Code

Line 239 registry formatting#179

Code

Open

kevinelwell wants to merge 210 commits intoSwiftOnSecurity:masterSwiftOnSecurity/sysmon-config:masterfrom Neo23x0:masterNeo23x0/sysmon-config:masterCopy head branch name to clipboard

+5,776-140

Commits

Commits on Jul 24, 2021

• squashed pull requests from original repo

  Show description for 88e3a0b
  Neo23x0

  committed
  88e3a0b

  Copy full SHA for 88e3a0b

• HiveNightmare detection

  Neo23x0

  committed
  bdc3fd2

  Copy full SHA for bdc3fd2

• docs: give credits to the contributors of the squashed pull requests

  Neo23x0

  committed
  ca2ccea

  Copy full SHA for ca2ccea

• docs: better line breaks in credits

  Neo23x0

  committed
  fe70b87

  Copy full SHA for fe70b87

• PrinterNightmare coverage

  Neo23x0

  committed
  23af2b4

  Copy full SHA for 23af2b4

• feat: more PrinterNightmare coverage

  Neo23x0

  committed
  f893c68

  Copy full SHA for f893c68

• docs: info on extended coverage

  Neo23x0

  committed
  510e4ed

  Copy full SHA for 510e4ed

• fix: accidental removal of section

  Neo23x0

  committed
  ca54b56

  Copy full SHA for ca54b56

• filter: OneDrive

  Neo23x0

  committed
  876166b

  Copy full SHA for 876166b

• SeriousSAM CS Pattern

  Neo23x0

  committed
  4aa2ad4

  Copy full SHA for 4aa2ad4

Commits on Jul 26, 2021

• First CI workflow draft

  Show description for fd602c9
  humpalum

  authored
  fd602c9

  Copy full SHA for fd602c9

• fix: renamed main to master

  humpalum

  authored
  7b98675

  Copy full SHA for 7b98675

• chore: Added Eventcount Check Job

  humpalum

  authored
  fdb5396

  Copy full SHA for fdb5396

• chore: Added a simulated busy system

  Show description for 97b006c
  humpalum

  authored
  97b006c

  Copy full SHA for 97b006c

• chore: Fixed Branchnames

  humpalum

  authored
  3530138

  Copy full SHA for 3530138

Commits on Jul 27, 2021

• chore: Limiting Eventcount to Sysmon Events

  humpalum

  authored
  df4e131

  Copy full SHA for df4e131

• docs: add maintainers

  Neo23x0

  committed
  94d37c3

  Copy full SHA for 94d37c3

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  17836fd

  Copy full SHA for 17836fd

Commits on Jul 28, 2021

• ProcessAccess using CobaltStrike BOF NtOpenProcess

  phantinuss

  committed
  77d3adb

  Copy full SHA for 77d3adb

• lsass process access with relevant access rights

  phantinuss

  committed
  0c24d1d

  Copy full SHA for 0c24d1d

• fix: use tab instead of space characters for indentation

  phantinuss

  committed
  def0883

  Copy full SHA for def0883

• Merge pull request #2 from phantinuss/master

  Show description for cd90b87
  phantinuss

  authored
  cd90b87

  Copy full SHA for cd90b87

Commits on Jul 29, 2021

• docs: update README

  Neo23x0

  committed
  a253184

  Copy full SHA for a253184

• chore: full fledged sysmon config

  Neo23x0

  committed
  5370dcf

  Copy full SHA for 5370dcf

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  337be95

  Copy full SHA for 337be95

Commits on Jul 30, 2021

• chore: ignore .vscode

  Neo23x0

  committed
  df67cdc

  Copy full SHA for df67cdc

• new CobaltStrike NamedPipe patterns

  Neo23x0

  committed
  2618b37

  Copy full SHA for 2618b37

• Merge pull request #3 from Neo23x0/config-devel

  Show description for 454b72e
  Neo23x0

  authored
  454b72e

  Copy full SHA for 454b72e

• Add Splunk exclusions per sysmon-modular

  DustyMMiller

  committed
  743a054

  Copy full SHA for 743a054

• Merge remote-tracking branch 'DustyMMiller/master' into SwiftOnSecurity-PRs

  

