Skip to content

Commit

Permalink
Updated after successful CICD run 09/20/2023 07:33:02 UTC
Browse files Browse the repository at this point in the history
  • Loading branch information
Azure Pipeline committed Sep 20, 2023
1 parent 5cd2c60 commit a9ff298
Show file tree
Hide file tree
Showing 6 changed files with 96 additions and 0 deletions.
Binary file modified 0_custom_configuration/all_exclude_modules.txt
View file
Binary file not shown.
Binary file modified 0_custom_configuration/all_modules.txt
View file
Binary file not shown.
24 changes: 24 additions & 0 deletions sysmonconfig-excludes-only.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -330,6 +330,22 @@
<Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
<ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileCoAuth.exe</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\netapi32.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\msvcp110_win.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\dsreg.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\perfctrs.dll</ImageLoaded>
</Rule>
</ImageLoad>
</RuleGroup>
<!-- Event ID 8 == CreateRemoteThread - Excludes -->
Expand Down Expand Up @@ -365,6 +381,12 @@
<SourceImage condition="is">C:\Program Files\Adobe\Adobe Photoshop 2021\Photoshop.exe</SourceImage>
<TargetImage condition="begin with">C:\Program Files\Autodesk\Autodesk Desktop App</TargetImage>
<TargetImage condition="begin with">C:\Program Files (x86)\Autodesk\Autodesk Desktop App</TargetImage>
<Rule groupRelation="and">
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
<TargetImage condition="is">C:\Windows\system32\cscript.exe</TargetImage>
</Rule>
<SourceImage condition="contains all">C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
<SourceImage condition="is">C:\Windows\CarbonBlack\cb.exe</SourceImage>
<Rule name="Exclude Chrome SW Reporter into Reporter" groupRelation="and">
<SourceImage condition="image">software_reporter_tool.exe</SourceImage>
Expand All @@ -384,6 +406,8 @@
<SourceImage condition="contains all">C:\Users\;\AppData\Local\Citrix\ICA Client\receiver\Receiver.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe</SourceImage>
<SourceImage condition="is">c:\Program Files\Couchbase\Server\bin\sigar_port.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage>
<SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage>
<SourceImage condition="contains all">C:\Program Files\Elastic\Agent\data\;\metricbeat.exe</SourceImage>
<SourceImage condition="contains all">C:\Program Files;\FireEye\xagt\xagt.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe</SourceImage>
Expand Down
24 changes: 24 additions & 0 deletions sysmonconfig-mde-augment.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -906,6 +906,22 @@
<Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
<ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileCoAuth.exe</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\netapi32.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\msvcp110_win.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\dsreg.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\perfctrs.dll</ImageLoaded>
</Rule>
</ImageLoad>
</RuleGroup>
<!-- Event ID 8 == CreateRemoteThread - Sysmon will not provide notable additional visibility over MDE. -->
Expand Down Expand Up @@ -1020,6 +1036,12 @@
<SourceImage condition="is">C:\Program Files\Adobe\Adobe Photoshop 2021\Photoshop.exe</SourceImage>
<TargetImage condition="begin with">C:\Program Files\Autodesk\Autodesk Desktop App</TargetImage>
<TargetImage condition="begin with">C:\Program Files (x86)\Autodesk\Autodesk Desktop App</TargetImage>
<Rule groupRelation="and">
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
<TargetImage condition="is">C:\Windows\system32\cscript.exe</TargetImage>
</Rule>
<SourceImage condition="contains all">C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
<SourceImage condition="is">C:\Windows\CarbonBlack\cb.exe</SourceImage>
<Rule name="Exclude Chrome SW Reporter into Reporter" groupRelation="and">
<SourceImage condition="image">software_reporter_tool.exe</SourceImage>
Expand All @@ -1039,6 +1061,8 @@
<SourceImage condition="contains all">C:\Users\;\AppData\Local\Citrix\ICA Client\receiver\Receiver.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe</SourceImage>
<SourceImage condition="is">c:\Program Files\Couchbase\Server\bin\sigar_port.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage>
<SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage>
<SourceImage condition="contains all">C:\Program Files\Elastic\Agent\data\;\metricbeat.exe</SourceImage>
