49 lines
2.3 KiB
Batchfile
49 lines
2.3 KiB
Batchfile
@echo off
|
|
color 0B
|
|
echo ===================================================
|
|
echo Auto Sysmon Configuration Updater for L7 Network
|
|
echo ===================================================
|
|
echo.
|
|
|
|
set "PS_SCRIPT=%TEMP%\sysmon_updater.ps1"
|
|
|
|
echo $ErrorActionPreference = 'Stop' > "%PS_SCRIPT%"
|
|
echo Write-Host "[*] Searching for Sysmon Service..." >> "%PS_SCRIPT%"
|
|
echo $sysmonSvc = Get-CimInstance Win32_Service -Filter "Name like 'Sysmon%%'" >> "%PS_SCRIPT%"
|
|
echo if (-not $sysmonSvc) { Write-Host "Error: Sysmon service not found!" -ForegroundColor Red; exit 1 } >> "%PS_SCRIPT%"
|
|
echo $sysmonExe = $sysmonSvc[0].PathName -replace '\"', '' >> "%PS_SCRIPT%"
|
|
|
|
echo Write-Host "[*] Downloading SwiftOnSecurity config..." >> "%PS_SCRIPT%"
|
|
echo $xmlPath = "$env:TEMP\sysmon_soar.xml" >> "%PS_SCRIPT%"
|
|
echo Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml' -OutFile $xmlPath >> "%PS_SCRIPT%"
|
|
echo [xml]$xml = Get-Content $xmlPath >> "%PS_SCRIPT%"
|
|
|
|
echo Write-Host "[*] Patching Network and DNS Logging rules..." >> "%PS_SCRIPT%"
|
|
echo $netNodes = $xml.SelectNodes('//RuleGroup/NetworkConnect') >> "%PS_SCRIPT%"
|
|
echo foreach ($node in $netNodes) { $null = $node.ParentNode.RemoveChild($node) } >> "%PS_SCRIPT%"
|
|
|
|
echo $dnsNodes = $xml.SelectNodes('//RuleGroup/DnsQuery') >> "%PS_SCRIPT%"
|
|
echo foreach ($node in $dnsNodes) { $null = $node.ParentNode.RemoveChild($node) } >> "%PS_SCRIPT%"
|
|
|
|
echo $newNet = $xml.CreateElement('NetworkConnect') >> "%PS_SCRIPT%"
|
|
echo $newNet.SetAttribute('onmatch', 'exclude') >> "%PS_SCRIPT%"
|
|
echo $null = $xml.SelectSingleNode('//EventFiltering').AppendChild($newNet) >> "%PS_SCRIPT%"
|
|
|
|
echo $newDns = $xml.CreateElement('DnsQuery') >> "%PS_SCRIPT%"
|
|
echo $newDns.SetAttribute('onmatch', 'exclude') >> "%PS_SCRIPT%"
|
|
echo $null = $xml.SelectSingleNode('//EventFiltering').AppendChild($newDns) >> "%PS_SCRIPT%"
|
|
|
|
echo $xml.Save($xmlPath) >> "%PS_SCRIPT%"
|
|
|
|
echo Write-Host "[*] Applying configuration to Sysmon..." >> "%PS_SCRIPT%"
|
|
echo Start-Process -FilePath $sysmonExe -ArgumentList "-c `"$xmlPath`"" -Wait -NoNewWindow >> "%PS_SCRIPT%"
|
|
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File "%PS_SCRIPT%"
|
|
|
|
echo.
|
|
del "%PS_SCRIPT%"
|
|
echo ===================================================
|
|
echo [*] Update Complete!
|
|
echo ===================================================
|
|
pause
|