关于sysmon的基本使用(1)
sysmon的基本使用(1)
-
安装
下载地址 : https://download.sysinternals.com/files/Sysmon.zipInstall: Sysmon.exe -i <configfile> # 指定配置文件安装 sysmon -accepteula –i -n # 一键安装(使用sha1进行散列的过程映像，无网络监控) sysmon -accepteula -i -h md5，sha256 -n # 使用md5和sha256进行安装创建进程并监视网络连接 sysmon -accepteula -i c\windows\config.xml # 使用配置文件安装Sysmon [-h <[sha1|md5|sha256|imphash|*],...>] [-n [<process,...>]] [-l (<process,...>)] Configure: Sysmon.exe -c <configfile> # 从文件读取修改配置信息 sysmon –c -- # 修改配置信息为默认配置 sysmon -c # 转储配置文件 [--|[-h <[sha1|md5|sha256|imphash|*],...>] [-n [<process,...>]] [-l [<process,...>]]] Uninstall: Sysmon.exe -u # 卸载 # 注 : 安装需要管理员权限 操作系统 windows 7+ 上日志会写入到 Logs/Microsoft/Windows/Sysmon/Operational 低版本windows 会写入到 system日志
- 参数说明
-d # 指定已安装设备驱动程序映像的名称。 -c # 更新或显示配置 如果没有提供其他参数，则为当前配置。可选获取配置文件。 -h # 指定hash记录的算法 -i # 安装，可用xml文件来更新配置文件 -l # 记录加载模块，可指定进程 -m # 安装事件清单 -n # 记录网络链接 -r # 检测证书是否撤销 -u # 卸载服务和驱动 -s # 打印配置架构 -? config # 查看配置文件写法
-
配置文件说明
- 官方给出的配置文件例子:
<Sysmon schemaversion="4.21"> <HashAlgorithms>*HashAlgorithms> <EventFiltering> <DriverLoad onmatch="exclude"> <Signature condition="contains">microsoftSignature> <Signature condition="contains">windowsSignature> DriverLoad> <ProcessTerminate onmatch="include" /> <NetworkConnect onmatch="include"> <DestinationPort>443DestinationPort> <DestinationPort>80DestinationPort> NetworkConnect> <NetworkConnect onmatch="exclude"> <Image condition="end with">iexplore.exeImage> NetworkConnect> EventFiltering> Sysmon> -- 配置条目直接位于Sysmon 标签下, 过滤器位于 EventFiltering 标签下 - 过滤器标签
ProcessCreate 进程创建 FileCreateTime 文件创建时间更改 NetworkConnect 检测到网络连接 ProcessTerminate 进程终止 DriverLoad 驱动程序已加载 ImageLoad 镜像加载 CreateRemoteThread 已检测到创建远程线程 RawAccessRead 检测到原始访问读取 ProcessAccess 已访问的进程 FileCreate 文件创建 RegistryEvent 添加或删除注册表对象 RegistryEvent 注册表值设置 RegistryEvent 注册表对象已重命名 FileCreateStreamHash 已创建文件流 PipeEvent 管道创建 PipeEvent 管道已连接 WmiEvent 检测到WmiEventFilter活动 -- WmiEventFilter activity detected WmiEvent 检测到WmiEventConsumer活动 -- WmiEventConsumer activity detected WmiEvent 检测到WmiEventConsumerToFilter活动 -- WmiEventConsumerToFilter activity DnsQuery DNS查询 - 标签使用说明:
使用onmacth标记配置文件中 过滤器规则 include exclude include: 仅包含include的规则配置 exclude: 除去该规则配置, 其他全包含 PS: 例如，此规则将丢弃进程创建中 IntegrityLevel 为中等的任何流程事件Medium
- 过滤器标签的字段可以使用其他条件匹配该值
-------------------------------------- 注: 不区分大小写 -------------------------------------- 字段如下: is 默认值, 等于 is not 不等于 contains 包含 excludes 不包含 begin with 以此字段开始 end with 以此字段结束 less than 小于 more than 大于 image 匹配镜像路径(完整路径或仅镜像名称) 例如：lsass.exe将匹配c:\windows\system32\lsass.exe -----------------------------------------
- 规则组:
<EventFiltering> <RuleGroup name="group 1" groupRelation="and"> <ProcessCreate onmatch="include"> <Image condition="contains">timeout.exeImage> <CommandLine condition="contains">100CommandLine> ProcessCreate> RuleGroup> <RuleGroup groupRelation="or"> <ProcessTerminate onmatch="include"> <Image condition="contains">timeout.exeImage> <Image condition="contains">ping.exeImage> ProcessTerminate> RuleGroup> <ImageLoad onmatch="include"/> EventFiltering>要让sysmon报告哪个规则匹配导致记录事件，请向规则添加名称： <NetworkConnect onmatch="exclude"> <Image name="network iexplore" condition="contains">iexplore.exeImage> NetworkConnect>
- 官方给出的配置文件例子:
- 两个sysmon 配置文件
<Sysmon schemaversion="4.21"> <HashAlgorithms>md5,sha256HashAlgorithms> <CheckRevocation/> <EventFiltering> <RuleGroup name="" groupRelation="or"> <ProcessCreate onmatch="exclude"> <ParentCommandLine condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -EmbeddingParentCommandLine> <CommandLine condition="is"> "whoami" CommandLine> <CommandLine condition="is"> "systeminfo" CommandLine> <CommandLine condition="begin with"> "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" CommandLine> <CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /ProcessidCommandLine> <CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -EmbeddingCommandLine> <CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -secured -EmbeddingCommandLine> <CommandLine condition="is">C:\Windows\system32\wermgr.exe -uploadCommandLine> <CommandLine condition="is">C:\Windows\system32\SearchIndexer.exe /EmbeddingCommandLine> <CommandLine condition="is">C:\windows\system32\wermgr.exe -queuereportingCommandLine> <CommandLine condition="is">\??\C:\Windows\system32\autochk.exe *CommandLine> <CommandLine condition="is">\SystemRoot\System32\smss.exeCommandLine> <CommandLine condition="is">C:\Windows\System32\RuntimeBroker.exe -EmbeddingCommandLine> <Image condition="is">C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exeImage> <Image condition="is">C:\Windows\System32\TokenBrokerCookies.exeImage> <Image condition="is">C:\Windows\System32\plasrv.exeImage> <Image condition="is">C:\Windows\System32\wifitask.exeImage> <Image condition="is">C:\Windows\system32\CompatTelRunner.exeImage> <Image condition="is">C:\Windows\system32\PrintIsolationHost.exeImage> <Image condition="is">C:\Windows\system32\SppExtComObj.ExeImage> <Image condition="is">C:\Windows\system32\audiodg.exeImage> <Image condition="is">C:\Windows\system32\conhost.exeImage> <Image condition="is">C:\Windows\system32\mobsync.exeImage> <Image condition="is">C:\Windows\system32\musNotification.exeImage> <Image condition="is">C:\Windows\system32\musNotificationUx.exeImage> <Image condition="is">C:\Windows\system32\powercfg.exeImage> <Image condition="is">C:\Windows\system32\sndVol.exeImage> <Image condition="is">C:\Windows\system32\sppsvc.exeImage> <Image condition="is">C:\Windows\system32\wbem\WmiApSrv.exeImage> <IntegrityLevel condition="is">AppContainerIntegrityLevel> <ParentCommandLine condition="begin with">%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\WindowsParentCommandLine> <ParentCommandLine condition="is">C:\windows\system32\wermgr.exe -queuereportingParentCommandLine> <CommandLine condition="is">C:\WINDOWS\system32\devicecensus.exe UserCxtCommandLine> <CommandLine condition="is">C:\Windows\System32\usocoreworker.exe -EmbeddingCommandLine> <ParentImage condition="is">C:\Windows\system32\SearchIndexer.exeParentImage> <Image condition="begin with">C:\Program Files\Windows DefenderImage> <Image condition="is">C:\Windows\system32\MpSigStub.exeImage> <CommandLine