Author: hephaestus22Subject: Sysmon and compound filtering
Posted: 12 April 2016 at 2:57pm
Greetings all,
First off, thanks to the SysInternals team for all your great work on these great tools. I use them everyday. Here's my question:
I'm using Sysmon v3.2 to monitor endpoints, and have created filters to exclude most noisy events. However, I'm running into a problem trying to build rules that can do the following:
1. Monitor events where 'Image' is somewhere in the user's profile (C:\Users).
2. EXCLUDE events where the 'Image' is in a specific subfolder of C:\Users. In this case I need to exclude items in 'C:\Users\<username>\AppData\Local\Citrix\GoToMeeting', because those processes put lots of noise in the log.
Here's the filter I have set up, which is working fine except for the noisy Citrix processes:
<!-- DISABLE capture of image loads by default, EXCEPT items below: -->
<ImageLoad default="exclude">
<!-- Include Imageload events from processes in User directory-->
<Image condition="contains">C:\Users\</Image>
</ImageLoad>
According to the sysmon doc, filters are processed until events hit the first match so I'm trying to figure out how to work around that limitation. Any ideas? I tried the following, but it doesn't work properly and winds up logging ALL ImageLoad events. Logically though, this is what I'm trying to achieve:
<!-- DISABLE capture of image loads by default, EXCEPT items below: -->
<ImageLoad default="exclude">
<!-- Include Imageload events from processes in User directory-->
<Image condition="contains">C:\Users\</Image>
<Image condition="ends with">\Citrix\GoToMeeting\g2mupdate.exe</Image>
</ImageLoad>
Thanks in advance for your help.