From 249ce2ec76d73a3cab17be4d43198b4d91222dcb Mon Sep 17 00:00:00 2001 From: Chris Long Date: Tue, 3 Dec 2019 22:18:20 -0800 Subject: [PATCH] Updating channel permissions for Microsoft-Windows-Sysmon --- Vagrant/Vagrantfile | 5 ++--- .../Custom Event Channel Permissions.htm | Bin 150094 -> 152480 bytes .../Default Domain Controllers Policy.htm | Bin 144954 -> 144954 bytes .../Backup.xml | 18 ++++++++++++++++++ .../Machine/Preferences/Registry/Registry.xml | 1 + .../bkupInfo.xml | 1 + .../gpreport.xml | Bin 24866 -> 26270 bytes .../Backup.xml | 18 ------------------ .../bkupInfo.xml | 1 - 9 files changed, 22 insertions(+), 22 deletions(-) mode change 100644 => 100755 Vagrant/resources/GPO/reports/Custom Event Channel Permissions.htm mode change 100644 => 100755 Vagrant/resources/GPO/reports/Default Domain Controllers Policy.htm create mode 100755 Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/Backup.xml rename Vagrant/resources/GPO/wef_configuration/{{AE232F63-0190-47EE-BAF9-B78754178376} => {1C916D7C-52F4-4EB4-8EA7-081349532B3C}}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml (84%) mode change 100644 => 100755 create mode 100755 Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/bkupInfo.xml rename Vagrant/resources/GPO/wef_configuration/{{AE232F63-0190-47EE-BAF9-B78754178376} => {1C916D7C-52F4-4EB4-8EA7-081349532B3C}}/gpreport.xml (84%) mode change 100644 => 100755 delete mode 100644 Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/Backup.xml delete mode 100644 Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/bkupInfo.xml diff --git a/Vagrant/Vagrantfile b/Vagrant/Vagrantfile index 0a55609..f9c1bdb 100644 --- a/Vagrant/Vagrantfile +++ b/Vagrant/Vagrantfile @@ -57,7 +57,6 @@ Vagrant.configure("2") do |config| cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: false cfg.vm.provision "shell", inline: 'wevtutil el | Select-String -notmatch "Microsoft-Windows-LiveId" | Foreach-Object {wevtutil cl "$_"}', privileged: false cfg.vm.provision "shell", inline: "Set-SmbServerConfiguration -AuditSmb1Access $true -Force", privileged: false - cfg.vm.provision "shell", inline: "cscript c:\\windows\\system32\\slmgr.vbs -rearm", privileged: false cfg.vm.provider "vmware_desktop" do |v, override| v.vmx["displayname"] = "dc.windomain.local" @@ -92,6 +91,7 @@ Vagrant.configure("2") do |config| cfg.vm.provision "shell", path: "scripts/fix-second-network.ps1", privileged: false, args: "-ip 192.168.38.103 -dns 192.168.38.102" cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false + cfg.vm.provision "shell", inline: "cscript c:\\windows\\system32\\slmgr.vbs -rearm", privileged: false cfg.vm.provision "reload" cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false cfg.vm.provision "shell", path: "scripts/download_palantir_wef.ps1", privileged: false @@ -109,7 +109,6 @@ Vagrant.configure("2") do |config| cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: false cfg.vm.provision "shell", inline: "Set-SmbServerConfiguration -AuditSmb1Access $true -Force", privileged: false cfg.vm.provision "shell", path: "scripts/install-microsoft-ata.ps1", privileged: false - cfg.vm.provision "shell", inline: "cscript c:\\windows\\system32\\slmgr.vbs -rearm", privileged: false cfg.vm.provider "vmware_desktop" do |v, override| v.vmx["displayname"] = "wef.windomain.local" @@ -145,6 +144,7 @@ Vagrant.configure("2") do |config| cfg.vm.provision "shell", path: "scripts/fix-second-network.ps1", privileged: false, args: "-ip 192.168.38.104 -dns 192.168.38.102" cfg.vm.provision "shell", path: "scripts/MakeWindows10GreatAgain.ps1", privileged: false cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false + cfg.vm.provision "shell", inline: "cscript c:\\windows\\system32\\slmgr.vbs -rearm", privileged: false cfg.vm.provision "reload" cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false cfg.vm.provision "shell", path: "scripts/download_palantir_wef.ps1", privileged: false @@ -156,7 +156,6 @@ Vagrant.configure("2") do |config| cfg.vm.provision "shell", path: "scripts/install-osquery.ps1", privileged: false cfg.vm.provision "shell", path: "scripts/install-sysinternals.ps1", privileged: false cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: false - cfg.vm.provision "shell", inline: "cscript c:\\windows\\system32\\slmgr.vbs -rearm", privileged: false cfg.vm.provider "vmware_desktop" do |v, override| v.vmx["displayname"] = "win10.windomain.local" diff --git a/Vagrant/resources/GPO/reports/Custom Event Channel Permissions.htm b/Vagrant/resources/GPO/reports/Custom Event Channel Permissions.htm old mode 100644 new mode 100755 index 7db032b3234366d3898c22404e87de41cb7b63d0..a192d95788c84e32f0c043247ab7b2d2718079e3 GIT binary patch delta 357 zcmX>%g>%7j&W0_FeP0y~8H^b88BBoKh{1rtkin8cfx(o)ioqDjwgO_a?d!iX{$x?d zrp^Sc&KO7I7z1|1;VeEQAbjKR~7{b5w|GzMB@26Un^(1}Js6}mvSDT5o3uM6~o8-o+jA-X`) z87Sun7K3=n5XiRxsx=4dHUjFXML2VN*ogB0z3CqmnPjG)VP{g9_McH= Qy21}emhJOAm^Ls106>dR^8f$< delta 311 zcmZ3mob%ii&W0_FeP0#L8T1*97$BqpgCUTmz+k~(#b5vw1(Vy?e`Wm1q7G4E23C!% z&WOPTsLqJN45%-F!FT#X9wznaAAT}QO&9phs6?8!hTn{jrl0uDm@@s?A4WA#GX^&X zQwB$%lgxq6v0%^z(iT8y24tB4<=hxtfh;EmV<2_|vW$RyOQ0HoadXP}pA5sunk z_LotHdHR~4j6&0A0g0(6n8K!?`pGCUJ%*7OY7ytkO diff --git a/Vagrant/resources/GPO/reports/Default Domain Controllers Policy.htm b/Vagrant/resources/GPO/reports/Default Domain Controllers Policy.htm old mode 100644 new mode 100755 index e50193da1a1ea7efb94b9c9fc614bb715dd7a1b5..deb6612b2d3e8f2a511f1c546a04f4e3d435bd59 GIT binary patch delta 165 zcmdn>hGW+oj)pCalfEh%G8i%FGnfFe5rYAPA%i7@0)r`o6%d<)Nt5lHzcRA2s$)}U w0#pIg1tN`r`WzX2ryt~GQlCEIH>1>ah2M-yBx&0Y)V7R~(QUi=Uq)t20KH=%$^ZZW delta 165 zcmdn>hGW+oj)pCalfEjNGw3rIF+fNI216iAfx&{oiopOVYQ + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 bd d8 5d 55 72 8b b8 b4 bb d9 f7 34 e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 bd d8 5d 55 72 8b b8 b4 bb d9 f7 34 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 bd d8 5d 55 72 8b b8 b4 bb d9 f7 34 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml b/Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml old mode 100644 new mode 100755 similarity index 84% rename from Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml rename to Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml index ad42d31..6430a1f --- a/Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml +++ b/Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml @@ -2,6 +2,7 @@ + diff --git a/Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/bkupInfo.xml b/Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/bkupInfo.xml new file mode 100755 index 0000000..7e8fa51 --- /dev/null +++ b/Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/gpreport.xml b/Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/gpreport.xml old mode 100644 new mode 100755 similarity index 84% rename from Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/gpreport.xml rename to Vagrant/resources/GPO/wef_configuration/{1C916D7C-52F4-4EB4-8EA7-081349532B3C}/gpreport.xml index 5012f4c3968b85f611f2f3cb8a9d62876abb64b3..6b424f9265a6f9695597b5077ed14abaa2bd4104 GIT binary patch delta 1076 zcmbtTK}%Fo6#nkaa~v{9Y-nL2NiKBrY~H+i<2)N>9LHd&q+tq~7#poN7A0y56*4;o zp+y~N*&BOg?+Png3) zo2eOGH+F=CE=G`&MXP-7D8ggR;~)aA{Itfs<1jukF0UOTGHdS1nJ?T#9v4KlCFOS8 zkBbg(cKL=h5$?Ya+VsfI6Q3i9rpzmY{GbRPEwQo^`yMKPqy2rDe7z9wwn7nnI@uAK z3{e4A!DcmBIr-JoE4u^hFR}^U>PkfQLC?KTePw7b7V3fB$!{^)KNXJT*}&)UB$vIN zb~P+^y-M4x-;slvm~M@pNJ^rx+C1EYee9P*eTwtw!wTkc7o+r_8rcN$Nt{)GonHvn@ z=jsl28rS$$`$liG&X1RN6+X8(FLARuEK5u{sP?Q2jL1PeZ&h(xRxr~3;0LW!mzTaJ L%t93wU - 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 c3 ba 37 ad 66 a9 3f 6a cb ef b8 9d e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 c3 ba 37 ad 66 a9 3f 6a cb ef b8 9d 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 c3 ba 37 ad 66 a9 3f 6a cb ef b8 9d 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/bkupInfo.xml b/Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/bkupInfo.xml deleted file mode 100644 index efa3bbc..0000000 --- a/Vagrant/resources/GPO/wef_configuration/{AE232F63-0190-47EE-BAF9-B78754178376}/bkupInfo.xml +++ /dev/null @@ -1 +0,0 @@ -