Comments (2)
All the testing I've done has shown that the "AND" isn't working as documented and everything is just a big "OR".
According to the docs:
Within a rule, filter conditions on the same field have OR behavior, whereas conditions on different fields have AND behavior.
from sysmon-config.
@gwsales Thank you ! I was wondering if I was the only person who was seeing that (I certainly know I'm not, but then why does the developer say that the AND condition works in the official Sysmon download page.)
Tons of infosec people are using Sysmon, and this config is called out everywhere as a reference guide. Requesting the author (or any of the experienced community leaders) to please help clarify this one seemingly simple & basic question.
Here is another place I've asked the same question & got no response back:
https://gist.github.com/Neo23x0/f56bea38d95040b70cf5#comments
from sysmon-config.
Related Issues (20)
- Sysmon for Linux HOT 3
- Event Id 10 not being generated HOT 1
- Event 22 not generating HOT 1
- Outdated link inside the sysmon-config HOT 1
- Capturing deleted files
- config causing 35 second delay opening modern MS Office file formats (.docx & .xlsx etc)
- Include vs Exclude precedence HOT 1
- Sysmon 14.13: Crash with sysmon-config on Windows 2012 R2 HOT 1
- Event 22 DNS Query issue - not generating event from browsers HOT 12
- 28 Event ID... HOT 1
- Incorrect XML Configuration - Sysmon 14.16
- Sysmon v15.0 & 29 Events HOT 2
- Exclude _PSSCRIPTPOLICYTEST_xxxxx.ps1 in fullfilepath in AppLocker events from forwarding to WEC
- Sysmon Installation Issue - wevtutil.exe returned failure HOT 2
- sysmon erronious sysmon not installed error
- Can help show me the code how to sysmon use eventID 23, 26 ? HOT 1
- Sysmonconfig XML error log when attempting to install.
- LSA Credential Guard
- Where are Windows Event ID??? HOT 1
- Is this config now abandoned?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sysmon-config.