Porawit/gravity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Porawit Dongwang
2026-09-16 23:20:08 +07:00
commit 0041668dbb
32577 changed files with 3687927 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ระบบ SOAR integration ร่วมกับ Wazuh/update_sysmon_v3.bat
+43
View File
@@ -0,0 +1,43 @@
@echo off
echo ===================================================
echo Sysmon Configuration Updater for L7 Network Log
echo ===================================================
echo.
:: สร้างไฟล์ Script ชั่วคราว
set "PS_SCRIPT=%TEMP%\update_sysmon_script.ps1"
echo $ErrorActionPreference = 'Stop' > "%PS_SCRIPT%"
echo $possiblePaths = @('C:\sysmon\sysmonconfig.xml', 'C:\Windows\sysmonconfig.xml', 'C:\sysmonconfig.xml', '.\sysmonconfig.xml') >> "%PS_SCRIPT%"
echo $xmlPath = $null >> "%PS_SCRIPT%"
echo foreach ($p in $possiblePaths) { if (Test-Path $p) { $xmlPath = $p; break } } >> "%PS_SCRIPT%"
echo if (-not $xmlPath) { >> "%PS_SCRIPT%"
echo $xmlPath = Read-Host "Could not find sysmonconfig.xml automatically. Please enter the full path to your Sysmon config XML file" >> "%PS_SCRIPT%"
echo if (-not (Test-Path $xmlPath)) { Write-Host "Error: File still not found. Exiting."; exit 1 } >> "%PS_SCRIPT%"
echo } >> "%PS_SCRIPT%"
echo Write-Host "[*] Found configuration at: $xmlPath" -ForegroundColor Cyan >> "%PS_SCRIPT%"
echo [xml]$xml = Get-Content -Path $xmlPath >> "%PS_SCRIPT%"
echo Write-Host "[*] Removing old NetworkConnect rules..." >> "%PS_SCRIPT%"
echo $networkNodes = $xml.SelectNodes('//RuleGroup/NetworkConnect') >> "%PS_SCRIPT%"
echo foreach ($node in $networkNodes) { $node.ParentNode.RemoveChild($node) ^| Out-Null } >> "%PS_SCRIPT%"
echo Write-Host "[*] Removing old DnsQuery rules..." >> "%PS_SCRIPT%"
echo $dnsNodes = $xml.SelectNodes('//RuleGroup/DnsQuery') >> "%PS_SCRIPT%"
echo foreach ($node in $dnsNodes) { $node.ParentNode.RemoveChild($node) ^| Out-Null } >> "%PS_SCRIPT%"
echo Write-Host "[*] Adding new aggressive logging rules..." >> "%PS_SCRIPT%"
echo $newNet = $xml.CreateElement('NetworkConnect') >> "%PS_SCRIPT%"
echo $newNet.SetAttribute('onmatch', 'exclude') >> "%PS_SCRIPT%"
echo $xml.SelectSingleNode('//EventFiltering').AppendChild($newNet) ^| Out-Null >> "%PS_SCRIPT%"
echo $newDns = $xml.CreateElement('DnsQuery') >> "%PS_SCRIPT%"
echo $newDns.SetAttribute('onmatch', 'exclude') >> "%PS_SCRIPT%"
echo $xml.SelectSingleNode('//EventFiltering').AppendChild($newDns) ^| Out-Null >> "%PS_SCRIPT%"
echo $xml.Save($xmlPath) >> "%PS_SCRIPT%"
echo Write-Host "[*] Configuration saved to $xmlPath" -ForegroundColor Green >> "%PS_SCRIPT%"
echo Write-Host "[*] Reloading Sysmon config..." >> "%PS_SCRIPT%"
echo ^& sysmon -c $xmlPath >> "%PS_SCRIPT%"
:: รัน Script ที่สร้างขึ้นมา
powershell -NoProfile -ExecutionPolicy Bypass -File "%PS_SCRIPT%"
echo.
del "%PS_SCRIPT%"
pause