From d431d007a42f5503bb3872bc0751f349ce942311 Mon Sep 17 00:00:00 2001 From: Chris Long Date: Tue, 16 Jan 2018 19:48:31 -0800 Subject: [PATCH] Modify the schema of Sysmon Schema to 4.0 Addresses https://github.com/clong/DetectionLab/issues/38 --- Vagrant/scripts/install-sysinternals.ps1 | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Vagrant/scripts/install-sysinternals.ps1 b/Vagrant/scripts/install-sysinternals.ps1 index d557aa3..7885e14 100755 --- a/Vagrant/scripts/install-sysinternals.ps1 +++ b/Vagrant/scripts/install-sysinternals.ps1 @@ -33,7 +33,10 @@ Invoke-WebRequest -Uri "https://live.sysinternals.com/Tcpview.exe" -Outfile $tcp Copy-Item $sysmonPath $sysmonDir # Download SwiftOnSecurity's Sysmon config -Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml" -Outfile "$sysmonDir\sysmonConfig.xml" +Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml" -Outfile "$sysmonConfigPath" + +# Convert Sysmon config schema from 3.30 to 4.0 per GitHub Issue #38 +(Get-Content $sysmonConfigPath) -replace 'schemaversion="3.30"', 'schemaversion="4.00"' | Set-Content $sysmonConfigPath # Startup Sysmon Write-Host "Starting Sysmon..."