Comments (1)
Be aware that the rules for combining rule conditions have changed in 7.01:
From Sysmon 6.1:
- You can use both include and exclude rules for the same tag, where exclude rules override include rules. Within a rule, filter conditions on the same field have OR behavior, whereas conditions on different fields have AND behavior. In the sample configuration shown earlier, the networking filter
uses both an include and exclude rule to capture activity to port 80 and 443 by all processes except those that have iexplore.exe in their name.
From Sysmon 7.01:
- You can use both include and exclude rules for the same tag, where exclude rules override include rules. Within a rule, filter conditions have OR behavior, In the sample configuration shown earlier, the networking filter uses both an include and exclude rule to capture activity to port 80 and 443
by all processes except those that have iexplore.exe in their name.
Regards
John
from sysmon-config.
Related Issues (20)
- Sysmon for Linux HOT 3
- Event Id 10 not being generated HOT 1
- Event 22 not generating HOT 1
- Outdated link inside the sysmon-config HOT 1
- Capturing deleted files
- config causing 35 second delay opening modern MS Office file formats (.docx & .xlsx etc)
- Include vs Exclude precedence HOT 1
- Sysmon 14.13: Crash with sysmon-config on Windows 2012 R2 HOT 1
- Event 22 DNS Query issue - not generating event from browsers HOT 12
- 28 Event ID... HOT 1
- Incorrect XML Configuration - Sysmon 14.16
- Sysmon v15.0 & 29 Events HOT 2
- Exclude _PSSCRIPTPOLICYTEST_xxxxx.ps1 in fullfilepath in AppLocker events from forwarding to WEC
- Sysmon Installation Issue - wevtutil.exe returned failure HOT 2
- sysmon erronious sysmon not installed error
- Can help show me the code how to sysmon use eventID 23, 26 ? HOT 1
- Sysmonconfig XML error log when attempting to install.
- LSA Credential Guard
- Where are Windows Event ID??? HOT 1
- Is this config now abandoned?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sysmon-config.