sysmon_snapattack.xml

<!--
  snapattack_sysmon | a Sysmon configuration tuned for higher volume logging
  Requires Sysmon v13.30
  Last Updated: 2021-10-26

  NOTES:
  - Sysmon XML cannot use the AMPERSAND sign. Replace it with this: &amp;
  - If you only specify exclude for a filtering subsection, everything in that subsection is logged by default.
  - Duplicate or overlapping "Include" rules do not result in duplicate events being logged.
  - All characters enclosed by XML tags are always interpreted literally. Sysmon does not support wildcards (*), alternate characters, or RegEx.
  - "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path.

  FILTERING: Filter conditions available for use are: is, is not, contains, excludes, begin with, end with, less than, more than, image
-->

<Sysmon schemaversion="4.50">
    <HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms>
    <CheckRevocation/>

    <EventFiltering>
        <!--SYSMON EVENT ID 1 : PROCESS CREATION [ProcessCreate]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessID, Image, FileVersion, Description, Product, Company, CommandLine, CurrentDirectory, User, LogonGuid, LogonId, TerminalSessionId, IntegrityLevel, Hashes, ParentProcessGuid, ParentProcessId, ParentImage, ParentCommandLine, RuleName-->
        <RuleGroup name="" groupRelation="or">
            <ProcessCreate onmatch="exclude">
                <Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image>
                <Image condition="begin with">C:\Windows\capattack\</Image>
            </ProcessCreate>
        </RuleGroup>
    
        <!--SYSMON EVENT ID 2 : FILE CREATION TIME RETROACTIVELY CHANGED IN THE FILESYSTEM [FileCreateTime]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, PreviousCreationUtcTime-->
        <RuleGroup name="" groupRelation="or">
            <FileCreateTime onmatch="exclude">
                <Image condition="image">OneDrive.exe</Image> 
                <Image condition="image">msiexec.exe</Image>
                <Image condition="image">TrustedInstaller.exe</Image> 
                <Image condition="image">backgroundTaskHost.exe</Image>
                <Image condition="image">CompatTelRunner.exe</Image>
                <Image condition="image">cleanmgr.exe</Image>
                <Image condition="image">ProvTool.exe</Image>
                <Image condition="image">StartMenuExperienceHost.exe</Image>
                <Image condition="image">SearchApp.exe</Image>
            </FileCreateTime>
        </RuleGroup>

        <!--SYSMON EVENT ID 3 : NETWORK CONNECTION INITIATED [NetworkConnect]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, Image, User, Protocol, Initiated, SourceIsIpv6, SourceIp, SourceHostname, SourcePort, SourcePortName, DestinationIsIpV6, DestinationIp, DestinationHostname, DestinationPort, DestinationPortName-->
        <RuleGroup name="" groupRelation="or">
            <NetworkConnect onmatch="exclude">
                <Rule name="LLMNR" groupRelation="and">
                    <Image condition="is">C:\Windows\System32\svchost.exe</Image>
                    <SourceIp condition="is">224.0.0.252</SourceIp>
                    <SourceIp condition="is">ff02:0:0:0:0:0:1:3</SourceIp>
                </Rule>
                <Rule name="mDNS" groupRelation="and">
                    <Image condition="is">C:\Windows\System32\svchost.exe</Image>
                    <SourceIp condition="is">224.0.0.251</SourceIp>
                    <SourceIp condition="is">ff02:0:0:0:0:0:0:fb</SourceIp>
                </Rule>
                <Rule name="SSDP" groupRelation="and">
                    <Image condition="is">C:\Windows\System32\svchost.exe</Image>
                    <Image condition="is">C:\Windows\System32\dashost.exe</Image>
                    <SourceIp condition="is">239.255.255.250</SourceIp>
                    <SourceIp condition="is">ff02:0:0:0:0:0:0:c</SourceIp>
                </Rule>
            </NetworkConnect>
        </RuleGroup>
    
        <!--SYSMON EVENT ID 4 : RESERVED FOR SYSMON SERVICE STATUS MESSAGES-->
        <!--DATA: UtcTime, State, Version, SchemaVersion-->
        <!--Cannot be filtered.-->

        <!--SYSMON EVENT ID 5 : PROCESS ENDED [ProcessTerminate]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, Image-->
        <RuleGroup name="" groupRelation="or">
            <ProcessTerminate onmatch="exclude">
                <Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image>
                <Image condition="begin with">C:\Windows\capattack\</Image>
            </ProcessTerminate>
        </RuleGroup>

