trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added olafhartong sysmon-modular config

Browse Source
This commit is contained in:
Olaf Hartong
2018-05-13 11:42:27 +02:00
parent 53ca340244
commit f2545eef50
1 changed files with 2 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
Vagrant/scripts/install-sysinternals.ps1
View File

@@ -32,14 +32,8 @@ Invoke-WebRequest -Uri "https://live.sysinternals.com/Sysmon64.exe" -Outfile $sy
Invoke-WebRequest -Uri "https://live.sysinternals.com/Tcpview.exe" -Outfile $tcpviewPath Invoke-WebRequest -Uri "https://live.sysinternals.com/Tcpview.exe" -Outfile $tcpviewPath
Copy-Item $sysmonPath $sysmonDir Copy-Item $sysmonPath $sysmonDir
# Download SwiftOnSecurity's Sysmon config # Download Olaf Hartong's Sysmon config
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml" -Outfile "$sysmonConfigPath" Invoke-WebRequest -Uri "https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig.xml" -Outfile "$sysmonConfigPath"
# Convert Sysmon config schema from 3.30 to 4.0 per GitHub Issue #38
(Get-Content $sysmonConfigPath) -replace 'schemaversion="3.30"', 'schemaversion="4.00"' | Set-Content $sysmonConfigPath
# Convert Schema from 3.30 to 4.0 per GitHub Issue #38
(Get-Content $sysmonConfigPath) -replace 'schemaversion="3.30"', 'schemaversion="4.00"' | Set-Content $sysmonConfigPath
# Startup Sysmon # Startup Sysmon
Write-Host "Starting Sysmon..." Write-Host "Starting Sysmon..."