@echo off
color 0B
echo ===================================================
echo Auto Sysmon Configuration Updater for L7 Network
echo ===================================================
echo.

set "PS_SCRIPT=%TEMP%\update_sysmon_script.ps1"

echo $ErrorActionPreference = 'Stop' > "%PS_SCRIPT%"
echo Write-Host "[*] Searching for Sysmon Service path..." >> "%PS_SCRIPT%"
echo $sysmonSvc = Get-CimInstance Win32_Service -Filter "Name like 'Sysmon%'" ^| Select-Object -First 1 >> "%PS_SCRIPT%"
echo if (-not $sysmonSvc) { Write-Host "Error: Sysmon service is not installed!" -ForegroundColor Red; exit 1 } >> "%PS_SCRIPT%"
echo $sysmonExe = $sysmonSvc.PathName -replace '\"', '' >> "%PS_SCRIPT%"
echo Write-Host "[*] Downloading latest SwiftOnSecurity config..." >> "%PS_SCRIPT%"
echo $xmlPath = "$env:TEMP\sysmon_soar.xml" >> "%PS_SCRIPT%"
echo Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml' -OutFile $xmlPath >> "%PS_SCRIPT%"
echo [xml]$xml = Get-Content $xmlPath >> "%PS_SCRIPT%"
echo Write-Host "[*] Patching Network & DNS Logging rules..." >> "%PS_SCRIPT%"
echo $xml.SelectNodes('//RuleGroup/NetworkConnect') ^| ForEach-Object { $_.ParentNode.RemoveChild($_) ^| Out-Null } >> "%PS_SCRIPT%"
echo $xml.SelectNodes('//RuleGroup/DnsQuery') ^| ForEach-Object { $_.ParentNode.RemoveChild($_) ^| Out-Null } >> "%PS_SCRIPT%"
echo $newNet = $xml.CreateElement('NetworkConnect') >> "%PS_SCRIPT%"
echo $newNet.SetAttribute('onmatch', 'exclude') >> "%PS_SCRIPT%"
echo $xml.SelectSingleNode('//EventFiltering').AppendChild($newNet) ^| Out-Null >> "%PS_SCRIPT%"
echo $newDns = $xml.CreateElement('DnsQuery') >> "%PS_SCRIPT%"
echo $newDns.SetAttribute('onmatch', 'exclude') >> "%PS_SCRIPT%"
echo $xml.SelectSingleNode('//EventFiltering').AppendChild($newDns) ^| Out-Null >> "%PS_SCRIPT%"
echo $xml.Save($xmlPath) >> "%PS_SCRIPT%"
echo Write-Host "[*] Applying configuration to Sysmon..." >> "%PS_SCRIPT%"
echo ^& $sysmonExe -c $xmlPath >> "%PS_SCRIPT%"

powershell -NoProfile -ExecutionPolicy Bypass -File "%PS_SCRIPT%"

echo.
del "%PS_SCRIPT%"
echo ===================================================
echo [*] Update Complete! 
echo ===================================================
pause