  Tobias Michalski

  committed
  9dcf3b2

  Copy full SHA for 9dcf3b2

• fix: Added Section comment line

  humpalum

  authored
  e77d1e0

  Copy full SHA for e77d1e0

• refactor: simplified expressions

  Neo23x0

  committed
  c56d1ab

  Copy full SHA for c56d1ab

• Merge pull request #4 from Neo23x0/SwiftOnSecurity-PRs

  Show description for 58d6cc5
  humpalum

  authored
  58d6cc5

  Copy full SHA for 58d6cc5

Commits on Aug 3, 2021

• introduce new conditions to config and make use of 'not begin with' in ProcessAccess

  phantinuss

  committed
  cb81745

  Copy full SHA for cb81745

• Merge pull request #5 from phantinuss/master

  Show description for b8a1a30
  phantinuss

  authored
  b8a1a30

  Copy full SHA for b8a1a30

Commits on Aug 4, 2021

• chore: User simulation in workflow

  humpalum

  authored
  5e9e9d3

  Copy full SHA for 5e9e9d3

• Merge pull request #6 from Neo23x0/humpalum-patch-1-1

  Show description for 9af65f5
  humpalum

  authored
  9af65f5

  Copy full SHA for 9af65f5

• Add Rule for CobaltStrike BOF Injected AMSI Bypass

  phantinuss

  committed
  40bdcfc

  Copy full SHA for 40bdcfc

• replace spaces with tabs or duplicate spaces where needed

  phantinuss

  committed
  e5f3ed3

  Copy full SHA for e5f3ed3

• switch from spaces to tabs for the whole file

  phantinuss

  committed
  20025a0

  Copy full SHA for 20025a0

• Merge pull request #7 from phantinuss/master

  Show description for 72f2256
  phantinuss

  authored
  72f2256

  Copy full SHA for 72f2256

• chore: Removed Push Trigger from master

  Show description for 035297a
  humpalum

  authored
  035297a

  Copy full SHA for 035297a

Commits on Aug 5, 2021

• Merge remote-tracking branch 'f-bader/patch-1' into SwiftOnSecurity-PRs

  

  Tobias Michalski

  committed
  7c71dc5

  Copy full SHA for 7c71dc5

• Merge pull request #8 from Neo23x0/humpalum-patch-2

  Show description for 53c85f7
  humpalum

  authored
  53c85f7

  Copy full SHA for 53c85f7

Commits on Aug 6, 2021

• Merge pull request #9 from Neo23x0/SwiftOnSecurity-PRs

  Show description for efb7784
  humpalum

  authored
  efb7784

  Copy full SHA for efb7784

• Collect LittleCorporal ProcessAccess events

  phantinuss

  committed
  166d4e1

  Copy full SHA for 166d4e1

• Merge pull request #10 from phantinuss/master

  Show description for ce3e7bf
  Neo23x0

  authored
  ce3e7bf

  Copy full SHA for ce3e7bf

Commits on Aug 12, 2021

• chore: Changed UserSim Download Path

  humpalum

  authored
  a75e733

  Copy full SHA for a75e733

• chore: Fix User-Sim execute

  humpalum

  authored
  edc0509

  Copy full SHA for edc0509

• Merge pull request #11 from Neo23x0/humpalum-patch-2

  Show description for b818d1f
  phantinuss

  authored
  b818d1f

  Copy full SHA for b818d1f

• fix: revert to schema version 4.50. Newer schema versions are put on an other branch until adaption of newer sysmon version should be higher

  phantinuss

  committed
  fadf537

  Copy full SHA for fadf537

Commits on Aug 13, 2021

• fix: use correct list separator ;