<SourceImage condition="contains all">C:\Program Files;\FireEye\xagt\xagt.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe</SourceImage>
Expand Down
24 changes: 24 additions & 0 deletions sysmonconfig-with-filedelete.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1112,6 +1112,22 @@
<Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
<ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileCoAuth.exe</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\netapi32.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\msvcp110_win.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\dsreg.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\perfctrs.dll</ImageLoaded>
</Rule>
</ImageLoad>
</RuleGroup>
<!-- Event ID 8 == CreateRemoteThread - Excludes -->
Expand Down Expand Up @@ -1237,6 +1253,12 @@
<SourceImage condition="is">C:\Program Files\Adobe\Adobe Photoshop 2021\Photoshop.exe</SourceImage>
<TargetImage condition="begin with">C:\Program Files\Autodesk\Autodesk Desktop App</TargetImage>
<TargetImage condition="begin with">C:\Program Files (x86)\Autodesk\Autodesk Desktop App</TargetImage>
<Rule groupRelation="and">
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
<TargetImage condition="is">C:\Windows\system32\cscript.exe</TargetImage>
</Rule>
<SourceImage condition="contains all">C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
<SourceImage condition="is">C:\Windows\CarbonBlack\cb.exe</SourceImage>
<Rule name="Exclude Chrome SW Reporter into Reporter" groupRelation="and">
<SourceImage condition="image">software_reporter_tool.exe</SourceImage>
Expand All @@ -1256,6 +1278,8 @@
<SourceImage condition="contains all">C:\Users\;\AppData\Local\Citrix\ICA Client\receiver\Receiver.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe</SourceImage>
<SourceImage condition="is">c:\Program Files\Couchbase\Server\bin\sigar_port.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage>
<SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage>
<SourceImage condition="contains all">C:\Program Files\Elastic\Agent\data\;\metricbeat.exe</SourceImage>
<SourceImage condition="contains all">C:\Program Files;\FireEye\xagt\xagt.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe</SourceImage>
Expand Down
24 changes: 24 additions & 0 deletions sysmonconfig.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1112,6 +1112,22 @@
<Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
<ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileCoAuth.exe</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\netapi32.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\msvcp110_win.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\dsreg.dll</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<Image condition="is">C:\Windows\System32\svchost.exe</Image>
<ImageLoaded condition="is">C:\Windows\System32\perfctrs.dll</ImageLoaded>
</Rule>
</ImageLoad>
</RuleGroup>
<!-- Event ID 8 == CreateRemoteThread - Excludes -->
Expand Down Expand Up @@ -1237,6 +1253,12 @@
<SourceImage condition="is">C:\Program Files\Adobe\Adobe Photoshop 2021\Photoshop.exe</SourceImage>
<TargetImage condition="begin with">C:\Program Files\Autodesk\Autodesk Desktop App</TargetImage>
<TargetImage condition="begin with">C:\Program Files (x86)\Autodesk\Autodesk Desktop App</TargetImage>
<Rule groupRelation="and">
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
<TargetImage condition="is">C:\Windows\system32\cscript.exe</TargetImage>
</Rule>
<SourceImage condition="contains all">C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
<SourceImage condition="is">C:\Windows\CarbonBlack\cb.exe</SourceImage>
<Rule name="Exclude Chrome SW Reporter into Reporter" groupRelation="and">
<SourceImage condition="image">software_reporter_tool.exe</SourceImage>
Expand All @@ -1256,6 +1278,8 @@
<SourceImage condition="contains all">C:\Users\;\AppData\Local\Citrix\ICA Client\receiver\Receiver.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe</SourceImage>
<SourceImage condition="is">c:\Program Files\Couchbase\Server\bin\sigar_port.exe</SourceImage>
<SourceImage condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage>
<SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage>
<SourceImage condition="contains all">C:\Program Files\Elastic\Agent\data\;\metricbeat.exe</SourceImage>
<SourceImage condition="contains all">C:\Program Files;\FireEye\xagt\xagt.exe</SourceImage>
<SourceImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe</SourceImage>
Expand Down

0 comments on commit a9ff298

Please sign in to comment.