condition="is">C:\WINDOWS\System32\svchost.exe -k SafeMonorCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -s StateRepositoryCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -p -s camsvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodelCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -p -s tiledatamodelsvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k camera -s FrameServerCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s LSMCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlayCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k defragsvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k imgsvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s EventSystemCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s bthservCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s nsiCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s w32TimeCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonationCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s DhcpCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLogCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -s BTAGServiceCommandLine> <CommandLine condition="is">C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbServiceCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestrictedCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p -s SSDPSRVCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNoNetworkCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnumCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationServiceCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbServiceCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorServiceCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputServiceCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpServiceCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnumCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s NgcSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -p -s NgcCtnrSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SCardSvrCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauservCommandLine> <CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnvCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHostCommandLine> <CommandLine condition="is">C:\Windows\System32\svchost.exe -k localSystemNetworkRestricted -p -s WdiSystemHostCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestrictedCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BDESVCCommandLine> <CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVCCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s BITSCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BITSCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s AppinfoCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s GpsvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SENSCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnvCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s ThemesCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s WinmgmtCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcsCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -p -s DoSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s DnscacheCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstationCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s NlaSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s TermServiceCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkServiceCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkServiceNetworkRestrictedCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k rPCSSCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k secsvcsCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k swprvCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k unistackSvcGroupCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k utcsvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wbioSvcGroupCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k werSvcGroupCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcCommandLine> <CommandLine condition="is">C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVCCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvcCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -s ClipSVCCommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappxCommandLine> <ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcsParentCommandLine> <ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestrictedParentCommandLine> <CommandLine condition="is">C:\Windows\system32\deviceenroller.exe /c /AutoEnrollMDMCommandLine> <CommandLine condition="begin with">"C:\Program Files (x86)\Microsoft\Edge Dev\Application\msedge.exe" --type=CommandLine> <CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeCommandLine> <CommandLine condition="begin with">C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Ngen.exeCommandLine> <Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeImage> <Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeImage> <Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeImage> <ParentCommandLine condition="contains">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exeParentCommandLine> <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeParentImage> <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exeParentImage> <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeParentImage> <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exeParentImage> <Image condition="is">C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXEImage> <Image condition="is">C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXEImage> <Image condition="is">C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXEImage> <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEImage> <Image condition="is">C:\Program Files\Microsoft Office\Office16\msoia.exeImage> <Image condition="is">C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exeImage> <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exeImage> <ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeParentImage> <ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exeParentImage> <Image