  phantinuss

  committed
  be79a15

  Copy full SHA for be79a15

• generalise CobaltStrike BOF ProcessAccess Pattern

  phantinuss

  committed
  86397d2

  Copy full SHA for 86397d2

Commits on Aug 19, 2021

• Merge pull request #12 from phantinuss/master

  Show description for 289d5e9
  phantinuss

  authored
  289d5e9

  Copy full SHA for 289d5e9

Commits on Aug 23, 2021

• feat: efspotato named pipe

  Neo23x0

  committed
  254932d

  Copy full SHA for 254932d

• Merge pull request #13 from Neo23x0/config-devel

  Show description for ea785bc
  Neo23x0

  authored
  ea785bc

  Copy full SHA for ea785bc

• fix: limit too low

  Neo23x0

  committed
  8f35001

  Copy full SHA for 8f35001

Commits on Aug 26, 2021

• feat: more CobaltStrike malleable C2 profiles

  phantinuss

  committed
  569e839

  Copy full SHA for 569e839

• Merge pull request #14 from phantinuss/master

  Show description for 8335168
  phantinuss

  authored
  8335168

  Copy full SHA for 8335168

Commits on Sep 1, 2021

• Liquid Snake Named Pipe

  Neo23x0

  committed
  ac2cc48

  Copy full SHA for ac2cc48

• Merge branch 'master' into config-devel

  Neo23x0

  committed
  5c2fdc2

  Copy full SHA for 5c2fdc2

• suspicious WMI Event Consumer creates named pipe

  Neo23x0

  committed
  d3dbadd

  Copy full SHA for d3dbadd

• docs: rule development note - sysmon config for lab

  Neo23x0

  committed
  169d300

  Copy full SHA for 169d300

• Merge pull request #15 from Neo23x0/config-devel

  Show description for ed59813
  Neo23x0

  authored
  ed59813

  Copy full SHA for ed59813

Commits on Sep 10, 2021

• CVE-2021-40444 traces in registry

  Neo23x0

  committed
  a05925b

  Copy full SHA for a05925b

• Merge branch 'master' into config-devel

  Neo23x0

  committed
  a1e9a8f

  Copy full SHA for a1e9a8f

• Merge pull request #16 from Neo23x0/config-devel

  Show description for 06181b2
  Neo23x0

  authored
  06181b2

  Copy full SHA for 06181b2

• Winword writes .cab / .inf files : CVE-2021-40444 detection

  Neo23x0

  committed
  d852990

  Copy full SHA for d852990

• Merge pull request #17 from Neo23x0/config-devel

  Show description for 0676604
  Neo23x0

  authored
  0676604

  Copy full SHA for 0676604

Commits on Oct 4, 2021

• new ADS stream creation expressions

  Neo23x0

  committed
  29c61dc

  Copy full SHA for 29c61dc

• Merge branch 'master' into config-devel

  Neo23x0

  committed
  0ea30fe

  Copy full SHA for 0ea30fe

• Merge pull request #18 from Neo23x0/config-devel

  Show description for c327298
  Neo23x0

  authored
  c327298

  Copy full SHA for c327298

Commits on Oct 11, 2021

• ConnectPipe for \MICROSOFT##WID\tsql\query

  Neo23x0

  committed
  a23727f

  Copy full SHA for a23727f

Commits on Oct 12, 2021

• refactor: moved section to bigger "include" block

  Neo23x0

  committed
  3c249b9

  Copy full SHA for 3c249b9

• fix: position of PipeEvent

  Neo23x0

  committed
  3b1f323

  Copy full SHA for 3b1f323

• Update sysmonconfig-export.xml

  phantinuss

  authored
  0681c23

  Copy full SHA for 0681c23

• Merge pull request #19 from Neo23x0/config-devel

  Show description for ae35ee4
  phantinuss

  authored
  ae35ee4

  Copy full SHA for ae35ee4

Commits on Oct 18, 2021

• Update the Antivirus Tampering configuration, using broader condition

  hieutt35

  committed
  7166218

  Copy full SHA for 7166218

Commits on Oct 19, 2021

• fix: typo

  phantinuss

  committed
  9f2e182

  Copy full SHA for 9f2e182

• feat: mstsc connection history registry

  phantinuss

  committed
  7c0dc56

  Copy full SHA for 7c0dc56

Commits on Oct 20, 2021

• Merge pull request #20 from phantinuss/master

  Show description for 5674c3e
  humpalum

  authored
  5674c3e

  Copy full SHA for 5674c3e

• Merge github.com:SwiftOnSecurity/sysmon-config into SwiftOnSecurity-PRs

  

  Tobias Michalski

  committed
  bac20c7

  Copy full SHA for bac20c7

• Merge https://github.com/hieuttmmo/sysmon-config into SwiftOnSecurity-PRs

  

