### Generate Config with Verbose Logging Source: https://github.com/olafhartong/sysmon-modular/blob/master/README.md Example of building a custom configuration while enabling verbose logging and preserving XML comments. ```PowerShell $sysmonconfig = Merge-AllSysmonXml -BasePath . -IncludeList $workingFolder\include.txt -VerboseLogging -PreserveComments ``` -------------------------------- ### Advanced Sysmon Configuration Filtering Source: https://github.com/olafhartong/sysmon-modular/blob/master/README.md Examples of using advanced parameters like -BasePath, -ExcludeList, and -IncludeList to tailor the generated Sysmon configuration to specific environment requirements. ```PowerShell # Find rules based on path Find-RulesInBasePath -BasePath C:\users\sysmon\sysmon-modular\ -OutputRules | Out-File available_rules.txt # Merge using BasePath Merge-AllSysmonXml -AsString -BasePath C:\Users\sysmon\sysmon-modular\ # Merge with ExcludeList Merge-AllSysmonXml -AsString -BasePath C:\Users\sysmon\sysmon-modular\ -ExcludeList C:\users\sysmon\sysmon-modular\exclude_rules.txt # Merge with IncludeList Merge-AllSysmonXml -AsString -BasePath C:\Users\sysmon\sysmon-modular\ -IncludeList C:\users\sysmon\sysmon-modular\include_rules.txt ``` -------------------------------- ### Manage Sysmon Service via CLI Source: https://github.com/olafhartong/sysmon-modular/blob/master/README.md Commands to install or update the Sysmon service using a configuration file. These commands require administrative privileges to modify system-level event tracing. ```Batch :: Install configuration sysmon.exe -accepteula -i sysmonconfig.xml :: Update existing configuration sysmon.exe -c sysmonconfig.xml ``` -------------------------------- ### Deploy and Update Sysmon Configuration Source: https://context7.com/olafhartong/sysmon-modular/llms.txt Commands to install or update the Sysmon service with a specific XML configuration file. Requires administrative privileges to execute. ```powershell # Install Sysmon with a new configuration sysmon.exe -accepteula -i sysmonconfig.xml # Update an existing Sysmon installation with a new configuration sysmon.exe -c sysmonconfig.xml ``` -------------------------------- ### Generate Sysmon Configuration via PowerShell Source: https://github.com/olafhartong/sysmon-modular/blob/master/README.md Demonstrates the basic workflow to clone the repository and merge all modular XML rules into a single output file using the Merge-SysmonXml script. ```PowerShell git clone https://github.com/olafhartong/sysmon-modular.git cd sysmon-modular . .\Merge-SysmonXml.ps1 Merge-AllSysmonXml -Path ( Get-ChildItem '[0-9]*\*.xml') -AsString | Out-File sysmonconfig.xml ``` -------------------------------- ### Deploy Pre-Generated Configuration Source: https://context7.com/olafhartong/sysmon-modular/llms.txt Downloads a pre-built Sysmon configuration and applies it to the local system using the Sysmon executable. ```powershell Invoke-WebRequest -Uri "https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig.xml" -OutFile sysmonconfig.xml sysmon.exe -c sysmonconfig.xml ``` -------------------------------- ### Download Sysmon Configurations using Invoke-WebRequest Source: https://context7.com/olafhartong/sysmon-modular/llms.txt These commands use PowerShell's Invoke-WebRequest cmdlet to download different Sysmon configuration files from the sysmon-modular GitHub repository. Each command specifies a unique URL for a specific configuration and an output file name. ```powershell Invoke-WebRequest -Uri "https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig-with-filedelete.xml" -OutFile sysmonconfig-with-filedelete.xml Invoke-WebRequest -Uri "https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig-excludes-only.xml" -OutFile sysmonconfig-excludes-only.xml Invoke-WebRequest -Uri "https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig-research.xml" -OutFile sysmonconfig-research.xml Invoke-WebRequest -Uri "https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig-mde-augment.xml" -OutFile sysmonconfig-mde-augment.xml ``` -------------------------------- ### Manage Custom Sysmon Configurations Source: https://github.com/olafhartong/sysmon-modular/wiki/Configuration-options Provides commands to find available rule modules and merge them using specific include or exclude lists to tailor the configuration to environment needs. ```Powershell Find-RulesInBasePath -BasePath .