trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Modify the schema of Sysmon Schema to 4.0

Browse Source 
Addresses https://github.com/clong/DetectionLab/issues/38
This commit is contained in:
Chris Long
2018-01-16 19:48:31 -08:00
committed by GitHub
parent 621f714917
commit d431d007a4
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
Vagrant/scripts/install-sysinternals.ps1
View File

@@ -33,7 +33,10 @@ Invoke-WebRequest -Uri "https://live.sysinternals.com/Tcpview.exe" -Outfile $tcp
Copy-Item $sysmonPath $sysmonDir
# Download SwiftOnSecurity's Sysmon config
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml" -Outfile "$sysmonDir\sysmonConfig.xml"
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml" -Outfile "$sysmonConfigPath"
# Convert Sysmon config schema from 3.30 to 4.0 per GitHub Issue #38
(Get-Content $sysmonConfigPath) -replace 'schemaversion="3.30"', 'schemaversion="4.00"' | Set-Content $sysmonConfigPath
# Startup Sysmon
Write-Host "Starting Sysmon..."