  Tobias Michalski

  committed
  2fc084e

  Copy full SHA for 2fc084e

• Add T1003 file creation when using Mimikatz SSP

  Show description for df8a9dc
  mdecrevoisier

  authored
  df8a9dc

  Copy full SHA for df8a9dc

Commits on Oct 22, 2021

• Fixed indentation

  humpalum

  authored
  09044be

  Copy full SHA for 09044be

• Merge pull request #22 from mdecrevoisier/patch-1

  Show description for bb95139
  humpalum

  authored
  bb95139

  Copy full SHA for bb95139

Commits on Oct 26, 2021

• Merge pull request #21 from Neo23x0/SwiftOnSecurity-PRs

  Show description for 0052847
  phantinuss

  authored
  0052847

  Copy full SHA for 0052847

Commits on Oct 29, 2021

• more malicious named pipe names

  Show description for 423ddf1
  Neo23x0

  committed
  423ddf1

  Copy full SHA for 423ddf1

• Merge pull request #23 from Neo23x0/config-devel

  Show description for 656c64a
  Neo23x0

  authored
  656c64a

  Copy full SHA for 656c64a

Commits on Nov 8, 2021

• Kirbi file creation

  Neo23x0

  committed
  13cabb9

  Copy full SHA for 13cabb9

Commits on Nov 9, 2021

• Merge pull request #24 from Neo23x0/config-devel

  Show description for 4cd88a0
  Neo23x0

  authored
  4cd88a0

  Copy full SHA for 4cd88a0

Commits on Apr 7, 2022

• fix command line

  conitrade-as

  committed
  b7f0605

  Copy full SHA for b7f0605

• update Azure OMS/MMA Agent exclusions

  conitrade-as

  committed
  fadf11d

  Copy full SHA for fadf11d

• add PRTG exclusions

  conitrade-as

  committed
  439ff66

  Copy full SHA for 439ff66

Commits on Jul 7, 2022

• Merge pull request #25 from conitrade/hotfix/monitoring-agents

  Show description for dbe450d
  Neo23x0

  authored
  dbe450d

  Copy full SHA for dbe450d

Commits on Aug 17, 2022

• Update README.md

  Neo23x0

  authored
  04bf25b

  Copy full SHA for 04bf25b

• feat: new sysmon configs - trace, block

  Neo23x0

  committed
  23d19f0

  Copy full SHA for 23d19f0

• docs: configs

  Neo23x0

  committed
  c134c2b

  Copy full SHA for c134c2b

• fix: updated placeholders

  Neo23x0

  committed
  3b4e2f5

  Copy full SHA for 3b4e2f5

• new block rules

  Neo23x0

  committed
  d746b57

  Copy full SHA for d746b57

• Last change

  Neo23x0

  committed
  cc1683c

  Copy full SHA for cc1683c

• more office apps and file extensions

  phantinuss

  committed
  5e79e00

  Copy full SHA for 5e79e00

• new hacktool imphashes

  Neo23x0

  committed
  9ae9498

  Copy full SHA for 9ae9498

• Merge pull request #26 from phantinuss/master

  Show description for fd25520
  phantinuss

  authored
  fd25520

  Copy full SHA for fd25520

• fix: .NET imphash

  Neo23x0

  committed
  16edc45

  Copy full SHA for 16edc45

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  9993f89

  Copy full SHA for 9993f89

• end with extensions

  Neo23x0

  committed
  b709916

  Copy full SHA for b709916

• Update sysmonconfig-trace.xml

  nasbench

  committed
  36e2821

  Copy full SHA for 36e2821

• docs: readme

  Neo23x0

  committed
  79c75dc

  Copy full SHA for 79c75dc

• Update sysmonconfig-export.xml

  nasbench

  committed
  aaeae94

  Copy full SHA for aaeae94

• Update sysmonconfig-export-block.xml

  nasbench

  committed
  3e13b8b

  Copy full SHA for 3e13b8b

• updates on block list

  Neo23x0

  committed
  6f49ce0

  Copy full SHA for 6f49ce0

• chore: add tests for trace and block config

  phantinuss

  committed
  f9aa1ab

  Copy full SHA for f9aa1ab

• chore: increase event count for trace logs

  phantinuss

  committed
  051230b

  Copy full SHA for 051230b

Commits on Aug 18, 2022

• chore: spacing

  phantinuss

  committed
  ccb7fc1

  Copy full SHA for ccb7fc1

• chore: rename msbuild-default back to msbuild

  phantinuss

  committed
  4a8d689

  Copy full SHA for 4a8d689

• Merge pull request #29 from phantinuss/master

  Show description for 2595f79
  phantinuss

  authored
  2595f79

  Copy full SHA for 2595f79

• Merge pull request #28 from nasbench/master

  Show description for 50e6b0c
  phantinuss