\ -OutputRules | Out-File available_modules.txt # Merge using BasePath Merge-AllSysmonXml -AsString -BasePath .\ # Merge with ExcludeList Merge-AllSysmonXml -AsString -BasePath C:\sysmon-modular\ -ExcludeList .\0_custom_configuration\exclude_rules.txt # Merge with IncludeList Merge-AllSysmonXml -AsString -BasePath .\ -IncludeList .\0_custom_configuration\include_rules.txt ``` -------------------------------- ### Automated Environment Tuning with PowerShell Source: https://context7.com/olafhartong/sysmon-modular/llms.txt A PowerShell script to generate configurations and programmatically disable empty rule groups to reduce noise in the final Sysmon configuration. ```powershell . .\Merge-SysmonXml.ps1 $sysmonconfig = Merge-AllSysmonXml -BasePath . -IncludeList .\include.txt -VerboseLogging -PreserveComments foreach($rg in $sysmonconfig.SelectNodes("/Sysmon/EventFiltering/RuleGroup [*/@onmatch]")) { $ruleNodes = $rg.SelectNodes("./* [@onmatch]") if ($ruleNodes -eq $null -or $ruleNodes.ChildNodes.count -gt 0) { continue } $ruleNode = $ruleNodes[0] if ($ruleNode.onmatch -eq "exclude" -and $ruleNode.ChildNodes.count -eq 0) { $message = "{0} {1} has no matching conditions. Toggled to 'include' to limit output" -f $ruleNode.Name, $rg.Name Write-Warning $message $ruleNode.onmatch = "include" $comment = $sysmonconfig.CreateComment($message) $rg.AppendChild($comment) | Out-Null } } $sysmonconfig.Save(".\sysmonconfig-custom.xml") ``` -------------------------------- ### Merge Sysmon Configurations with Python Source: https://github.com/olafhartong/sysmon-modular/blob/master/README.md A Python-based utility to merge multiple Sysmon configuration files based on a CSV file containing file paths and priority levels. It preserves XML formatting and comments while enforcing dynamic schema versioning. ```Bash python merge_sysmon_configs.py config_lists/default_list/default_list.csv -f csv -b templates/sysmon_template.xml -o test.xml ``` -------------------------------- ### Generate Full Sysmon Configuration Source: https://github.com/olafhartong/sysmon-modular/wiki/Configuration-options Generates a comprehensive configuration file that includes all available modules, including high-volume events like FileDelete. ```Powershell git clone https://github.com/olafhartong/sysmon-modular.git cd sysmon-modular . .\Merge-SysmonXml.ps1 Merge-AllSysmonXml -Path ( Get-ChildItem '[0-9]*\*.xml') -AsString | Out-File -Encoding utf8 sysmonconfig-with-deletes.xml ``` -------------------------------- ### Discover Available Rule Modules Source: https://context7.com/olafhartong/sysmon-modular/llms.txt Scans a directory to identify valid Sysmon XML rule files. This is useful for auditing available detection coverage or generating lists for inclusion/exclusion. ```powershell . .\Merge-SysmonXml.ps1 # List all available rule files in the repository Find-RulesInBasePath -BasePath C:\sysmon-modular\ # Output just the rule paths (useful for creating include/exclude lists) Find-RulesInBasePath -BasePath .\ -OutputRules | Out-File available_modules.txt ``` -------------------------------- ### Generate Default Sysmon Configuration Source: https://github.com/olafhartong/sysmon-modular/wiki/Configuration-options Clones the repository and merges all modules into a default balanced configuration, excluding high-volume events like FileDelete and ClipboardEvents. ```Powershell git clone https://github.com/olafhartong/sysmon-modular.git cd sysmon-modular . .