search

SwiftOnSecurity / sysmon-config

Sysmon configuration file template with default high-quality event tracing
4.68k stars 1.69k forks source link

Patch FileCreate include - Capture .xsl instead of .xls #186

Closed ghost closed 2 weeks ago

ghost commented 1 year ago

There is a typo on line 519, instead of monitoring for .xsl file creations, the configuration is monitoring for .xls. There is a duplicate entry on line 537 to capture .xls file creations.

Original line: <TargetFilename condition="end with">.xls</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->

Updated line: <TargetFilename condition="end with">.xsl</TargetFilename><!--Microsoft [ https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75 ] -->