  authored
  50e6b0c

  Copy full SHA for 50e6b0c

• feat: adding certutil.exe to the blocklist

  Neo23x0

  committed
  01d2ab3

  Copy full SHA for 01d2ab3

• more LOLBINS

  Neo23x0

  committed
  ab94a0b

  Copy full SHA for ab94a0b

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  5792811

  Copy full SHA for 5792811

• Update sysmonconfig-export-block.xml

  nasbench

  committed
  63782a9

  Copy full SHA for 63782a9

• Merge branch 'Neo23x0:master' into master

  nasbench

  authored
  7684a0a

  Copy full SHA for 7684a0a

• Update sysmonconfig-trace.xml

  nasbench

  committed
  eadb378

  Copy full SHA for eadb378

• Update sysmonconfig-export-block.xml

  nasbench

  committed
  8ce36b4

  Copy full SHA for 8ce36b4

• Update sysmonconfig-export-block.xml

  nasbench

  committed
  45b2323

  Copy full SHA for 45b2323

• Merge pull request #30 from nasbench/master

  Show description for 3fb8937
  Neo23x0

  authored
  3fb8937

  Copy full SHA for 3fb8937

• feat: progs that should never drop exes

  Neo23x0

  committed
  665de6f

  Copy full SHA for 665de6f

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  d25bce4

  Copy full SHA for d25bce4

Commits on Aug 19, 2022

• Sliver stagers

  Neo23x0

  committed
  73ca900

  Copy full SHA for 73ca900

• Update sysmonconfig-export-block.xml

  nasbench

  committed
  8b5e899

  Copy full SHA for 8b5e899

Commits on Aug 21, 2022

• Dumpert Imphashes

  Neo23x0

  committed
  3ae0fce

  Copy full SHA for 3ae0fce

• docs: README updates

  Neo23x0

  committed
  3f808d9

  Copy full SHA for 3f808d9

Commits on Aug 22, 2022

• Merge pull request #32 from nasbench/master

  Show description for 48b06e9
  Neo23x0

  authored
  48b06e9

  Copy full SHA for 48b06e9

• fix: remove duplicate

  phantinuss

  committed
  63c1b1b

  Copy full SHA for 63c1b1b

• Merge pull request #33 from phantinuss/master

  Show description for aebac3e
  phantinuss

  authored
  aebac3e

  Copy full SHA for aebac3e

• refactor: disable expand.exe block

  Neo23x0

  committed
  9350818

  Copy full SHA for 9350818

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  ffd14ac

  Copy full SHA for ffd14ac

Commits on Sep 7, 2022

• block: SysmonEnte downloads

  Neo23x0

  committed
  71b62ae

  Copy full SHA for 71b62ae

• SysmonQuiet coverage

  Neo23x0

  committed
  bb1b414

  Copy full SHA for bb1b414

• SharpEvtMute Hook and Filename IOCs

  Neo23x0

  committed
  e274ab6

  Copy full SHA for e274ab6

Commits on Sep 15, 2022

• SharpEvtMute

  Neo23x0

  committed
  af1f439

  Copy full SHA for af1f439

Commits on Sep 29, 2022

• feat: more Cobalt Strike named pipe patterns

  Neo23x0

  committed
  6262d68

  Copy full SHA for 6262d68

Commits on Oct 4, 2022

• refactor: reworked file write section

  Neo23x0

  committed
  d2e5c3d

  Copy full SHA for d2e5c3d

• fix: many events with standard pipe

  Neo23x0

  committed
  6a904c1

  Copy full SHA for 6a904c1

Commits on Oct 6, 2022

• feat: block JuicyPotatoNG downloads

  Neo23x0

  committed
  f6e9b8f

  Copy full SHA for f6e9b8f

Commits on Oct 8, 2022

• Update sysmonconfig-export-block.xml

  Show description for abd7e1f
  stevenhardey

  authored
  abd7e1f

  Copy full SHA for abd7e1f

Commits on Oct 10, 2022

• Merge pull request #35 from stevenhardey/stevenhardey-patch-1

  Show description for 71f8acd
  phantinuss

  authored
  71f8acd

  Copy full SHA for 71f8acd

• chore: mirror changes from PR #35

  phantinuss

  committed
  452d448

  Copy full SHA for 452d448

• Merge pull request #36 from phantinuss/master

  Show description for e600a79
  phantinuss

  authored
  e600a79

  Copy full SHA for e600a79

Commits on Oct 21, 2022

• fix: remove unnecessary exclude block for FileDelete

  phantinuss

  committed
  2af5f4e

  Copy full SHA for 2af5f4e

• Merge pull request #37 from phantinuss/master

  Show description for 647ac14
  phantinuss

  authored
  647ac14

  Copy full SHA for 647ac14

• Revert "fix: many events with standard pipe"

