search

olafhartong / sysmon-modular

A repository of sysmon configuration modules
MIT License
2.66k stars 590 forks source link

Intercepting deleted files #149

Open harryray33 opened 2 years ago

harryray33 commented 2 years ago

Do you, by any chance, have a config file for the sysmon ability to intercept deleted files please.

As shown in this sysinternal video https://youtu.be/_MUP4tgdM7s?t=148

michalzobec commented 2 years ago

I voting pro for this new feature ;)

and I welcome config file with new feature FileBlockExecutable .