$ErrorActionPreference = 'Stop'
Write-Host "[*] Searching for Sysmon Service path..."
$sysmonSvc = Get-CimInstance Win32_Service -Filter "Name like 'Sysmon%'" | Select-Object -First 1
if (-not $sysmonSvc) { Write-Host "Error: Sysmon service is not installed on this machine!" -ForegroundColor Red; exit 1 }
$sysmonExe = $sysmonSvc.PathName -replace '"', ''
Write-Host "[*] Found Sysmon at $sysmonExe"
Write-Host "[*] Downloading latest SwiftOnSecurity config..."
$xmlPath = "$env:TEMP\sysmon_soar.xml"
Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml' -OutFile $xmlPath
[xml]$xml = Get-Content $xmlPath
Write-Host "[*] Patching Network & DNS Logging rules..."
$xml.SelectNodes('//RuleGroup/NetworkConnect') | ForEach-Object { $_.ParentNode.RemoveChild($_) | Out-Null }
$xml.SelectNodes('//RuleGroup/DnsQuery') | ForEach-Object { $_.ParentNode.RemoveChild($_) | Out-Null }
$newNet = $xml.CreateElement('NetworkConnect')
$newNet.SetAttribute('onmatch', 'exclude')
$xml.SelectSingleNode('//EventFiltering').AppendChild($newNet) | Out-Null
$newDns = $xml.CreateElement('DnsQuery')
$newDns.SetAttribute('onmatch', 'exclude')
$xml.SelectSingleNode('//EventFiltering').AppendChild($newDns) | Out-Null
$xml.Save($xmlPath)
Write-Host "[*] Applying configuration to Sysmon..."
Start-Process -FilePath $sysmonExe -ArgumentList "-c `"$xmlPath`"" -Wait -NoNewWindow