Skip to content

Instantly share code, notes, and snippets.

@olafhartong

olafhartong/msoffice-fileblock.xml

Created August 16, 2022 17:28
Show Gist options
  • Save olafhartong/87d242537c7d598a32923e597a140cb3 to your computer and use it in GitHub Desktop.
Save olafhartong/87d242537c7d598a32923e597a140cb3 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
msoffice-fileblock.xml
<Sysmon schemaversion="4.82">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileBlockExecutable onmatch="include">
<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">excel.exe</Image>
<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">winword.exe</Image>
<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">powerpnt.exe</Image>
<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">outlook.exe</Image>
<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">msaccess.exe</Image>
<Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">mspub.exe</Image>
</FileBlockExecutable>
</RuleGroup>
</EventFiltering>
</Sysmon>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment