</Image>
      <Image condition="contains">rundll32.exe</Image>
      <Image condition="contains">mshta.exe</Image>
    </NetworkConnect>

    <!-- ===================== -->
    <!-- FILE CREATION -->
    <!-- ===================== -->
    <FileCreate onmatch="include">
      <TargetFilename condition="contains">AppData</TargetFilename>
      <TargetFilename condition="contains">Temp</TargetFilename>
      <TargetFilename condition="end with">.exe</TargetFilename>
      <TargetFilename condition="end with">.dll</TargetFilename>
    </FileCreate>

    <!-- ===================== -->
    <!-- REGISTRY (PERSISTENCE) -->
    <!-- ===================== -->
    <RegistryEvent onmatch="include">
      <TargetObject condition="contains">Run</TargetObject>
      <TargetObject condition="contains">RunOnce</TargetObject>
      <TargetObject condition="contains">Policies</TargetObject>
      <TargetObject condition="contains">Winlogon</TargetObject>
    </RegistryEvent>

    <!-- ===================== -->
    <!-- PROCESS INJECTION -->
    <!-- ===================== -->
    <ProcessAccess onmatch="include">
      <GrantedAccess condition="contains">0x1F</GrantedAccess>
      <GrantedAccess condition="contains">0x1FFFFF</GrantedAccess>
    </ProcessAccess>

    <!-- ===================== -->
    <!-- DRIVER LOAD -->
    <!-- ===================== -->
    <DriverLoad onmatch="include" />

    <!-- ===================== -->
    <!-- IMAGE LOAD (DLL) -->
    <!-- ===================== -->
    <ImageLoad onmatch="include">
      <ImageLoaded condition="end with">.dll</ImageLoaded>
    </ImageLoad>

  </EventFiltering>

</Sysmon>