        <!--SYSMON EVENT ID 6 : DRIVER LOADED INTO KERNEL [DriverLoad]-->
        <!--DATA: UtcTime, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
        <RuleGroup name="" groupRelation="or">
            <DriverLoad onmatch="exclude">
                <!-- Log Everything -->
            </DriverLoad>
        </RuleGroup>

        <!--SYSMON EVENT ID 7 : DLL (IMAGE) LOADED BY PROCESS [ImageLoad]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, Image, ImageLoaded, Hashes, Signed, Signature, SignatureStatus-->
        <RuleGroup name="" groupRelation="or">
            <ImageLoad onmatch="exclude">
                <Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image>
                <Image condition="is">C:\Windows\System32\svchost.exe</Image>
                <Image condition="is">C:\Windows\System32\RuntimeBroker.exe</Image>
                <Image condition="is">C:\Windows\System32\backgroundTaskHost.exe</Image>
                <Image condition="is">C:\Windows\System32\taskhostw.exe</Image>
                <Image condition="is">C:\Windows\System32\conhost.exe</Image>
                <Image condition="image">skype.exe</Image>
                <Signature condition="is">Microsoft Windows</Signature>
                <SignatureStatus condition="is">Valid</SignatureStatus>
            </ImageLoad>
        </RuleGroup>

        <!--SYSMON EVENT ID 8 : REMOTE THREAD CREATED [CreateRemoteThread]-->
        <!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceImage, TargetProcessId, TargetImage, NewThreadId, StartAddress, StartModule, StartFunction-->
        <RuleGroup name="" groupRelation="or">
            <CreateRemoteThread onmatch="exclude">
                <!-- Low volume, but if you want to filter more, these take up about 85% of logs-->
                <!--
                <SourceImage condition="is">C:\Windows\System32\dwm.exe</SourceImage>
                <SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
                -->
            </CreateRemoteThread>
        </RuleGroup>

        <!--SYSMON EVENT ID 9 : RAW DISK ACCESS [RawAccessRead]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, Image, Device-->
        <RuleGroup name="" groupRelation="or">
            <RawAccessRead onmatch="exclude">
                <Image condition="is">C:\Windows\System32\svchost.exe</Image>
                <Image condition="is">SYSTEM</Image>
                <Image condition="image">SearchApp.exe</Image>
            </RawAccessRead>
        </RuleGroup>

        <!--SYSMON EVENT ID 10 : INTER-PROCESS ACCESS [ProcessAccess]-->  
        <!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceThreadId, SourceImage, TargetProcessGuid, TargetProcessId, TargetImage, GrantedAccess, CallTrace-->
        <RuleGroup name="" groupRelation="or">
            <ProcessAccess onmatch="exclude">
                <Rule name="svchost">
                    <SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
                    <TargetImage condition="is">C:\Windows\System32\svchost.exe</TargetImage>
                    <TargetImage condition="image">explorer.exe</TargetImage>
                    <TargetImage condition="image">SearchApp.exe</TargetImage>
                    <TargetImage condition="image">StartMenuExperienceHost.exe</TargetImage>
                    <TargetImage condition="image">ShellExperienceHost.exe</TargetImage>
                    <TargetImage condition="image">MemCompression</TargetImage>
                </Rule>
                <SourceImage condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</SourceImage>
                <SourceImage condition="is">C:\Windows\System32\runtimebroker.exe</SourceImage>
                <SourceImage condition="image">MsMpEng.exe</SourceImage>
                <TargetImage condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</TargetImage>
                <SourceImage condition="begin with">C:\Windows\capattack\</SourceImage>
                <TargetImage condition="begin with">C:\Windows\capattack\</TargetImage>
            </ProcessAccess>
        </RuleGroup>

        <!--SYSMON EVENT ID 11 : FILE CREATED [FileCreate]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime-->
        <RuleGroup name="" groupRelation="or">
            <FileCreate onmatch="exclude">
                <TargetFilename condition="begin with">C:\Program Files\SplunkUniversalForwarder</TargetFilename>
                <TargetFilename condition="begin with">C:\Windows\capattack\</TargetFilename>  
                <Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image>
                <Image condition="is">C:\Windows\system32\mobsync.exe</Image>        
                <Image condition="is">C:\WINDOWS\system32\svchost.exe</Image>
                <Image condition="is">System</Image>
                <Image condition="image">MsMpEng.exe</Image>
                <Image condition="image">OneDriveSetup.exe</Image>
                <Image condition="image">SearchApp.exe</Image>
                <Image condition="image">ProvTool.exe</Image>
                <Image condition="image">backgroundTaskHost.exe</Image>
            </FileCreate>
        </RuleGroup>

