24 lines
1.1 KiB
PowerShell
24 lines
1.1 KiB
PowerShell
[xml]$xml = Get-Content "sysmonconfig.xml"
|
|
|
|
# Remove all existing NetworkConnect and DnsQuery
|
|
$xml.SelectNodes("//NetworkConnect") | ForEach-Object { [void]$_.ParentNode.RemoveChild($_) }
|
|
$xml.SelectNodes("//DnsQuery") | ForEach-Object { [void]$_.ParentNode.RemoveChild($_) }
|
|
|
|
# Create a new RuleGroup
|
|
$ruleGroup = $xml.CreateElement("RuleGroup")
|
|
$ruleGroup.SetAttribute("name", "AggressiveNetwork")
|
|
$ruleGroup.SetAttribute("groupRelation", "or")
|
|
|
|
$netNode = $xml.CreateElement("NetworkConnect")
|
|
$netNode.SetAttribute("onmatch", "exclude")
|
|
$netNode.InnerXml = "<DestinationIp condition='is'>127.0.0.1</DestinationIp><SourceIp condition='is'>127.0.0.1</SourceIp><DestinationIp condition='begin with'>192.168.</DestinationIp><DestinationIp condition='begin with'>10.</DestinationIp>"
|
|
[void]$ruleGroup.AppendChild($netNode)
|
|
|
|
$dnsNode = $xml.CreateElement("DnsQuery")
|
|
$dnsNode.SetAttribute("onmatch", "exclude")
|
|
$dnsNode.InnerXml = "<QueryName condition='end with'>.arpa</QueryName><QueryName condition='end with'>.local</QueryName>"
|
|
[void]$ruleGroup.AppendChild($dnsNode)
|
|
|
|
[void]$xml.Sysmon.EventFiltering.AppendChild($ruleGroup)
|
|
$xml.Save("sysmon_tuned.xml")
|