\Merge-SysmonXml.ps1 Merge-AllSysmonXml -AsString -BasePath .\ -ExcludeList .\0_custom_configuration\file_delete_modules.txt | Out-File -Encoding utf8 sysmonconfig.xml ``` -------------------------------- ### Sysmon XML Rule Module Structure Source: https://context7.com/olafhartong/sysmon-modular/llms.txt The standard XML schema for individual Sysmon rule modules. Includes MITRE ATT&CK technique annotations within the rule definitions. ```xml FromBase64 http -EncodedCommand ``` -------------------------------- ### Define Inclusion Lists for PowerShell Source: https://context7.com/olafhartong/sysmon-modular/llms.txt A text-based format for specifying individual rule files or entire event category directories to be included in the generation process. ```text # Include individual rule files (one per line) 1_process_creation\exclude_adobe_acrobat.xml 3_network_connection_initiated\include_native_windows_tools.xml 12_13_14_registry_event\exclude_internet_explorer_settings.xml 17_18_pipe_event\include_winreg.xml 8_create_remote_thread\include_psinject.xml # Include entire event categories (directory names) 1_process_creation 5_process_ended 11_file_create 23_file_delete 7_image_load 17_18_pipe_event ``` -------------------------------- ### Generate Sysmon Configuration from Modules Source: https://context7.com/olafhartong/sysmon-modular/llms.txt Uses the Merge-AllSysmonXml function to combine multiple XML rule modules into a single configuration file. Supports filtering via include/exclude lists, base paths, and specific output modes like MDE augmentation or verbose logging. ```powershell . .\Merge-SysmonXml.ps1 # Generate default configuration from all modules in numbered directories Merge-AllSysmonXml -Path (Get-ChildItem '[0-9]*\*.xml') -AsString | Out-File -Encoding utf8 sysmonconfig.xml # Generate configuration using BasePath (auto-discovers all rule files) Merge-AllSysmonXml -AsString -BasePath C:\sysmon-modular\ # Generate configuration excluding specific modules Merge-AllSysmonXml -AsString -BasePath .\ -ExcludeList .\0_custom_configuration\file_delete_modules.txt | Out-File -Encoding utf8 sysmonconfig.xml # Generate configuration including only specific modules Merge-AllSysmonXml -AsString -BasePath .\ -IncludeList .\0_custom_configuration\include_rules.txt | Out-File -Encoding utf8 sysmonconfig.xml # Generate verbose configuration with detailed logging Merge-AllSysmonXml -AsString -BasePath .\ -VerboseLogging | Out-File -Encoding utf8 sysmonconfig-verbose.xml # Generate MDE augmentation configuration Merge-AllSysmonXml -AsString -BasePath .\ -MDEaugment | Out-File -Encoding utf8 sysmonconfig-mde-augment.xml # Preserve XML comments in output for documentation Merge-AllSysmonXml -AsString -BasePath .\ -PreserveComments | Out-File -Encoding utf8 sysmonconfig-documented.xml ``` -------------------------------- ### Define Rule Priority via CSV Source: https://context7.com/olafhartong/sysmon-modular/llms.txt A CSV format used by the Python generator to define file paths and rule precedence. Higher priority values ensure specific rules are processed with higher precedence. ```csv filepath,priority 1_process_creation/exclude_adobe_acrobat.xml,10 1_process_creation/include_bypass_uac.xml,100 1_process_creation/include_suspicious_powershell.xml,100 1_process_creation/include_shells.xml,1 10_process_access/include_lsass_access.xml,10 11_file_create/include_cve_2021_40444.xml,100 12_13_14_registry_event/include_windows_consent.xml,100 17_18_pipe_event/include_cobaltstrike.xml,10 3_network_connection_initiated/include_common_callback_ports.xml,1 ``` -------------------------------- ### Generate Sysmon Configuration via Python CLI Source: https://context7.com/olafhartong/sysmon-modular/llms.txt Uses the merge_sysmon_configs.py script to compile a Sysmon configuration from a CSV list of rules. Supports debug logging, stdout output, and custom groupRelation settings. ```bash python merge_sysmon_configs.py config_lists/default_list/default_list.csv -f csv -b templates/sysmon_template.xml -o sysmonconfig.xml python merge_sysmon_configs.py config_lists/default_list/default_list.csv -f csv -b templates/sysmon_template.xml -o sysmonconfig.xml --debug python merge_sysmon_configs.py config_lists/default_list/default_list.csv -f csv -b templates/sysmon_template.xml python merge_sysmon_configs.py config_lists/default_list/default_list.csv -f csv -b templates/sysmon_template.xml -o sysmonconfig.xml --no-force-grouprelation-or ``` -------------------------------- ### Optimize Sysmon Rule Groups with PowerShell Source: https://github.com/olafhartong/sysmon-modular/blob/master/README.md This PowerShell script iterates through Sysmon XML rule groups to identify and toggle empty 'exclude' rules to 'include'. This prevents excessive logging by ensuring that rules without defined conditions are safely handled. ```PowerShell foreach($rg in $sysmonconfig.SelectNodes("/Sysmon/EventFiltering/RuleGroup [*/@onmatch]")) { $ruleNodes = $rg.SelectNodes("./* [@onmatch]") if($ruleNodes -eq $null -or $ruleNodes.ChildNodes.count -gt 0) { continue } $ruleNode = $ruleNodes[0] if($ruleNode.onmatch -eq "exclude" -and $ruleNode.ChildNodes.count -eq 0 ) { $message = "{0} {1} has no matching conditions. Toggled to 'include' to limit output" -f $ruleNode.Name,$rg.Name Write-Warning $message $ruleNode.onmatch = "include" $comment = $sysmonconfig.CreateComment($message) $rg.AppendChild($comment) | Out-Null } } ``` -------------------------------- ### Merge Two Sysmon XML Documents Source: https://context7.com/olafhartong/sysmon-modular/llms.txt A low-level function to merge two specific XML configuration documents. It supports outputting the result as a string or saving directly to a file. ```powershell . .\Merge-SysmonXml.ps1 # Load two XML documents $source = [xml](Get-Content .\base_config.xml) $diff = [xml](Get-Content .\additional_rules.xml) # Merge the documents $merged = Merge-SysmonXml -Source $source -Diff $diff # Output as formatted string $merged = Merge-SysmonXml -Source $source -Diff $diff -AsString $merged | Out-File merged_config.xml # Merge with verbose logging enabled $merged = Merge-SysmonXml -Source $source -Diff $diff -VerboseLogging -AsString ``` -------------------------------- ### Sysmon Event ID Directory Structure Overview Source: https://context7.com/olafhartong/sysmon-modular/llms.txt This text-based representation outlines the directory structure used by the sysmon-modular project to organize rule modules. Each entry corresponds to a specific Sysmon Event ID and its associated rule type (include/exclude). ```text 1_process_creation/ # Event ID 1: Process Creation 2_file_create_time/ # Event ID 2: File Creation Time Changed 3_network_connection/ # Event ID 3: Network Connection Initiated 5_process_ended/ # Event ID 5: Process Terminated 6_driver_loaded/ # Event ID 6: Driver Loaded 7_image_load/ # Event ID 7: Image (DLL) Loaded 8_create_remote_thread/ # Event ID 8: CreateRemoteThread 9_raw_access_read/ # Event ID 9: RawAccessRead 10_process_access/ # Event ID 10: ProcessAccess 11_file_create/ # Event ID 11: FileCreate 12_13_14_registry_event/ # Event IDs 12-14: Registry Events 15_file_create_stream/ # Event ID 15: FileCreateStreamHash 17_18_pipe_event/ # Event IDs 17-18: Pipe Events 19_20_21_wmi_event/ # Event IDs 19-21: WMI Events 22_dns_query/ # Event ID 22: DNS Query 23_file_delete/ # Event ID 23: FileDelete (archived) 24_clipboard_change/ # Event ID 24: ClipboardChange 25_process_tampering/ # Event ID 25: ProcessTampering 26_file_delete_detected/ # Event ID 26: FileDeleteDetected 29_file_executable/ # Event ID 29: FileExecutableDetected ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.