Skip to content

Instantly share code, notes, and snippets.

@darkoperator

darkoperator/dangeconfig.xml

Created July 30, 2016 02:56
Show Gist options
  • Save darkoperator/2c044de7c79ab07cdb9071201b5cbbcd to your computer and use it in GitHub Desktop.
Save darkoperator/2c044de7c79ab07cdb9071201b5cbbcd to your computer and use it in GitHub Desktop.
Download ZIP
Raw
dangeconfig.xml
<Sysmon schemaversion="2.10">
<HashAlgorithms>*</HashAlgorithms>
<CheckRevocation></CheckRevocation>
<EventFiltering>
<ImageLoad onmatch="include">
<ImageLoaded condition="contains">System.Management.Automation.ni.dll</ImageLoaded>
<ImageLoaded condition="contains">System.Management.Automation.dll</ImageLoaded>
</ImageLoad>
<ImageLoad onmatch="exclude">
<Image condition="is">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Image>
<Image condition="is">C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe</Image>
</ImageLoad>
</EventFiltering>
</Sysmon>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment