jsecurity101

jsecurity101

#Author: Jonathan Johnson
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12  



$WinlogbeatUrl = "https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-7.5.2-windows-x86_64.zip"
$WinlogbeatOutputFile = "winlogbeat.zip"
$WinlogbeatConfig = "https://gist.github.com/jsecurity101/ec4c829e6d32a984d7ccf4c1e9247590/archive/8d85c6c443704e821a7f53e536be61667c67febd.zip"
$WinlogZip = "winlogconfig.zip"

jsecurity101

###################### Winlogbeat Configuration Example ########################

# This file is an example configuration file highlighting only the most common
# options. The winlogbeat.reference.yml file from the same directory contains
# all the supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/winlogbeat/index.html

# ======================== Winlogbeat specific options =========================

jsecurity101

<Sysmon schemaversion="4.30">
   <!-- Capture all hashes -->
   <HashAlgorithms>*</HashAlgorithms>
   <EventFiltering>
      <!-- Event ID 1 == Process Creation. Log all newly created processes except -->
      <ProcessCreate onmatch="exclude">
	      <Image condition="contains">splunk</Image>
	      <Image condition="contains">btool.exe</Image>
	      <Image condition="contains">SnareCore</Image>
	      <Image condition="contains">nxlog</Image>

jsecurity101

jsecurity101

SELECT 
    a.computer_name,
    a.OriginalFileName,
    a.LogonId,
    b.ProcessId,
    c.TargetFilename
FROM processreimaging a
JOIN processreimaging b
    ON a.ProcessGuid = b.ProcessGuid
    AND b.channel = "Microsoft-Windows-Sysmon/Operational"