29 lines
1.6 KiB
PowerShell
29 lines
1.6 KiB
PowerShell
$script = @'
|
|
$ErrorActionPreference = 'Stop'
|
|
Write-Host "[*] Searching for Sysmon Service path..."
|
|
$sysmonSvc = Get-CimInstance Win32_Service -Filter "Name like 'Sysmon%'" | Select-Object -First 1
|
|
if (-not $sysmonSvc) { Write-Host "Error: Sysmon service is not installed on this machine!" -ForegroundColor Red; exit 1 }
|
|
$sysmonExe = $sysmonSvc.PathName -replace '"', ''
|
|
Write-Host "[*] Found Sysmon at $sysmonExe"
|
|
Write-Host "[*] Downloading latest SwiftOnSecurity config..."
|
|
$xmlPath = "$env:TEMP\sysmon_soar.xml"
|
|
Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml' -OutFile $xmlPath
|
|
[xml]$xml = Get-Content $xmlPath
|
|
Write-Host "[*] Patching Network & DNS Logging rules..."
|
|
$xml.SelectNodes('//RuleGroup/NetworkConnect') | ForEach-Object { $_.ParentNode.RemoveChild($_) | Out-Null }
|
|
$xml.SelectNodes('//RuleGroup/DnsQuery') | ForEach-Object { $_.ParentNode.RemoveChild($_) | Out-Null }
|
|
$newNet = $xml.CreateElement('NetworkConnect')
|
|
$newNet.SetAttribute('onmatch', 'exclude')
|
|
$xml.SelectSingleNode('//EventFiltering').AppendChild($newNet) | Out-Null
|
|
$newDns = $xml.CreateElement('DnsQuery')
|
|
$newDns.SetAttribute('onmatch', 'exclude')
|
|
$xml.SelectSingleNode('//EventFiltering').AppendChild($newDns) | Out-Null
|
|
$xml.Save($xmlPath)
|
|
Write-Host "[*] Applying configuration to Sysmon..."
|
|
Start-Process -FilePath $sysmonExe -ArgumentList "-c `"$xmlPath`"" -Wait -NoNewWindow
|
|
'@
|
|
$bytes = [System.Text.Encoding]::Unicode.GetBytes($script)
|
|
$b64 = [Convert]::ToBase64String($bytes)
|
|
$bat = "@echo off`ncolor 0B`npowershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand $b64`npause"
|
|
Set-Content "auto_update_sysmon.bat" $bat
|