23 lines
1.4 KiB
PowerShell
23 lines
1.4 KiB
PowerShell
$ErrorActionPreference = 'Stop'
|
|
Write-Host "[*] Searching for Sysmon Service path..."
|
|
$sysmonSvc = Get-CimInstance Win32_Service -Filter "Name like 'Sysmon%'" | Select-Object -First 1
|
|
if (-not $sysmonSvc) { Write-Host "Error: Sysmon service is not installed on this machine!" -ForegroundColor Red; exit 1 }
|
|
$sysmonExe = $sysmonSvc.PathName -replace '"', ''
|
|
Write-Host "[*] Found Sysmon at $sysmonExe"
|
|
Write-Host "[*] Downloading latest SwiftOnSecurity config..."
|
|
$xmlPath = "$env:TEMP\sysmon_soar.xml"
|
|
Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml' -OutFile $xmlPath
|
|
[xml]$xml = Get-Content $xmlPath
|
|
Write-Host "[*] Patching Network & DNS Logging rules..."
|
|
$xml.SelectNodes('//RuleGroup/NetworkConnect') | ForEach-Object { $_.ParentNode.RemoveChild($_) | Out-Null }
|
|
$xml.SelectNodes('//RuleGroup/DnsQuery') | ForEach-Object { $_.ParentNode.RemoveChild($_) | Out-Null }
|
|
$newNet = $xml.CreateElement('NetworkConnect')
|
|
$newNet.SetAttribute('onmatch', 'exclude')
|
|
$xml.SelectSingleNode('//EventFiltering').AppendChild($newNet) | Out-Null
|
|
$newDns = $xml.CreateElement('DnsQuery')
|
|
$newDns.SetAttribute('onmatch', 'exclude')
|
|
$xml.SelectSingleNode('//EventFiltering').AppendChild($newDns) | Out-Null
|
|
$xml.Save($xmlPath)
|
|
Write-Host "[*] Applying configuration to Sysmon..."
|
|
Start-Process -FilePath $sysmonExe -ArgumentList "-c `"$xmlPath`"" -Wait -NoNewWindow
|