        <!--SYSMON EVENT ID 12 & 13 & 14 : REGISTRY MODIFICATION [RegistryEvent]-->
        <!--EVENT 12: "Registry object added or deleted"-->
        <!--EVENT 13: "Registry value set"-->
        <!--EVENT 14: "Registry objected renamed"-->
        <!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, TargetObject, Details (can't filter on), NewName (can't filter on)-->
        <RuleGroup name="" groupRelation="or">
            <RegistryEvent onmatch="exclude">
                <Image condition="is">C:\WINDOWS\Sysmon.exe</Image>
                <Image condition="is">C:\WINDOWS\Sysmon64.exe</Image>
                <Image condition="is">C:\WINDOWS\System32\svchost.exe</Image>
                <Image condition="is">C:\WINDOWS\System32\taskhostw.exe</Image>
                <Image condition="is">C:\WINDOWS\System32\backgroundTaskHost.exe</Image>
                <Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image>
                <Image condition="is">SYSTEM</Image>
                <Image condition="image">OneDriveSetup.exe</Image>
                <Image condition="end with">MicrosoftEdgeUpdate.exe</Image>
                <Image condition="end with">GoogleUpdate.exe</Image>
                <Rule name="locations">
                    <TargetObject condition="is">HKLM\System\CurrentControlSet\Control\Hvsi</TargetObject>
                    <TargetObject condition="end with">Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing</TargetObject>
                    <TargetObject condition="is">HKLM\DRIVERS\DriverDatabase\DriverPackages</TargetObject>
                    <TargetObject condition="is">HKLM\DRIVERS\DriverDatabase\DriverInfFiles</TargetObject>
                    <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows Search\CrawlScopeManager\Windows\SystemIndex</TargetObject>
                    <TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications</TargetObject>
                    <TargetObject condition="end with">SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization</TargetObject>
                    <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\SecurityManager</TargetObject>
                    <TargetObject condition="is">HKCR</TargetObject>
                    <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy</TargetObject>
                    <TargetObject condition="begin with">HKLM\System\CurrentControlSet\Services\Tcpip\Parameters</TargetObject>
                    <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\Capabilities</TargetObject>
                    <TargetObject condition="is">HKLM\SOFTWARE</TargetObject>
                    <TargetObject condition="is">HKLM\SOFTWARE\Microsoft</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\CA</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\CA\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\CA\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\CA\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Root</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Root\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Root\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Root\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Trust</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Trust\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Trust\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Trust\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\TrustedPeople</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\TrustedPeople\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\TrustedPeople\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\TrustedPeople\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Disallowed</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Disallowed\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Disallowed\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\EnterpriseCertificates\Disallowed\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\AuthRoot</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\AuthRoot\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\AuthRoot\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\AuthRoot\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\CA</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\CA\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\CA\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\CA\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\Disallowed</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\Disallowed\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\Disallowed\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\Disallowed\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\ROOT</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\ROOT\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\ROOT\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\ROOT\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\Root</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\Root\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\Root\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\Root\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\SmartCardRoot</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\SmartCardRoot\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\SmartCardRoot\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\SmartCardRoot\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\TrustedPeople</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\TrustedPeople\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\TrustedPeople\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\TrustedPeople\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\trust</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\trust\CRLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\trust\CTLs</TargetObject>
                    <TargetObject condition="end with">Microsoft\SystemCertificates\trust\Certificates</TargetObject>
                    <TargetObject condition="end with">Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\CA</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\CA\CRLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\CA\CTLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\CA\Certificates</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\Disallowed</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\Disallowed\CRLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\Disallowed\CTLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\Disallowed\Certificates</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\Root</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\Root\CRLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\Root\CTLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\TrustedPeople</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\trust</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\trust\CRLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\trust\CTLs</TargetObject>
                    <TargetObject condition="end with">Policies\Microsoft\SystemCertificates\trust\Certificates</TargetObject>
                </Rule>
            </RegistryEvent>
        </RuleGroup>

