Skip to content

Instantly share code, notes, and snippets.

@darkoperator

darkoperator/dangeconfig.xml

Created July 30, 2016 02:56
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save darkoperator/2c044de7c79ab07cdb9071201b5cbbcd to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save darkoperator/2c044de7c79ab07cdb9071201b5cbbcd to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. darkoperator created this gist Jul 30, 2016.
    14 changes: 14 additions & 0 deletions dangeconfig.xml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,14 @@
    <Sysmon schemaversion="2.10">
    <HashAlgorithms>*</HashAlgorithms>
    <CheckRevocation></CheckRevocation>
    <EventFiltering>
    <ImageLoad onmatch="include">
    <ImageLoaded condition="contains">System.Management.Automation.ni.dll</ImageLoaded>
    <ImageLoaded condition="contains">System.Management.Automation.dll</ImageLoaded>
    </ImageLoad>
    <ImageLoad onmatch="exclude">
    <Image condition="is">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Image>
    <Image condition="is">C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe</Image>
    </ImageLoad>
    </EventFiltering>
    </Sysmon>