condition="is">C:\Program Files\Windows Media Player\wmpnscfg.exeImage> <CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=CommandLine> <CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=CommandLine> <CommandLine condition="begin with">"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channelCommandLine> <CommandLine condition="begin with">"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channelCommandLine> <ParentImage condition="is">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exeParentImage> <Image condition="is">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exeImage> <Image condition="is">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exeImage> <Image condition="is">C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exeImage> <Image condition="is">C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exeImage> <Image condition="is">C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeImage> <Image condition="is">C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exeImage> <CommandLine condition="begin with">"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /CR CommandLine> <CommandLine condition="begin with">"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --channel=CommandLine> <Image condition="is">C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeImage> <Image condition="is">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exeImage> <ParentImage condition="is">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exeParentImage> <Image condition="is">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeImage> <Image condition="is">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exeImage> <Image condition="is">C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exeImage> <Image condition="is">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exeImage> <Image condition="is">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exeImage> <ParentImage condition="is">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exeParentImage> <Image condition="is">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exeImage> <ParentImage condition="is">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exeParentImage> <Image condition="is">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exeImage> <ParentImage condition="is">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exeParentImage> <ParentImage condition="is">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exeParentImage> <ParentImage condition="is">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exeParentImage> <ParentImage condition="is">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\agent.exeParentImage> <CommandLine condition="is">C:\Windows\system32\igfxsrvc.exe -EmbeddingCommandLine> <ParentImage condition="is">C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exeParentImage> ProcessCreate> RuleGroup> <RuleGroup name="" groupRelation="or"> <FileCreateTime onmatch="include"> <Image name="T1099" condition="begin with">C:\UsersImage> <TargetFilename name="T1099" condition="end with">.exeTargetFilename> <Image name="T1099" condition="begin with">\Device\HarddiskVolumeShadowCopyImage> FileCreateTime> <FileCreateTime onmatch="exclude"> <Image condition="image">OneDrive.exeImage> <Image condition="image">C:\Windows\system32\backgroundTaskHost.exeImage> <Image condition="contains">setupImage> <Image condition="contains">installImage> <Image condition="contains">Update\Image> <Image condition="end with">redist.exeImage> <Image condition="is">msiexec.exeImage> <Image condition="is">TrustedInstaller.exeImage> FileCreateTime> RuleGroup> <RuleGroup name="" groupRelation="or"> <NetworkConnect onmatch="include"> <Image name="Usermode" condition="begin with">C:\UsersImage> <Image name="Caution!" condition="begin with">C:\RecyleImage> <Image condition="begin with">C:\ProgramDataImage> <Image condition="begin with">C:\Windows\TempImage> <Image name="Caution!" condition="begin with">\Image> <Image name="Caution!" condition="begin with">C:\perflogsImage> <Image name="Caution!" condition="begin with">C:\intelImage> <Image name="Caution!" condition="begin with">C:\Windows\fontsImage> <Image name="Caution!" condition="begin with">C:\Windows\system32\configImage> <Image condition="image">at.exeImage> <Image condition="image">certutil.exeImage> <Image condition="image">cmd.exeImage> <Image condition="image">cmstp.exeImage> <Image condition="image">cscript.exeImage> <Image condition="image">driverquery.exeImage> <Image condition="image">dsquery.exeImage> <Image condition="image">hh.exeImage> <Image condition="image">infDefaultInstall.exeImage> <Image condition="image">java.exeImage> <Image condition="image">javaw.exeImage> <Image condition="image">javaws.exeImage> <Image condition="image">mmc.exeImage> <Image condition="image">msbuild.exeImage> <Image condition="image">mshta.exeImage> <Image condition="image">msiexec.exeImage> <Image condition="image">nbtstat.exeImage> <Image condition="image">net.exeImage> <Image condition="image">net1.exeImage> <Image condition="image">notepad.exeImage> <Image condition="image">nslookup.exeImage> <Image condition="image">powershell.exeImage> <Image condition="image">qprocess.exeImage> <Image condition="image">qwinsta.exeImage> <Image condition="image">qwinsta.exeImage> <Image condition="image">reg.exeImage> <Image condition="image">regsvcs.exeImage> <Image condition="image">regsvr32.exeImage> <Image condition="image">rundll32.exeImage> <Image condition="image">rwinsta.exeImage> <Image condition="image">sc.exeImage> <Image condition="image">schtasks.exeImage> <Image condition="image">taskkill.exeImage> <Image condition="image">tasklist.exeImage> <Image condition="image">wmic.exeImage> <Image condition="image">wscript.exeImage> <Image condition="image">nc.exeImage> <Image condition="image">ncat.exeImage> <Image condition="image">psexec.exeImage> <Image condition="image">psexesvc.exeImage> <Image condition="image">tor.exeImage> <Image condition="image">vnc.exeImage> <Image condition="image">vncservice.exeImage>