  Show description for c90917b
  phantinuss

  committed
  c90917b

  Copy full SHA for c90917b

• Merge pull request #38 from phantinuss/master

  Show description for 062473c
  phantinuss

  authored
  062473c

  Copy full SHA for 062473c

• fix: fixed pipename beginswith clauses

  pH-T

  committed
  13588c0

  Copy full SHA for 13588c0

• feat: new havoc c2 pipenames

  pH-T

  committed
  fd6830b

  Copy full SHA for fd6830b

Commits on Oct 24, 2022

• Apply suggestions from code review

  Show description for 7b41eb3
  

  pH-T

  and

  phantinuss

  authored
  7b41eb3

  Copy full SHA for 7b41eb3

• Merge pull request #39 from pH-T/master

  Show description for 937ac18
  phantinuss

  authored
  937ac18

  Copy full SHA for 937ac18

Commits on Oct 26, 2022

• Update Config

  nasbench

  committed
  2c6ce88

  Copy full SHA for 2c6ce88

• Add missing backslashes in "end with"

  nasbench

  committed
  f67d8d3

  Copy full SHA for f67d8d3

Commits on Oct 27, 2022

• Merge pull request #40 from nasbench/master

  Show description for a7e2293
  phantinuss

  authored
  a7e2293

  Copy full SHA for a7e2293

Commits on Dec 4, 2022

• feat: include SysmonEOP.exe blocks

  Neo23x0

  committed
  834388e

  Copy full SHA for 834388e

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  a10e454

  Copy full SHA for a10e454

Commits on Jan 13, 2023

• Exclude aurora agent

  frack113

  committed
  47aed63

  Copy full SHA for 47aed63

• Exclude aurora agent x86

  frack113

  committed
  f78b00c

  Copy full SHA for f78b00c

• Exclude aurora agent path

  frack113

  committed
  c2e2f13

  Copy full SHA for c2e2f13

• chore: remove boilerplate text (1)

  phantinuss

  authored
  2dff95f

  Copy full SHA for 2dff95f

• chore: remove boilerplate text (2)

  phantinuss

  authored
  5e7c317

  Copy full SHA for 5e7c317

• Apply suggestions from code review

  Show description for ee64e18
  

  frack113

  and

  phantinuss

  authored
  ee64e18

  Copy full SHA for ee64e18

• chore: workflow: switch python3 with nodejs installer as test data

  phantinuss

  committed
  4348699

  Copy full SHA for 4348699

• chore: workflow: update to node16

  phantinuss

  committed
  a3014ed

  Copy full SHA for a3014ed

• Merge pull request #42 from phantinuss/master

  Show description for e5c291e
  phantinuss

  authored
  e5c291e

  Copy full SHA for e5c291e

• Exclude aurora agent

  frack113

  committed
  ddc07ee

  Copy full SHA for ddc07ee

• Exclude aurora agent x86

  frack113

  committed
  120c110

  Copy full SHA for 120c110

• Exclude aurora agent path

  frack113

  committed
  b427c6c

  Copy full SHA for b427c6c

• chore: remove boilerplate text (1)

  

  phantinuss

  authored and

  frack113

  committed
  353f141

  Copy full SHA for 353f141

• chore: remove boilerplate text (2)