        <!--SYSMON EVENT ID 15 : ALTERNATE DATA STREAM CREATED [FileCreateStreamHash]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, Image, TargetFilename, CreationUtcTime, Hash-->
        <FileCreateStreamHash onmatch="exclude">
            <!-- Log Everything -->
        </FileCreateStreamHash>

        <!--SYSMON EVENT ID 16 : SYSMON CONFIGURATION CHANGE-->
        <!--DATA: UtcTime, Configuration, ConfigurationFileHash-->
        <!--Cannot be filtered.-->

        <!--SYSMON EVENT ID 17 & 18 : PIPE CREATED / PIPE CONNECTED [PipeEvent]-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, PipeName, Image-->
        <RuleGroup name="" groupRelation="or">
            <PipeEvent onmatch="exclude">
                <Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image>
                <Image condition="begin with">C:\Windows\capattack\</Image>
                <Image condition="is">C:\WINDOWS\system32\svchost.exe</Image>
                <Rule name="SearchIndexer">
                    <Image condition="is">C:\WINDOWS\system32\SearchIndexer.exe</Image>
                    <PipeName condition="is">\MsFteWds</PipeName>
                </Rule>
                <Rule name="wmiprvse">
                    <Image condition="is">C:\WINDOWS\system32\wbem\wmiprvse.exe</Image>
                    <PipeName condition="is">\srvsvc</PipeName>
                    <PipeName condition="is">\wkssvc</PipeName>
                    <PipeName condition="is">\lsass</PipeName>
                </Rule>
            </PipeEvent>
        </RuleGroup>

        <!--SYSMON EVENT ID 19 & 20 & 21 : WMI EVENT MONITORING [WmiEvent]-->
        <!--EVENT 19: "WmiEventFilter activity detected"-->
        <!--EVENT 20: "WmiEventConsumer activity detected"-->
        <!--EVENT 21: "WmiEventConsumerToFilter activity detected"-->
        <!--DATA: EventType, UtcTime, Operation, User, Name, Type, Destination, Consumer, Filter-->
        <RuleGroup name="" groupRelation="or">
            <WmiEvent onmatch="exclude">
                <!-- Log Everything -->
            </WmiEvent>
        </RuleGroup>

        <!--SYSMON EVENT ID 22 : DNS QUERY [DnsQuery]-->
        <!--EVENT 22: "Dns query"-->
        <RuleGroup name="" groupRelation="or">
            <DnsQuery onmatch="exclude">
                <Image condition="is">C:\Windows\Sysmon64.exe</Image>
                <Image condition="is">C:\Windows\Sysmon.exe</Image>
                <Image condition="is">C:\Windows\system32\svchost.exe</Image>
            </DnsQuery>
        </RuleGroup>

        <!--SYSMON EVENT ID 23 : FILE DELETE-->
        <!--DATA: UtcTime, ProcessGuid, ProcessId, Image, User, TargetFilename, Hashes, IsExecutable, Archived-->
        <RuleGroup name="" groupRelation="or">
            <FileDelete onmatch="exclude">
                <Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image>
                <Image condition="begin with">C:\Windows\capattack\</Image>
                <User condition="contains any">NETWORK SERVICE; LOCAL SERVICE</User>
            </FileDelete>
        </RuleGroup>

        <!--SYSMON EVENT ID 24 : CLIPBOARD EVENT MONITORING [ClipboardChange]-->
        <!--DATA: EventType, UtcTime, ProcessGuid, ProcessId, Image, Session, ClientInfo, Hashes, Archived -->
        <RuleGroup name="" groupRelation="or">
            <ClipboardChange onmatch="exclude">
                <!-- Log Everything -->
            </ClipboardChange>
        </RuleGroup>

        <!--SYSMON EVENT ID 25 : PROCESS TAMPERING [ProcessTampering]-->
        <!--DATA: EventType, RuleName, UtcTime, ProcessGuid, ProcessId, Image, Type -->
        <RuleGroup name="" groupRelation="or">
            <ProcessTampering onmatch="exclude">
                <Image condition="begin with">C:\Program Files\Mozilla Firefox\firefox.exe</Image>
                <Image condition="begin with">C:\Program Files (x86)\Microsoft\Edge\Application\</Image>
                <Image condition="contains">unknown process</Image>
            </ProcessTampering>
        </RuleGroup>

        <!--SYSMON EVENT ID 255 : ERROR-->
        <!--Cannot be filtered.-->

    </EventFiltering>
</Sysmon>