36 lines
1.9 KiB
Batchfile
36 lines
1.9 KiB
Batchfile
@echo off
|
|
echo ===================================================
|
|
echo Sysmon Configuration Updater for L7 Network Log
|
|
echo ===================================================
|
|
echo.
|
|
|
|
set "PS_SCRIPT=%TEMP%\update_sysmon_script.ps1"
|
|
|
|
echo $ErrorActionPreference = 'Stop' > "%PS_SCRIPT%"
|
|
echo $xmlPath = 'C:\sysmon\sysmonconfig.xml' >> "%PS_SCRIPT%"
|
|
echo if (-not (Test-Path $xmlPath)) { Write-Host "Error: Could not find $xmlPath"; exit 1 } >> "%PS_SCRIPT%"
|
|
echo [xml]$xml = Get-Content -Path $xmlPath >> "%PS_SCRIPT%"
|
|
echo Write-Host "[*] Removing old NetworkConnect rules..." >> "%PS_SCRIPT%"
|
|
echo $networkNodes = $xml.SelectNodes('//RuleGroup/NetworkConnect') >> "%PS_SCRIPT%"
|
|
echo foreach ($node in $networkNodes) { $node.ParentNode.RemoveChild($node) ^| Out-Null } >> "%PS_SCRIPT%"
|
|
echo Write-Host "[*] Removing old DnsQuery rules..." >> "%PS_SCRIPT%"
|
|
echo $dnsNodes = $xml.SelectNodes('//RuleGroup/DnsQuery') >> "%PS_SCRIPT%"
|
|
echo foreach ($node in $dnsNodes) { $node.ParentNode.RemoveChild($node) ^| Out-Null } >> "%PS_SCRIPT%"
|
|
echo Write-Host "[*] Adding new aggressive logging rules..." >> "%PS_SCRIPT%"
|
|
echo $newNet = $xml.CreateElement('NetworkConnect') >> "%PS_SCRIPT%"
|
|
echo $newNet.SetAttribute('onmatch', 'exclude') >> "%PS_SCRIPT%"
|
|
echo $xml.SelectSingleNode('//EventFiltering').AppendChild($newNet) ^| Out-Null >> "%PS_SCRIPT%"
|
|
echo $newDns = $xml.CreateElement('DnsQuery') >> "%PS_SCRIPT%"
|
|
echo $newDns.SetAttribute('onmatch', 'exclude') >> "%PS_SCRIPT%"
|
|
echo $xml.SelectSingleNode('//EventFiltering').AppendChild($newDns) ^| Out-Null >> "%PS_SCRIPT%"
|
|
echo $xml.Save($xmlPath) >> "%PS_SCRIPT%"
|
|
echo Write-Host "[*] Configuration saved to $xmlPath" -ForegroundColor Green >> "%PS_SCRIPT%"
|
|
echo Write-Host "[*] Reloading Sysmon config..." >> "%PS_SCRIPT%"
|
|
echo ^& sysmon -c $xmlPath >> "%PS_SCRIPT%"
|
|
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File "%PS_SCRIPT%"
|
|
|
|
echo.
|
|
del "%PS_SCRIPT%"
|
|
pause
|