  

  phantinuss

  authored and

  frack113

  committed
  ccd5e5a

  Copy full SHA for ccd5e5a

• Apply suggestions from code review

  Show description for 935685e
  

  frack113

  and

  phantinuss

  committed
  935685e

  Copy full SHA for 935685e

• Merge branch 'exclude_aurora' of github.com:frack113/sysmon-config into exclude_aurora

  frack113

  committed
  e66beb4

  Copy full SHA for e66beb4

• Merge pull request #41 from frack113/exclude_aurora

  Show description for 7f75f64
  phantinuss

  authored
  7f75f64

  Copy full SHA for 7f75f64

Commits on Feb 9, 2023

• feat: add onenote app to blocklist

  nasbench

  authored
  9e25076

  Copy full SHA for 9e25076

Commits on Feb 10, 2023

• Merge pull request #44 from nasbench/add-onenote-blocklist

  Show description for 86eb8c9
  phantinuss

  authored
  86eb8c9

  Copy full SHA for 86eb8c9

Commits on Apr 12, 2023

• Fixes #48

  nasbench

  committed
  ae41115

  Copy full SHA for ae41115

• Fixes #49

  nasbench

  committed
  1276443

  Copy full SHA for 1276443

• Fixes #43

  nasbench

  committed
  0dc42ba

  Copy full SHA for 0dc42ba

• Fixes #50

  nasbench

  committed
  9718f92

  Copy full SHA for 9718f92

Commits on Apr 19, 2023

• feat: update sysmon config

  nasbench

  committed
  d6c7c57

  Copy full SHA for d6c7c57

Commits on Apr 21, 2023

• feat: remove driver filters

  nasbench

  committed
  b766604

  Copy full SHA for b766604

Commits on Apr 27, 2023

• fix: apply suggestions from code review

  Show description for 94a324a
  

  nasbench

  and

  phantinuss

  authored
  94a324a

  Copy full SHA for 94a324a

Commits on May 5, 2023

• new hacktool blocks

  Neo23x0

  committed
  0ee029a

  Copy full SHA for 0ee029a

• Merge pull request #51 from nasbench/resolve-issues

  Show description for bb5c8a6
  Neo23x0

  authored
  bb5c8a6

  Copy full SHA for bb5c8a6

• Update sysmonconfig-export-block.xml

  Neo23x0

  committed
  65e6fff

  Copy full SHA for 65e6fff

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  6e36404

  Copy full SHA for 6e36404

Commits on May 15, 2023

• Remove duplicates sysmonconfig-export

  cospirho

  authored
  46fd40f

  Copy full SHA for 46fd40f

• Remove duplicates sysmonconfig-export-block

  cospirho

  authored
  cea856d

  Copy full SHA for cea856d

Commits on May 18, 2023

• Merge pull request #53 from cospirho/master

  Show description for 766b2a7
  nasbench

  authored
  766b2a7

  Copy full SHA for 766b2a7

Commits on Jun 28, 2023

• new FileExecutableDetected Block

  Neo23x0

  committed
  43f8ebf

  Copy full SHA for 43f8ebf

• Merge branch 'master' of https://github.com/Neo23x0/sysmon-config

  Neo23x0

  committed
  8569801

  Copy full SHA for 8569801

• loldrivers rules

  Neo23x0

  committed
  87be34c

  Copy full SHA for 87be34c

• Update sysmonconfig-export.xml

  Neo23x0

  committed
  f10d77f

  Copy full SHA for f10d77f

• fix: increase allowance for trace runs

  Neo23x0

  committed
  bc734a5

  Copy full SHA for bc734a5

• feat: blocked config

  Neo23x0

  committed
  21205e9

  Copy full SHA for 21205e9

• fix: schema version

  Neo23x0

  committed
  65bc443

  Copy full SHA for 65bc443

• Merge pull request #56 from Neo23x0/loldrivers-extension

  Show description for 277c594
  Neo23x0

  authored
  277c594

  Copy full SHA for 277c594

Commits on Jul 27, 2023

• Update sysmonconfig-export.xml

  nasbench

  authored
  b2b5554

  Copy full SHA for b2b5554

• Update sysmonconfig-export-block.xml

  nasbench

  authored
  8b8c419

  Copy full SHA for 8b8c419

Commits on Oct 17, 2023

• Merge pull request #57 from nasbench/master

  Show description for fa614fd
  nasbench

  authored
  fa614fd

  Copy full SHA for fa614fd

Commits on Dec 14, 2023

• add: EDRSandblast

  Show description for 65c78ba
  Neo23x0

  committed
  65c78ba

  Copy full SHA for 65c78ba

Commits on Dec 29, 2023

• EDRSilencer hashes

  Neo23x0

  committed
  2dc8575

  Copy full SHA for 2dc8575

Commits on Feb 1, 2024

• add: EventLogCrasher

  Neo23x0

  committed
  f944c05

  Copy full SHA for f944c05