Deploy Sysmon With A LimaCharlie D&R Rule

deploy_sysmon.yml

deploy_sysmon:
    detect:
      event: OS_SERVICES_REP
      op: and
      rules:
        - op: is platform
          name: windows
        - op: contains
          not: true
          case sensitive: false
          path: event/SVCS/?/SVC_NAME
          value: sysmon      
    respond:
    - action: task
      command: put --payload-name sysmon.exe --payload-path "C:\Windows\Temp\sysmon.exe"
    - action: wait
      duration: 10s
    - action: task
      command: >-
        put --payload-name sysmonconfig.xml --payload-path
        "C:\Windows\Temp\sysmon.xml"
    - action: wait
      duration: 10s
    - action: task
      command: >-
        run --shell-command "C:\Windows\Temp\sysmon.exe -accepteula -i
        C:\Windows\Temp\sysmon.xml"
    - action: wait
      duration: 10s
    - action: task
      command: file_del "C:\Windows\Temp\sysmon.exe"
    - action: task
      command: file_del "C:\Windows\Temp\sysmon.xml"
    is_enabled: true